To expand the number of operating systems and application programs that can run on a computer system, a field of technology has developed in which a given computer, called a host, will include an emulator program that allows the host computer to emulate other computing device configurations. The host computer can both run software configured for its native hardware and software configured for computers having different hardware configurations.
When a guest computer system is emulated on a host computer system, the guest computer system is called a “virtual machine” as the guest computer system only exists in the host computer system as a software representation of the operation of one specific hardware configuration that may diverge from the native machine. The virtual machine presents to the software operating on the virtual machine an emulated hardware configuration.
A virtual machine management system (sometimes referred to as a virtual machine monitor or a hypervisor) is also often employed to manage one or more virtual machines so that multiple virtual machines can run on a single computing device concurrently. The virtual machine management system runs directly on the native hardware and virtualizes the resources of the machine by exposing interfaces to virtual machines for access to the underlying hardware. A host operating system and a virtual machine management system may run side-by-side on the same physical hardware. For purposes of clarity will we use the abbreviation VMM to refer to all incarnations of a virtual machine management system.
One of the many advantages of a virtual machine (VM) over a physical machine is the ability to quickly and cheaply create multiple instances of the same virtual machine. The abstraction of the virtual machine from the underlying hardware provides for flexible resource allocation and facilitates the ability to move, or “migrate,” virtual machines from one host machine to another.
Being able to migrate a virtual machine quickly and easily from one host machine to another is useful, for example, for “load balancing” systems, performing hardware or software upgrades, or handling disaster recovery. More specifically, if a virtual machine requires more processing power than is available on one host machine, it can be moved to another host machine that has extra capacity. Second, if the host machine requires hardware maintenance or a software upgrade, the virtual machine may be migrated from one physical machine to another temporarily, which thereby allows the first physical machine to be taken down and upgraded. Similarly, in the case of disaster recovery, all virtual machines of a datacenter can be migrated to another datacenter that is out of harm's way and then migrated back when the threat passes. Additionally, virtual machines facilitate the offloading of a company or enterprises operation to a hosted datacenter simply to reduce the need for maintaining and upgrading resources. In all cases, this allows, for example, critical business applications to remain up and running without interruption and without the user even being aware of the interruption.
A virtual machine hard drive can be securely migrated or distributed. A key used to encrypt the virtual hard disk drive may be based on or protected by a unique value of a hardware device on the system hosting the virtual hard drive. Consequently, a copy of the key is protected by a service that is separate from the hosting system. The protected copy of the key is then distributed to one of more target systems destined to receive the virtual hard disk drive. The protected copy of the key can be recovered on the targets systems by authenticating the user of the target system. As a result, the key can be used to decrypt the virtual hard drive for use on the second computing device.
In on example, the hardware device on the first computing device comprises a trusted platform module. Typically, the virtual hard disk drive contains a guest operating system and application program. Preferably, the key protection mechanism includes encryption.
The foregoing summary, as well as the following detailed description of preferred embodiments, is better understood when read in conjunction with the appended drawings. For the purpose of illustrating the invention, there is shown in the drawings exemplary constructions of the invention; however, the invention is not limited to the specific methods and instrumentalities disclosed. In the drawings:
The inventive subject matter is described with specificity to meet statutory requirements. However, the description itself is not intended to limit the scope of this patent. Rather, the inventor has contemplated that the claimed subject matter might also be embodied in other ways, to include different combinations similar to the ones described in this document, in conjunction with other present or future technologies.
Numerous embodiments of the present invention may execute on a computer.
Referring now to
Depending on the specific physical implementation, severs may include a trusted platform module 30 (or TPM as it is referred to in the art). A TPM 30 and one or more of the processing units 21, and the system memory 22 can be physically co-located, such as on a single chip. In such a case, some or all of the system bus 23 can be, in part, nothing more than silicon pathways within a single chip structure and its illustration in
TPM 30 can comprise encryption keys for the encryption and decryption of information provided to it and it can further store values such that they are protected by the hardware design of the TPM 30 itself. Traditionally, the TPM 30 comprises an initial set of immutable public and private encryption keys that can be utilized, in a known and established manner, to obtain disposable public and private encryption keys. TPM 30 typically also has TPM-specific keys stored within the TPM 30 that can include any such set of private and public keys, and are not meant to refer to any specific encryption key set. In addition, the TPM 30 can comprise Platform Configuration Registers (PCRs) that can securely store data provided to the TPM 30 by the processing unit 21 via the system bus 23. In some embodiments, only specific code executed by the processing unit 21 would be permitted to send data to TPM 30 that would modify the values stored in the PCRs.
A number of program modules may be stored on the hard disk, magnetic disk 29, optical disk 31, ROM 24 or RAM 25, including an operating system 35, one or more application programs 36, other program modules 37 and program data 38. A user may enter commands and information into the computer 20 through input devices such as a keyboard 40 and pointing device 42. Other input devices (not shown) may include a microphone, joystick, game pad, satellite disk, scanner or the like. These and other input devices are often connected to the general purpose processing unit 21 through a serial port interface 46 that is coupled to the system bus, but may be connected by other interfaces, such as a parallel port, game port or universal serial bus (USB). A display 47 or other type of display device can also be connected to the system bus 23 via an interface, such as a video adapter 48. In addition to the display 47, computers typically include other peripheral output devices (not shown), such as speakers and printers. The exemplary system of
The computer 20 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 49. The remote computer 49 may be another computer, a server, a router, a network PC, a peer device or other common network node, and typically can include many or all of the elements described above relative to the computer 20, although only a memory storage device 50 has been illustrated in
When used in a LAN networking environment, the computer 20 can be connected to the LAN 51 through a network interface or adapter 53. When used in a WAN networking environment, the computer 20 can typically include a modem 54 or other means for establishing communications over the wide area network 52, such as the Internet. The modem 54, which may be internal or external, can be connected to the system bus 23 via the serial port interface 46. In a networked environment, program modules depicted relative to the computer 20, or portions thereof, may be stored in the remote memory storage device. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used. Moreover, while it is envisioned that numerous embodiments of the present disclosure are particularly well-suited for computerized systems, nothing in this document is intended to limit the disclosure to such embodiments.
Referring now to
Continuing with the description of
Generally, guest operating systems 220 through 222 can include any operating system such as, for example, operating systems from Microsoft®, Apple®, the open source community, etc. The guest operating systems can include user/kernel modes of operation and can have kernels that can include schedulers, memory managers, etc. Each guest operating system 220 through 222 can have associated file systems that can have applications stored thereon such as e-commerce servers, email servers, etc., and the guest operating systems themselves. The guest operating systems 220-222 can schedule threads to execute on the virtual processors 230-232 and instances of such applications can be effectuated.
As known and understood by those skilled in the art, a VHD is a virtualized device, logically equivalent to a physical hard drive device, that a virtual machine emulates for a guest operating system. (As used herein, the terms “hard disk,” “hard drive,” and “hard disk drive” may be used interchangeably.) In
It is not uncommon for an enterprise to have a repository of many VHDs. The VHDs can be deployed on VMMs residing on different physical servers across data centers and/or business locations. This capability is an important aspect of a dynamic IT environment. The VHDs and the repository are also exposed to security threats, whether by rogue IT administrators who have access to the enterprise IT infrastructure or by illicit copies being spirited out of the enterprise premises. The VHD copies could be booted on an unauthorized system with the appropriate VMM software. The risks are increased when an enterprise expands its IT operations to “edge” co-location data centers, or those that are operated by a hosting service vendor. In such environments, staff of the hosting company have authorized access to the physical servers running the various VHDs. It is difficult to protect against such staff compromising the security of the VHDs, thereby exposing an enterprise to intellectual property theft. The security risk limits the widespread adoption of hosted and cloud computing.
In the event that a need arises to migrate VM A from host server 20 to host server 20′, for any reason, the VHD can be transferred from one host to another or from a repository to a computing device and then booted on the new computing device.
There are additional complexities involved in the process of moving a VHD from one server to another. For example, because the VHD contains all of the information necessary to instantiate a copy of a computing system and run it on anther platform, security concerns are introduced. In particular, in some instances it my be necessary to replicate the VHD containing a virtual machine operating system image or mount it as a data volume for content retrieval or modification. However, such processes could be performed in an authorized or unauthorized manner. In order to protect against unauthorized uses, a fully configured and operational virtual machine can be distributed as an encrypted VHD. The operating system in the virtual hard disk can be temporarily disabled, using cryptographic techniques, prior to distribution. In that case, a user will be prompted to enter a single-use authorized recovery password on the first attempt to boot the operating system. The boot process will not succeed until this recovery process is successfully completed. The successfully booted virtual machine can use a platform hardware backed security device (e.g., trusted platform module) that is exposed by the virtualization software to re-seal the virtual machine. As a result, the software inside the virtual hard disk is prevented from executing on an unauthorized physical server.
As alluded to above, a TPM as is known in the art generally has an endorsement key that is created at manufacture time and cannot be changed. It also has an owner password and a storage root key that is used for implementing encrypted storage. The storage root key is created after the system is running and can later be cleared from the BIOS.
As can be understood from the above description, because the encryption is tied back to the TPM which has encryption keys that are embedded at manufacture time, the encrypted drive is tied to the particular TPM of the particular hardware. If an attempt is made to move the encrypted volume to different hardware, the SRK will not match. Consequently, neither the VMK nor the FVEK, which are protected by virtue of the VMK being protected, e.g., encrypted, by the keys of TPM in the source system, can be recovered and unauthorized use is prevented. As a result, because the VMK and FVEK are required to decrypt and encrypted a VHD, unauthorized use of the VHD can be similarly prevented.
TPM 502 can also be used to ensure that there is a chain of trust from the hardware device 20 during the boot process. In general the chain of trust process validates each component of hardware and software from the bottom up (bare metal, to firmware, to the operating system, and the application programs). To start the chain of trust, the processor must be in a known state, running known code. From this initial condition, each change of state checks that the previous state is valid. As an initial matter, the a system that boots up with a known secure boot process starts by checking the BIOS against the TPM keys. For example the BIOS performs a hash function and compares the value to a known value that is stored and signed with a TPM key. If the BIOS is verified, it can then check the master boot record and ensure that it is validated against a hash function, the master boot record then decrypts the operating system using a key that is obtained from the TPM. Each step of the process ensures that the next step in the process has been validated.
In the case of a virtual machine system, a similar process is employed. The TPM is used to encrypt the BIOS hash which follows the chain of trust through a trusted hypervisor and then to a trusted parent partition. The trusted parent partition then is used to ensure that the child partitions are trusted and so on. As shown in
In addition to the above, the OS in each virtual machine may also measure the boot path for the OS in that VM. For example, by storing hashes of certain aspects of the boot, e.g., the loading of boot record for the virtual hard drive, etc. This information is securely saved (sealed) into the security hardware device (e.g., the TPM) using keys. Once this process is complete, the OS in the VM can only be booted on that host server, i.e. it requires the boot measurement and key information to be available from the hardware security device.
According to an aspect of the invention, authorized moves of the VHD are facilitated. To that end, a recovery password mechanism can be used to decrypt the VEK on the target system. Once the VEK is recovered a VHD can be decrypted by the FVEK on new underlying hardware, either in it's entirety or in portions on demand.
Alternatively, the VHD can be moved in the clear but aspects of the chain of trust would still prevent unauthorized movement of the VHD. For instance, a VM that is locked to a host server when a VHD is moved to another host server, the VM's VHD file(s) are copied to the destination host server. At this point the OS in the VM cannot boot because the security services in the VM cannot access the boot measurement and key information from the hardware security device on the destination (or target) host server. To allow for authorized migration, the recovery password service would need to override the missing boot measurement information through authentication of the user. New boot measurement information would then be taken on the target system and used to lock the VHD to the destination system by storing the information in the security device on the destination server. This secondary security and the encryption of the VHD can be used separately or combined together to ensure that a VHD is not moved or migrated in an unauthorized manner.
When a VHD is migrated to a different computing device, the encryption keys associated with the prior TPM would not function to decode the VHD as described herein because the encryption key (VEK) is sealed in a protection mechanism, e.g., it is encrypted by the SRK of the TPM. As a result, the VHD will not operate on unauthorized hardware. To address that issue, in addition to the VEK being protected, e.g., encrypted, by the TPM of the source system, additional copies of the key can be encrypted by a service and provided along with the VHD or distributed separately from the VHD. In such a case, the VEK key can be recovered by receiving a decryption password from a service. For authorized users, the boot of the VHD on the new computing device will cause a request for a recovery password. The recovery password is then supplied to the user through a cryptographic service, that is used to recover the additional copy of the VEK. Thereafter the VEK is recovered and used to decrypt the FVEK. Both can be stored in the TPM of the target system and used to decrypt the VHD. The VEK, once decrypted, can be re-encrypted by the SRK of the target and bound to the target system through storage in the TPM.
In addition to the above embodiment, the entire VHD can be decrypted on the target system and re-encrypted on the target system. In such a case, new keys can be generated based on the TPM of the target system and thereby bound to the target system.
The various systems, methods, and techniques described herein may be implemented with hardware or software or, where appropriate, with a combination of both. Thus, the methods and apparatus of the present invention, or certain aspects or portions thereof, may take the form of program code (i.e., instructions) embodied in tangible media, such as floppy diskettes, CD-ROMs, hard drives, or any other machine-readable storage medium, wherein, when the program code is loaded into and executed by a machine, such as a computer, the machine becomes an apparatus for practicing the invention. In the case of program code execution on programmable computers, the computer will generally include a processor, a storage medium readable by the processor (including volatile and non-volatile memory and/or storage elements), at least one input device, and at least one output device. One or more programs are preferably implemented in a high level procedural or object oriented programming language to communicate with a computer system. However, the program(s) can be implemented in assembly or machine language, if desired. In any case, the language may be a compiled or interpreted language, and combined with hardware implementations.
The methods and apparatus of the present invention may also be embodied in the form of program code that is transmitted over some transmission medium, such as over electrical wiring or cabling, through fiber optics, or via any other form of transmission, wherein, when the program code is received and loaded into and executed by a machine, such as an EPROM, a gate array, a programmable logic device (PLD), a client computer, a video recorder or the like, the machine becomes an apparatus for practicing the invention. When implemented on a general-purpose processor, the program code combines with the processor to provide a unique apparatus that operates to perform the indexing functionality of the present invention.
While the present invention has been described in connection with the preferred embodiments of the various figures, it is to be understood that other similar embodiments may be used or modifications and additions may be made to the described embodiment for performing the same function of the present invention without deviating there from. For example, while exemplary embodiments of the invention are described in the context of digital devices emulating the functionality of personal computers, one skilled in the art will recognize that the present invention is not limited to such digital devices, as described in the present application may apply to any number of existing or emerging computing devices or environments, such as a gaming console, handheld computer, portable computer, etc. whether wired or wireless, and may be applied to any number of such computing devices connected via a communications network, and interacting across the network. Furthermore, it should be emphasized that a variety of computer platforms, including handheld device operating systems and other application specific hardware/software interface systems, are herein contemplated, especially as the number of wireless networked devices continues to proliferate. Therefore, the present invention should not be limited to any single embodiment, but rather construed in breadth and scope in accordance with the appended claims.
Finally, the disclosed embodiments described herein may be adapted for use in other processor architectures, computer-based systems, or system virtualizations, and such embodiments are expressly anticipated by the disclosures made herein and, thus, the present invention should not be limited to specific embodiments described herein but instead construed most broadly. Likewise, the use of synthetic instructions for purposes other than processor virtualization are also anticipated by the disclosures made herein, and any such utilization of synthetic instructions in contexts other than processor virtualization should be most broadly read into the disclosures made herein.