Patent Grant
11153322
The present disclosure relates generally to security systems, and more specifically to allowing air gapping security using virtual computing.
Air gapping is a security measure that involves isolating a computer from an external connection. For example, an air gapped computer is one that is physically segregated and incapable of connecting wirelessly or physically with other computers or network devices. Air gapped systems and networks are used to protect many types of critical systems, such as those utilized in industries including financial, military, government, utility facilities, and the like.
Preventing a computer or a network from accessing an external network significantly limits the productivity of users using such a computer or network. For example, an application executed on an “air gapped” computer cannot access any resource over the Internet. To do so, the user would need to use a different computer having access to the Internet.
In the related art, there are a number of solutions attempting to isolate different computing environments on a single computer. However, such solutions do not provide a complete air gapping architecture. Furthermore, such solutions often suffer from user experience issues.
As a prime example, isolation solutions are based on virtual machine (VM) technologies. VMs are containers in which applications and guest operating systems can be executed. By design, all VMs are isolated from one another. This isolation enables multiple virtual machines to run securely while sharing hardware.
Although virtual machines share hardware (e.g., CPU, memory, and I/O devices, etc.), a guest operating system running on an individual virtual machine cannot detect any device other than the virtual devices made available to the guest operating system. In various virtualization environments, a hypervisor acts as an interface between the guest operating system and the host operating system for some or all of the functions of the guests. A host operating system directly interacts with the hardware. A host operating system may be Windows®, Linux®, and the like.
Endpoints (e.g., desktop or laptop computer) configured with VM isolation do not provide a complete defense against malicious code. One vulnerability point in such virtualization environments is the host operating system. That is, hackers can exploit security vulnerabilities integrated in such operating systems to propagate malicious code to the hypervisors and then to the guest operating systems. Further, a user can install malicious software directly on the host operating systems (i.e., outside of the virtualization environment). To prevent users from installing software directly on the host operating system, such an operating system should be restricted. However, such an approach limits the user experience as the user cannot install applications, plug-ins, change settings, and so on.
In addition to limited operations that can be performed by users on endpoints configured with VM isolation, the look-and-feel of the computing environment is different from more familiar unrestricted endpoints. Many standard user experience (UX) features are not available at all on the restricted endpoints. For example, a user cannot view, on the endpoint's desktop, multiple windows of different applications executed on different VMs. As another example, the user cannot copy data (e.g., a text snippet) from an application executed in one VM's environment to another VM's environment. Having these and other UX functions disabled on restricted endpoints significantly limits the ability to freely and easily interact and perform actions on the user device, i.e., the endpoint. Thus, the UX is negatively affected. As a result, many users prefer to use unrestricted and unsecured endpoints with full UX capabilities.
It would therefore be advantageous to provide a solution that would overcome the deficiencies noted above.
A summary of several example embodiments of the disclosure follows. This summary is provided for the convenience of the reader to provide a basic understanding of such embodiments and does not wholly define the breadth of the disclosure. This summary is not an extensive overview of all contemplated embodiments, and is intended to neither identify key or critical elements of all embodiments nor to delineate the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a prelude to the more detailed description that is presented later. For convenience, the term “some embodiments” or “certain embodiments” may be used herein to refer to a single embodiment or multiple embodiments of the disclosure.
Certain embodiments disclosed herein include a method for seamlessly launching an application in an appropriate virtual machine, including: monitoring a plurality of virtual machines to detect at least one user request to be executed within a security zone; intercepting the user request and analyzing a level of permission required to complete the user request; determining an appropriate security zone in which to execute the user request, wherein the appropriate security zone has the required level of permission; and executing the user request in the appropriate security zone.
Certain embodiments disclosed herein also include a non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to: monitoring a plurality of virtual machines to detect at least one user request to be executed within a security zone; intercepting the user request and analyzing a level of permission required to complete the user request; determining an appropriate security zone in which to execute the user request, wherein the appropriate security zone has the required level of permission; and executing the user request in the appropriate security zone.
Certain embodiments disclosed herein also include a virtual machine system, including: a network card interface; a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: monitor a plurality of virtual machines to detect at least one user request to be executed within a security zone; intercept the user request and analyzing a level of permission required to complete the user request; determine an appropriate security zone in which to execute the user request, wherein the appropriate security zone has the required level of permission; and execute the user request in the appropriate security zone.
The subject matter disclosed herein is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other objects, features, and advantages of the disclosed embodiments will be apparent from the following detailed description taken in conjunction with the accompanying drawings.
It is important to note that the embodiments disclosed herein are only examples of the many advantageous uses of the innovative teachings herein. In general, statements made in the specification of the present application do not necessarily limit any of the various claimed embodiments. Moreover, some statements may apply to some inventive features but not to others. In general, unless otherwise indicated, singular elements may be in plural and vice versa with no loss of generality. In the drawings, like numerals refer to like parts through several views.
By way of example to the disclosed embodiments, a virtualized environment designed to secure endpoints from execution of malicious code is provided. Specifically, the disclosed embodiments allow for operation of any endpoint in a virtual air-gap mode, thereby ensuring that the endpoint is isolated from unsecured resources (such as networks, external drives, and the like). The disclosed virtualized environment allows for executing multiple applications in a number of different secured zones, while providing a seamless user experience.
In an embodiment, each zone is isolated from other zones, and each application that can be accessed by a user is executed in one of a few virtualized environments. In addition, the virtualized environment does not require a full host OS to interface between the security zones and the hardware of the endpoint. As another security measure, a user of the endpoint cannot configure or directly access any element of the underlying host environment.
The endpoint 100 includes hardware 120, that can be found in a standard desktop or laptop computer. The hardware 120 may include, for example, a processing circuitry (CPU) 121, a memory (Mem) 122, a storage 123, a network interface card (NIC) 124, input/output (I/O) peripherals (10P) 125, a graphics processing unit (GPU) 126, and a sound card (SC) 127. The processing circuity 121 may be realized by one or more hardware logic components and circuits. For example, and without limitation, a general-purpose microprocessor, a central processing unit (CPU), a multi-core CPU, a digital signal processor (DSP), and the like, or any other hardware logic components that can perform calculations or other manipulations of information. The memory 122 may be volatile (e.g., RAM, etc.), non-volatile (e.g., ROM, flash memory, etc.), or a combination thereof.
The storage 123 may be magnetic storage, optical storage, and the like and may be realized, for example, as flash memory or other memory technology, CD-ROM, Digital Versatile Disks (DVDs) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information. The NIC 124 allows the endpoint 100 to communicate with external networks over a wired connection, a wireless connection, or both.
The NIC 124 may transmit communication media, receive communication media, or both. For example, the NIC 124 may be in the form of a modem, an integrated network interface, a radio frequency transmitter/receiver, an infrared port, a USB connection, and the like.
The I/O peripheral 125 allows connectivity to external peripherals, such as a disk drive, printers, wireless keyboard, pointing device, a microphone, a speaker, a docking station, and the like. The I/O peripherals 125 may allow connectivity through USB ports, PS/2 ports, infrared ports, and the like. The GPU 126 provides connectivity to a monitor display. The sound card 127 (or audio card) provides input and output of audio signals to and from an endpoint under control of the guest OS.
It should be noted that other hardware components are included in a typical hardware of an endpoint which are not illustrated herein. Such components may include, but are not limited to, a motherboard, a power source, and the like.
According to the disclosed embodiments, the virtualized environment 110 is designed to provide a complete virtual air-gapping for a plurality of security zones 130-1 through 130-N, where N is an integer equal to or greater than 1 (hereinafter referred to individually as a security zone 130 and collectively as security zones 130, merely for simplicity purposes). The virtualized environment 110 is also arranged to include a hypervisor 140 controlling the security zones 130, a networking VM (N-VM) 150, and a primitive operating system (OS) 160.
Each security zone 130 is realized as a virtual machine executing a plurality of applications 131 over a guest OS 132. Each security zone 130 is configured to host applications based on their security and sensitivity levels. For example, a security zone 130 may be a corporate zone for general corporate applications, a personal zone for untrusted content and applications, a privileged IT zone for production applications, a financial zone for sensitive financial applications (e.g., SWIFT), a zone for critical infrastructure applications (e.g., SCADA), and so on.
Each security zone 130 is completely isolated from each of the other zones 130. That is, an application executed in zone 130-1 cannot access any content or applications accessed, stored, or executed in zone 130-2.
As an example, the zone 130-1 may be a trusted corporate zone (executing sensitive corporate applications) while the zone 130-2 can run applications that can access untrusted applications and resources. That is, the corporate zone 130-1 provides access to sensitive corporate resources and can be strictly locked down, while the personal zone 130-2 can provide free access to the Internet and allow the user to install and run any application.
According to the disclosed embodiments, the virtualized environment 110 provides a complete separation between the zones 130-1 and 130-2, thereby providing a complete air-gap between the zones. As will be discussed below, applications from different zones 130 are displayed on the same display, content can be copied from one zone to another (under a control of a user, and based on administrator-defined policy), and switching between zones is seamless. Thus, the virtualized environment 110 would allow improved productivity for users.
The operation of the security zones 130 is controlled by the hypervisor 140. Specifically, the hypervisor 140 is configured to instantiate a VM for each security zone 130. The applications 132 are executed in each corresponding VM. The hypervisor 140 is configured to present the zones 130, and hence the applications 131 executed therein, with a unified user experience (UX).
According to an embodiment, the hypervisor 140 is also configured to instantiate the N-VM 150. The N-VM 150 is not accessible to the user, i.e., no user applications are executed therein and no local configuration of the N-VM 150 is allowed. The N-VM 150 is configured to control and regulate access to the external networks (not shown in
According to the disclosed embodiments, after instantiating the VMs of the zones 130 and the N-VM 150, the hypervisor 140 is configured to virtualize the components of the hypervisor 140. That is, for each guest OS 132, the hypervisor 140 provides a limited set of virtualized hardware services. For example, when the user is in a security zone 130-1 access to a microphone may be permitted to access the applications 131 running in that zone.
In an embodiment, the hypervisor 140 is configured to instantiate and control the VMs, as well as to virtualize hardware services to such VMs. This allows for programming the hypervisor 140 with a significantly lower number of code lines, thereby reducing the risks of vulnerabilities that can be exploited by, for example, the guest OS 132. In an embodiment, controlling the VMs (zones 130) includes enforcing security policies for each zone, as discussed in greater detail below.
The hypervisor 140 also includes an optimization module 230 configured to perform optimization processes to accelerate or otherwise improve the operation of the native hypervisors 220. Such optimization processes include, but are not limited to, display optimization (3D and graphic rendering), audio optimization (playback and audio recordings), and power optimization.
In an embodiment, the audio optimization includes bypassing all emulation layers, typically performed by a standard native hypervisor when emulating a sound card (e.g., sound card 127,
In another embodiment, the display optimization includes causing the GPU (e.g., GPU 126,
In yet another embodiment, the power optimization is designed to extend the operating hours of a battery (not shown). The virtualized environment (110,
The optimization module 230 is configured to “freeze” all virtual machines (i.e., switch their current states to an idle state) that do not have an active foreground window. In their idle state, VMs no longer consume CPU or perform I/O operations and the memory state of each idle VM remains at the latest state. The applications executed in the idle (frozen) VMs are displayed in their last state before the freeze operation. When the user switches the focus back to one of the frozen VMs, the optimization module 236 changes its state to that of a normal operation. It should be noted that the power optimization provides a security benefit, as a frozen VM cannot be attacked because it does not have any attack-vulnerable surface at that time.
According to the disclosed embodiments, the hypervisor 140 also includes a security module 240 configured to directly communicate with the VMs 130 and 150. That is, any request to access the hypervisor 140 is received and handled by the security module 240. In an embodiment, a request (or command) to access a resource of the hypervisor 140 is captured by the security module 240 such that the request does not reach the OS 160. For example, a keyboard shortcut (e.g., Ctrl+C) would be captured and handled by the hypervisor 140. That is, the hypervisor 140 disclosed herein prevents any interfacing of a user device with the primitive OS 160. The security module 240 is configured to monitor and control the operation of other UX functions, such as URL redirection and rendering of unified desktop's display. Such UX functions are discussed in greater detail below.
Returning to
In an embodiment, the primitive OS 160 is configured to execute only pre-signed code. Thus, any malware code will not be executed by the primitive OS 160. In yet another embodiment, the primitive OS 160 cannot access the NIC 124, thus, cannot access an external network. The communication is performed through the N-VM 150. To this end, any TCP/IP activity by the primitive OS is controlled and restricted by the N-VM 150.
In an example implementation, the primitive OS 160 may implement a virtual NIC (not shown) configured with a virtual IP to allow communication with the N-VM 150. In yet another embodiment, the files of the primitive OS 160 are non-persistent, ensuring that the primitive OS 160 is reset to its original configuration after each boot of the endpoint 100. In yet another embodiment, the files of the primitive OS 160 are encrypted, so that cannot be tampered or manipulated.
In an embodiment, the primitive OS 160 may be, for example, Windows®, Mac OS®, or Linux®, that has been configured to allow only execution of drivers and to eliminate any functionality as discussed herein.
The N-VM 150 is configured to manage network connectivity. That is, the N-VM 150 is configured to monitor and police all communications between the applications 131 in the different security zones 130 and external networks (not shown in
In an embodiment, all network access requests are routed to the N-VM 150. In response, the N-VM 150 is configured to identify the security zone 130 (i.e., a VM) requesting access to an external network. The N-VM 150 allows or denies the access request based on the network policy determined for the requesting zone. As an example, requests from a personal zone to a corporate network will be blocked by the N-VM 150, while requests from a corporate network to the same network will be allowed. The network policies are pre-configured using, for example, a management server (not shown in
It should be appreciated that the primitive OS 160, the hypervisor 140, or both, do not manage the network connection, and as such do not allow or deny connections to external networks. It should be further appreciated that physical connection to the external networks are established through the NIC 124 under the control of the N-VM 150. The N-VM 150 operates in a non-persistent mode and is reverted to its initial state upon each connect or disconnect event, adding another layer of security in case the N-VM somehow becomes infected.
In an embodiment, the N-VM 150 is configured to perform network identification at various layers, e.g., a MAC layer, a TCP/IP layer, and an application layer (e.g., HTTPS or SSL identification). In another embodiment, the network policies can be enforced by applying access control or firewall rules at TCP/IP or application layers (e.g., layers 4 or 7 of the OSI module). In yet another embodiment, the N-VM 150 is configured to allow connection using VLAN tags or through DHCP proxy implemented in the N-VM 150.
It should be appreciated that the virtualized environment 110 provides a complete virtual air-gapping secured solution to applications executed in each security zone even if one or more of the zones becomes vulnerable. The design of the virtualized environment 110 assumes that all VMs, guest OSs, and applications executed in the zones 130 are not trusted. Additional layers of protection are achieved by means of the hypervisor 140, the N-VM 150, and the limited functionality of the primitive OS 160.
In an example scenario, a corporate zone (e.g., one of the security zones 130) is infected by a malicious bot communicating with a command-and-control server. According to the disclosed embodiments, the bot cannot communicate with its command-and-control server over the Internet, as such access attempt will be blocked by the N-VM 150. That is, the N-VM 150 may allow access to an internal corporate network or a whitelisted set of cloud hosts, as defined in a network policy for the corporate zone, and block access to any other network location.
In an embodiment, VMs of the security zones 130 are non-persistent. That is, the VMs are initialized to an original configuration after each boot, logoff, application event, and so on. That is, VMs infected with malware will return to their initial “clean” state after, e.g., each boot.
The operation of the security zones 130 is also regulated by additional preconfigured policies. In an embodiment, illustrated in
In an example embodiment, the UX policy 320 defines which user interface actions are allowed to be performed by the user in the respective zone. Examples for such actions include, but are not limited to, clipboard use, printing, screenshotting, and the like. As a non-limiting example, the UX policy 320 can define if the user can copy content and paste such content in a different zone, or if content from a different zone can be pasted in the current zone. Content may include, for example, text, images, files and the like. The UX policy 320 may also designate what type of content can be copied, pasted, or both.
In an embodiment, the cross-transfer of content between security zones is allowed only when explicitly approved by the user. This ensures that malware cannot copy content from one zone to another.
The browsing policy 330 defines a whitelist of URLs, domain names, or other network locations that can be accessed from a browser executed in the respective zone. This allows, for example, blocking browsers from accessing malicious URLs when the user mistakenly browses to such URLs in the wrong security zone. In an optional embodiment, the blocked URL can be accessed and launched in another security zone which is allowed to access that URL. It should be noted that the browsing policy 330 is different from the network policy 310 in that it restricts access to certain URLs after a network connection has already been established per the network policy. The network policy 310 is discussed above.
The connectivity policy 340 defines a set of allowed peripheral devices through wired or wireless connections. As an example, the connectivity policy 340 may define if connections through a USB plug are allowed or restricted. Restricted connectivity may limit all connections or connections to designated USB devices (e.g., printers may be allowed, while flash drives may be prohibited). Examples for other wired connections may include, for example, DisplayPort, Thunderbolt™, HDMI®, PS/2, and the like. Wireless connections may include short range connections that allow wireless docking of peripheral devices (e.g., WiGig™), and the like.
Returning to
In one embodiment, the applications from the secondary zone can be displayed on the endpoint's display providing the user with the ability to interact with applications from different zones. Windows of applications from different zones are optionally marked differently.
In another embodiment, the security policy for the security zone is also defined through the management server 430. As noted above in
In an embodiment, the management server 430 may include preconfigured security zones and policies that can be easily uploaded to a new endpoint. In yet another embodiment, the management server 430 can be utilized to clone security zones from one endpoint to another. Therefore, the management server 430 simplifies the process of reconfiguring new endpoints.
As shown in
According to the disclosed embodiments, the management server 430 is a secured device. As such, only specific designated endpoints can access the management server 430. In an embodiment, the server 430 accepts connection requests from endpoints including valid certificates, e.g., SSL client certificates. Such certificates are installed only on the designated endpoints.
In the example diagram shown in
Furthermore, when the management server 430 accesses any of endpoints 410-1 through 410-M, the access is performed over a secured connection. Any connection attempt made by the management server 430 to an endpoint 410-1 through 410-M is verified by a hypervisor (e.g., the hypervisor 140 of
The management server 430 may be structured as a computing device including a processing circuitry coupled to a memory, a storage, and a network interface (not shown in
The processing circuitry may be realized as one or more hardware logic components and circuits. For example, and without limitation, illustrative types of hardware logic components that can be used include field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), Application-specific standard products (ASSPs), system-on-a-chip systems (SOCs), general-purpose microprocessors, microcontrollers, digital signal processors (DSPs), and the like, or any other hardware logic components that can perform calculations or other manipulations of information.
The memory may be volatile (e.g., RAM, etc.), non-volatile (e.g., ROM, flash memory, etc.), or a combination thereof. In one configuration, computer readable instructions to implement one or more embodiments disclosed herein may be stored in the storage.
In another embodiment, the memory is configured to store software. Software shall be construed broadly to mean any type of instructions, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise. Instructions may include code (e.g., in source code format, binary code format, executable code format, or any other suitable format of code). The instructions, when executed by the one or more processors, cause the processing circuitry to perform the various processes described herein with respect to the operation of the management server, such as configuring security zones and policies with the endpoints.
The storage may be magnetic storage, optical storage, and the like, and may be realized, for example, as flash memory or other memory technology, CD-ROM, Digital Versatile Disks (DVDs), or any other medium which can be used to store the desired information. The storage may store the received templates of security zones, policies defined for each zone, SSL certificates, configuration of entire secured zones, and so on.
The various embodiments disclosed herein allow for operation of the air-gapped endpoint 100 with an enhanced and seamless user experience. A user using the air-gapped endpoint 100 would experience the same look-and-feel of a traditional (unrestricted) endpoint. To this end, various UX features are implemented by the hypervisor 140 in the virtualized environment 110.
In an embodiment, one of the UX features includes enabling the display of multiple application windows executed in different security zones over the endpoint's 100 desktop. This feature is further demonstrated in
In another embodiment, only applications of the primary security zone are displayed. In order to display windows of applications from the secondary security zone, application windows in the primary security zone are hidden and the application windows in the secondary security zone are exclusively shown. The switching between zones can be performed using a predefined UX command (e.g., a keyboard shortcut, such as Ctrl+F1, a GUI element, such as an icon or a taskbar shortcut, and the like).
It should be emphasized that regardless of the display mode, applications executed in different zones cannot access each other. There is a complete separation between zones and applications and guest OS executed therein. However, from the user's perspective, the user can access any window and interact with the applications executed therein seamlessly.
The display of multiple windows of different security zones is controlled by the hypervisor 140 (
The hypervisor 140 is configured to render a first layer illustrating a desktop view of a first security zone. Such desktop view includes all active windows. Then, the hypervisor 140 renders a cropped desktop display of the second security zone, only displaying the clipped regions of windows that should be displayed to maintain the Z-order by the user. As such, the desktop's display would provide an illusion of a single window manager/desktop environment.
At S610, the user activity is monitored to at least provide an indication of current window relationships. This may include the relationships of windows operable in each security zone and their z-order.
At S620, a first layer presenting a desktop of the first security zone is rendered. The first layer includes all applications executed in the first zone arranged according to their order and size as set by the user.
At S630, a second layer presenting a cropped desktop display of the second security zone is rendered. As noted above, this second layer only includes regions of windows that should be displayed to maintain the z-order set by the user. In an embodiment, border lines of windows in the first and second desktops are marked differently, e.g., by different colors, to distinguish between the different security zones.
At S640, the first layer of the first desktop is presented in its entirety on the endpoint's display. That is, all windows of the first desktop are presented. Then, at S650, the second layer, i.e., the cropped regions, are displayed on top of the first layer. The cropped display includes only the clipped regions of windows that should be displayed to maintain the z-order.
It should be noted that the user activity is continuously monitored, and any changes in the windows arrangement (e.g., changing location, order, size, closing an application, and/or launching an application) would trigger a re-cropping of the first and second layers, thus changing the user's view to keep the illusion of a single desktop's display.
It should be further noted that the first and second security zone can be, without limitation, a primary and secondary security zone, respectively. In an embodiment, when a user toggles from the primary to the secondary security zone, the first and second layers are switched as well. That is, the second layer would be displayed in its entirety, and a cropped version of the first layer would be displayed on top of the second layer.
Illustrative diagrams showing the various arrangement of windows are shown in
In another embodiment, discussed with reference to
As noted above, the user activity is continuously monitored, and any attempt by a user to modify position, dimensions, state, or a combination thereof, of a guest entity while the virtual clipping layer is active may be identified. The modification may be applied to the single desktop environment, such that the modification as a result of user interaction to a graphical user interface in a form of overlapping windows is updated in real-time.
The modification can be additionally configured to toggle the activation of the first virtual layer and the second virtual layer in the graphical user interface interchangeably based on a user interaction, where the user interaction involves manipulation by the user of the interface using the integrated access of the mouse, keyboard, screen, and resources in the single user interface comprising a single desktop environment. The user interaction includes managing changes to applications and interface components of the displayed environments based on default security policies, predetermined security policies, or both, using the integrated access to the mouse, keyboard, screen, and resources in the single user interface comprising a single desktop environment in real-time.
In an example embodiment, the integrated access of the mouse, keyboard, screen, and resources in the single user interface comprising a single desktop environment in real-time acquires a priority condition based on the default security policies, predetermined security policies, or both. For example, the keyboard can be redirected to the VM that the top entity (guest window) belongs to. The host can also show special entities (e.g., special host windows that allow global settings to be changed), that can be displayed on top of all security zones.
The clipping action will isolate an area in the second VM in the area of the host entity. The allows the host entity to appear as the top window. The modification can also be configured to toggle the activation of the first virtual layer and the second virtual layer in the graphical user interface interchangeably based on the user interaction.
In an embodiment, entities (guest windows) of the second security zone can be represented in the task-bar and in an app-switcher (e.g., as initiated by a keyboard shortcut, such as ALT+TAB) with the corresponding icons, even though they are not running on the respective VM. This creates an illusion for the user that the entities from the second security zone are running on the first security zone. That is, it appears to the user that applications from both security zones are executed on the first (primary) security zone.
According to the disclosed embodiments, a single-sign-on (SSO) function is provided in order to ease the log-in to the air-gapped endpoint. Specifically, the SSO allows a user of the end-point to log-in once to one of the security zones (e.g., to a guest operating system executed therein) and then to seamlessly log into the other security zones without providing login credentials a second time.
In order to the allow the SSO function, all guest operating systems are booted when a user logs into a primary security zone (e.g., zone 130-1 of
The hypervisor then automatically provides the credentials to all other guest operating systems that have been booted. In some configurations, each guest OS is configured with a proxy component that captures the credentials and passes them to the hypervisor. The proxy component can also perform an automatic login process using the user's credentials provided by the hypervisor.
In an embodiment, when the hypervisor receives a message indicating that the user has locked a guest OS of the primary operating system, the hypervisor is configured to automatically lock the other guest operating systems executed in the other security zones.
According to another embodiment, cross-transfer of content between security zones is provided. This UX function allows the user to seamlessly use a single keyboard to copy and paste content across different zones. For example, a user can mark and copy content from one application in one security zone and paste that content to another application in a different zone. The process for cross-transfer of content is secured and controlled by the hypervisor (the hypervisor 140 of
To this end, the hypervisor is configured to monitor all UX commands executed by the user of the endpoint, including, but not limited to, keystrokes. When a copy command is detected (e.g., Ctrl+C or a mouse selection), a process (e.g., an agent) running in the zone the content was copied from notifies the hypervisor on the copied content and the zone (of VM) ID.
When the hypervisor detects a paste command (e.g., Ctrl+V), the hypervisor identifies the target zone to paste the content, and determines if the operation is permitted. The determination, in one embodiment, is based on the UX policy. If the content transfer is allowed, the hypervisor notifies the user via a designated notification that a cross-VM transfer is taking place. The user can be prompted to approve the content transfer. In an embodiment, an approval dialog box is displayed to the user in a trusted host window. Malware running in one of the guest VMs cannot view, access, or control the dialog box or any buttons therein.
It should be appreciated that only physical keystrokes or mouse clicks that have been detected would trigger an actual content transfer. This prevents a malware application executed in a security zone to initiate content transfer.
In yet another embodiment, to enhance the user experience when interacting with an air-gapped endpoint, a browser application is enabled in each security zone, as long as the requested URL is not malicious or blocked by the browsing policy of each zone. According to this embodiment, the hypervisor 140 is configured to monitor any URL accessed by a user. When the user is not permitted to access the requested website in one security zone, the hypervisor 140 can redirect the request to another security zone, if such a zone exists, and to automatically open the website in that zone. That is, the hypervisor would cause the VM to launch a browser in the zone that the URL is redirected to. It should be appreciated that the automatically launching of websites provides a seamless browsing experience, as the user is not aware that the original access attempt has been blocked or redirected.
For example, if the user attempts to access www.facebook.com from a corporate security zone, such a request may be directed to the personal security zone so that the user can access the website from that security zone.
In an embodiment, to prevent a malware application from using the URL redirection capability to leak data between the environments, the URL redirection is enabled only when such operation is acknowledged by the user and/or when physical keystrokes or mouse clicks are detected.
As noted above, the various UX functions discussed herein as being performed or otherwise controlled by the hypervisor (e.g., the hypervisor 140). The hypervisor is configured to control the security zones of a networking VM (N-VM), and a primitive operating system (OS). In an embodiment, the component in the hypervisor controlling the UX functions is the security module 240, described with reference to
The method, in an embodiment, is performed by a hypervisor operable in a virtualized environment of the endpoint. The hypervisor is initialized to be executed over a primitive OS. The initialization occurs when the endpoint boots. As discussed in detail above, the primitive OS is a limited version of an OS designed to only run drivers of hardware components.
Prior to the execution of the method, multiple secure zones are created in the endpoint by initiating a plurality of VMs by a hypervisor executed over a primitive OS. Each VM runs its own guest OS and a set of applications. A security policy is associated with each security zone defining at least one of, or a combination of: a network policy, a UX policy, a browsing policy, and a connectivity policy. The type of the guest OS, applications and policies of each security zone can be retrieved from the management server, e.g., the server 530. In an embodiment, an operating system (OS) booted with the endpoint may be migrated to operate as one of the guest OSs. In an embodiment, a networking VM may be instantiated by the hypervisor. The networking VM is configured with the network policy of each security zone.
At S910, execution of the applications and guest OS in the security zones are monitored to detect at least UX commands, requests, or actions (collectively referred as UX command or commands). Such UX commands may include a request to open a new application window, resize an open window, copy content, paste content, launch a website, and so on. Any monitored UX command may include the requested function to be performed (e.g., resize window), source VM (zone), and destination zone, if applicable.
At S920, for each monitored command, it is determined if the execution of the UX command would affect at least one security zone differently than the zone from which the command was initiated. That is, the UX command, if performed, not only would affect a primary security zone (executing applications in the foreground), but also applications executed in the background by VMs in a secondary security zone. It should be noted that the primary security zone is also executed in a VM.
At S930, it is determined if execution of such UX commands would trigger a UX function that would maintain compliance with the security policy, and in particular with the UX policy. For example, a UX command may be a copy command (CTRL+C). This may trigger a UX function of cross-transfer of content. If the UX policy does not allow such transfer, the operation is blocked.
If the determination as S930 in is the affirmative and results with a Yes answer, execution proceeds with S940; otherwise, execution returns to S910.
At S940, a UX function triggered by the UX command is performed. Examples for such UX functions include rendering of a unified desktop's display when two or more security zones are concurrently executed in the virtualized environment. The unified desktop can display applications from different zones in different windows. In an embodiment, windows of applications from different zones are visually distinguished. The unified desktop UX function can be triggered, for example, by launching an application in another security zone.
Another example of a UX function is the transfer of content (copy-paste) across different security zones. Yet another example of a UX function is a redirection of URLs. As yet another example of a UX function is an SSO to multiple different security zones. Those functions are further discussed in detail herein.
The UX command may also refer to changing settings of the display. This would allow a user to set the display settings in one zone, and the hypervisor would apply the same settings to other zones. Examples for such preferences include a display's resolution, orientation, color, brightness, scale, and the like.
At S1020, the user request to launch application is intercepted and analyzed, e.g., by a networking VM, to determine what level of permissions are required to complete the request, and which security zone is appropriate to fulfill the request. For example, if the user request includes launching a web browser and visiting a website, the nature of the website, e.g., secured or trusted versus non-secured or non-trusted, is determined. In an embodiment, it is checked if the requested URL is included in a whitelist or in a blacklist associated with the security zone. In another embodiment, a third-party proxy is queried with the requested URL.
At S1025, if the request is not allowed (e.g., the URL cannot be accessed in the security zone), an HTML page is generated and sent to the browser. In an embodiment, the HTML page includes script code (e.g., JavaScript). The script code, when executed on the browser, determines if the request was triggered by a user (human) or a process trying to access a web resource. According to the disclosed embodiments, any attempt to launch the web browser made by a process (not a user) is blocked; otherwise, the script code caused the launching of the web browser in the appropriate security zone. Then, execution continues with S1030.
At S1030, it is determined if the mode of air-gapped endpoint is set up as manual or automatic. In manual mode, at S1040, a request confirmation is sent to a user before redirecting to an appropriate security zone. In this mode, before redirecting, the hypervisor asks a human operator for confirmation (e.g., via a dialog that the hypervisor displays that cannot be accessed from a guest operating system executed in the VM). The user request is only executed once an affirmative confirmation is received from the human operator of the device by clicking on the topmost hypervisor-generated dialog. Thus, malware running in the VM or guest OS cannot cause a redirect without human approval, even if such malware attempts to emulate keyboard or mouse operations.
In an embodiment, in an automatic mode, at S1045, the browser is redirected to an appropriate security zone without further user input. The automatic redirection is based on recent physical user activity. For example, the redirection happens automatically only if a human operator (user) had recently been active using a keyboard or mouse on a user device. Detecting keyboard or mouse activity cannot be tampered by malware on the guest device, as the hypervisor controls the physical hardware (and employs physical device control to detect such activity), while malware is limited to tampering with a virtual keyboard or mouse on the guest device. Furthermore, the user may receive a notification about each redirection and may be offered an option of reporting that such a request was not initiated by the user, which can help detect unwanted malware.
At S1050, the application or redirection action is executed in an appropriate security zone. For example, if the website to be accessed is determined to be a non-secure website that is only permitted to be accessed via a personal security zone, a browser is loaded in that zone and the website is displayed therein. The executed request is caused to be displayed in the first or second security zones on the same desktop display, namely the user is not aware of any shift of security zone, as the same desktop environment is displayed regardless of the security zone used to execute the request. In an embodiment, this is accomplished by rendering a first layer of the executed application in the appropriate first security zone, and displaying it as a cropped window in a second layer on a second security zone. The second layer may be configured to maintaining a z-order of windows as set by a user.
At optional S1060, if the action was initiated in a non-appropriate VM, e.g., a secured browser, that original application is blocked and/or terminated.
As a non-limiting example, a user launches an application on a primary VM that depends on connectivity to a particular remote server (e.g., a web browser, an RDP client, an SSH client, and the like). The user opens a browser in a “Corporate VM” and tries to browse to a non-corporate website (e.g. Facebook). Using the network security VM, the system captures the web request, returns a block page to the browser running in the corporate VM and then automatically launches the browser with the non-corporate website in the “Personal VM”. From the user's perspective, the non-corporate website has automatically loaded in the correct VM, without the user needing to manually launch the browser in the “Personal VM”.
The method discussed is executed in a virtualized environment also arranged to include a hypervisor controlling the security zones, a networking VM, and a primitive OS. Each security zone is realized as a virtual machine executing a plurality of applications over a guest OS. Each security zone 130 is configured to host applications based on their security and sensitivity levels. Such an environment is illustrated in
According to the some embodiments, the networking VM is configured to capture any attempt to access a URL, e.g., via any browser or similar application. It should be noted that in some embodiments, such attempts are captured without need for integration within a specific browser. The networking VM is further configured to check if the request is allowed on the security zone requesting to access the URL. The check may be performed against a URL whitelist or blacklist and/or based on integration with a third-party proxy. When the request is not allowed to be served on the security zone, the networking VM is configured to generate a HTML page.
The browser loads the HTML page. The page includes script code (e.g., JavaScript), that, when executed, determines if the request was triggered by a user trying to visit a website in a browser or the request was initiated by the browser or application to fetch a web resource.
When it is determined that the request to access the URL was initiated by the user, the script code sends a special URL request, triggering the networking VM to launch the website in the other security zone (VM). The launch of the web browser will be performed either automatically or manually with a user confirmation, as discussed above. As such, the networking VM does not launch a browser window for every web resource (e.g. an image) that the browser attempts to fetch.
It should be noted that by configuring the networking VM to manage this process, it is ensured that even if malware succeeds in exploiting the URL redirection mechanism, the malware ends up trapped in the networking VM and not in the hypervisor. It should be further noted that a web browser or similar application, as discussed herein, may be any application that can access a web or network resource.
As a non-limiting example, a user can access a start menu and desktop of a primary VM designated as a non-secured zone. When the user attempts to launch a shortcut of an application (app), the hypervisor is configured to present a dialog box asking the user which VM or security zone they would like to launch the application in (e.g. in a “Sensitive VM” or in a “General VM”). The dialog may also contain visual indicators matching an assigned VM color, the user's identity avatar, and the like to make it easier for a user to select to desired VM or security zone.
A user is presented with a complete shell (e.g., including a desktop, a task bar, and task switcher) of one of the employed VMs, e.g., designated as a primary zone, and displays placeholders in the shell for applications that can be run from both the primary VM, as well as other accessible security zones. The placeholders themselves do not contain any sensitive information other than the window title and icon, and are merely stubs of the actual application windows. However, the placeholders allow the user to interact with the system as if all of the application windows are running and managed by the “primary zone” shell. All application icons appear in the task bar and task switcher, even if some of them are running in a secondary zone.
It should be noted that this can be applied not only to websites, but also to other network resources. For example, a user may attempt to use an RDP client (e.g. “Microsoft Remote Desktop Connection”) in the “Personal Security Zone” to connect to an RDP server in the corporate network. When the user tries to connect, the network security zone automatically detects the socket connection request, blocks the “Personal Security Zone” from establishing the connection (returning an immediate socket termination response), and automatically launches the RDP client in the “Corporate Security Zone” with the target server as parameter. From the user's perspective, the correct RDP client had been opened automatically in the correct Security Zone.
The original web browser tab, or other application, that was blocked from accessing the network resource may be automatically closed or terminated, such that there are no remaining windows in the original zone (VM) where the user made the original request.
The various embodiments disclosed herein can be implemented as hardware, firmware, software, or any combination thereof. Moreover, the software is preferably implemented as an application program tangibly embodied on a program storage unit or computer readable medium consisting of parts, or of certain devices and/or a combination of devices. The application program may be uploaded to, and executed by, a machine comprising any suitable architecture. Preferably, the machine is implemented on a computer platform having hardware such as one or more central processing units (“CPUs”), a memory, and input/output interfaces. The computer platform may also include an operating system and microinstruction code. The various processes and functions described herein may be either part of the microinstruction code or part of the application program, or any combination thereof, which may be executed by a CPU, whether or not such a computer or processor is explicitly shown. In addition, various other peripheral units may be connected to the computer platform such as an additional data storage unit and a printing unit. Furthermore, a non-transitory computer readable medium is any computer readable medium except for a transitory propagating signal.
As used herein, the phrase “at least one of” followed by a listing of items means that any of the listed items can be utilized individually, or any combination of two or more of the listed items can be utilized. For example, if a system is described as including “at least one of A, B, and C,” the system can include A alone; B alone; C alone; A and B in combination; B and C in combination; A and C in combination; or A, B, and C in combination.
It should be understood that any reference to an element herein using a designation such as “first,” “second,” and so forth does not generally limit the quantity or order of those elements. Rather, these designations are generally used herein as a convenient method of distinguishing between two or more elements or instances of an element. Thus, a reference to first and second elements does not mean that only two elements may be employed there or that the first element must precede the second element in some manner. Also, unless stated otherwise, a set of elements comprises one or more elements.
All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the principles of the disclosed embodiment and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions. Moreover, all statements herein reciting principles, aspects, and embodiments of the disclosed embodiments, as well as specific examples thereof, are intended to encompass both structural and functional equivalents thereof. Additionally, it is intended that such equivalents include both currently known equivalents as well as equivalents developed in the future, i.e., any elements developed that perform the same function, regardless of structure.
This application is a continuation-in-part (CIP) of U.S. application Ser. No. 15/876,654 filed on Jan. 22, 2018, which claims the benefit of U.S. Provisional Application No. 62/449,123, filed Jan. 23, 2017. The contents of the aforementioned applications are hereby incorporated by reference.
| Number | Name | Date | Kind |
|---|---|---|---|
| 8141075 | Chawla et al. | Mar 2012 | B1 |
| 8220047 | Soghoian | Jul 2012 | B1 |
| 8555274 | Chawla et al. | Oct 2013 | B1 |
| 8732607 | Grechishkin | May 2014 | B1 |
| 8910277 | Reis | Dec 2014 | B1 |
| 8924961 | Radhakrishnan et al. | Dec 2014 | B2 |
| 8929287 | Huang | Jan 2015 | B1 |
| 8966004 | Connelly | Feb 2015 | B2 |
| 8966581 | Gross et al. | Feb 2015 | B1 |
| 8972977 | Neil | Mar 2015 | B2 |
| 9116733 | Banga | Aug 2015 | B2 |
| 9129123 | Mooring | Sep 2015 | B2 |
| 9148428 | Banga | Sep 2015 | B1 |
| 9210213 | Momchilov | Dec 2015 | B2 |
| 9218489 | Mooring | Dec 2015 | B2 |
| 9384029 | Brandwine et al. | Jul 2016 | B1 |
| 9386021 | Pratt | Jul 2016 | B1 |
| 9417904 | Shin | Aug 2016 | B2 |
| 9495215 | Podvratnik et al. | Nov 2016 | B2 |
| 9565202 | Kindlund et al. | Feb 2017 | B1 |
| 9600312 | Wagner | Mar 2017 | B2 |
| 9781055 | Liu | Oct 2017 | B2 |
| 9792143 | Potlapally et al. | Oct 2017 | B1 |
| 9832024 | Xu | Nov 2017 | B2 |
| 10055144 | Panchapakesan | Aug 2018 | B1 |
| 10135842 | Moshchuk | Nov 2018 | B2 |
| 10171508 | Ylonen | Jan 2019 | B2 |
| 10469472 | Main | Nov 2019 | B2 |
| 10795707 | Hay et al. | Oct 2020 | B2 |
| 10922423 | Rungta | Feb 2021 | B1 |
| 20070288247 | Mackay | Dec 2007 | A1 |
| 20080228865 | Cruzada | Sep 2008 | A1 |
| 20080229227 | Bantz | Sep 2008 | A1 |
| 20110265168 | Lucovsky | Oct 2011 | A1 |
| 20120054396 | Bhattacharya et al. | Mar 2012 | A1 |
| 20120089980 | Sharp et al. | Apr 2012 | A1 |
| 20140351810 | Pratt | Nov 2014 | A1 |
| 20160021149 | Maistri | Jan 2016 | A1 |
| 20160335110 | Paithane | Nov 2016 | A1 |
| 20170048249 | Berrangé | Feb 2017 | A1 |
| 20170118247 | Hussain et al. | Apr 2017 | A1 |
| 20180046479 | Ghosh | Feb 2018 | A1 |
| 20180062929 | Maskalik | Mar 2018 | A1 |
| 20180359799 | Huang | Dec 2018 | A1 |
| 20190109768 | Senarath | Apr 2019 | A1 |
| 20190196858 | Chakraborty | Jun 2019 | A1 |
| 20190245758 | Li | Aug 2019 | A1 |
| 20190303354 | Zamir | Oct 2019 | A1 |
| 20190394284 | Baghel | Dec 2019 | A1 |
| Number | Date | Country | |
|---|---|---|---|
| 20190372983 A1 | Dec 2019 | US |
| Number | Date | Country | |
|---|---|---|---|
| 62449123 | Jan 2017 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 15876654 | Jan 2018 | US |
| Child | 16541395 | US |
