Citrix Systems, Inc.

Bromium, Inc.

Hewlett-Packard Development Company, L.p.

Citrix Systems, Imc.

James McKenzie

Jean Guyader

Ian Pratt

Rahul Kashyap

Adrian Taylor

Ross Philipson

Steven Smith

Approaches for monitoring a host operating system. A threat model is stored and maintained in an isolated execution environment. The threat model identifies for any process executing on a host operating system how trustworthy the process should be deemed based on a pattern of observed behavior. The execution of the process and those processes in a monitoring circle relationship thereto are monitored. The monitoring circle relationship includes a parent process, any process in communication with a member of monitoring circle relationship, and any process instantiated by a present member of monitoring circle relationship. Observed process behavior is correlated with the threat model. Upon determining that a particular process has behaved in a manner inconsistent with a pattern of allowable behavior identified by the threat model for that process, a responsive action is taken.

Using a threat model to monitor host execution in a virtualized environment

Using threat model to monitor host execution in a virtualized environment

Approaches for performing nested virtualization using a hypervisor which does not support nested virtualization. A first hypervisor is loaded upon booting a computing device. The first hypervisor instantiates a first virtual machine, exposes an emulated hardware virtualization support interface to the first virtual machine, and executes a second hypervisor, which does not support nested virtualization, within the first virtual machine. The first hypervisor provides nested virtualization support to the second hypervisor to allow the second hypervisor to execute a third hypervisor within a second virtual machine by the first hypervisor abstracting hardware virtualization support to the third hypervisor.

Hypervisor to support nested virtualization

The present disclosure is directed towards methods and systems for maintaining state in a virtual machine when disconnected from graphics hardware. The virtual machine is one of a plurality of virtual machines hosted by a hypervisor executing on a computing device. A control virtual machine may be hosted by a hypervisor executing on a computing device. The control virtual machine may store state information of a graphics processing unit (GPU) of the computing device. The GPU may render an image from a first virtual machine. The control virtual machine may remove, from the first virtual machine, access to the GPU. The control virtual machine may redirect the first virtual machine to a GPU emulation program. The GPU emulation program may render the image from the first virtual machine using at least a portion of the stored state information.

Methods and systems for maintaining state in a virtual machine when disconnected from graphics hardware

The methods and systems described herein provide for allocating a universal serial bus (USB) device to one of a trusted virtual machine and a non-trusted virtual machine. A control program receives data indicating a USB port on the computing machine received a USB device and identifies at least one attribute of the USB device. The control program selects, based on application of a policy to the identified at least one device attribute, one of a trusted virtual machine and a non-trusted virtual machine executing. The control program grants, to the virtual machine selected by the control program, access to the USB device.

Methods and systems for allocating a USB device to a trusted virtual machine or a non-trusted virtual machine

The methods and systems described herein provide for preventing a non-trusted virtual machine from reading the graphical output of a trusted virtual machine. A graphics manager receives a request from a trusted virtual machine to render graphical data using a graphics processing unit. The graphics manager assigns, to the trusted virtual machine, a secure section of a memory of the graphics processing unit. The graphics manager renders graphics from the trusted virtual machine graphical data to the secure section of the graphics processing unit memory. The graphics manager receives a request from a non-trusted virtual machine to read graphics rendered from the trusted virtual machine graphical data and stored in the secure section of the graphics processing unit memory, and prevents the non-trusted virtual machine from reading the trusted virtual machine rendered graphics stored in the secure section of the graphics processing unit memory.

Methods and systems for preventing access to display graphics generated by a trusted virtual machine

The methods and systems described herein are directed to providing, to virtual machines, access to data associated with a connection to a wireless local area network, in a computing device executing a hypervisor hosting a first virtual machine and a second virtual machine. A first driver executed by a first virtual machine of the first physical computing device establishes a network connection to a second physical computing device, via a wireless local area network interface of the first physical computing device. The first driver receives from a second driver executed by a second virtual machine of the first physical computing device, a request for a characteristic of the network connection. The first driver provides, responsive to the request, data comprising the requested characteristic to the second driver.

Methods and systems for providing to virtual machines, via a designated wireless local area network driver, access to data associated with a connection to a wireless local area network

The methods and systems described herein provide for establishing a secure communication channel between a non-trusted virtual machine and a trusted virtual machine, in a computing device executing a hypervisor hosting the trusted virtual machine, the non-trusted virtual machine, and a third virtual machine. The method includes writing, by a non-trusted virtual machine, a first string of data to a region of memory of the computing device. The method also includes detecting, by a trusted virtual machine, the first string of data written to the region of memory. The method further includes establishing a communication channel between the trusted virtual machine and the non-trusted virtual machine by locking, by the trusted virtual machine and responsive to the detection, the region of memory for the duration of the communication to prevent a third virtual machine from accessing the region of memory.

Methods and systems for communicating between trusted and non-trusted virtual machines

The methods and systems described herein provide for granting a virtual machine exclusive access to an optical disc drive responsive to a determination the virtual machine initiated a transaction with the optical disc drive. A drive manager maps an optical disc drive connected to the computing device to a plurality of virtual machines hosted by a hypervisor executed by the computing device. The drive manager intercepts a transaction stream generated by the optical disc drive and converts the transaction stream to a command stream. The drive manager determines, based on an analysis of the command stream, a first virtual machine of the plurality of virtual machines initiated a transaction with the optical disc drive. Responsive to the determination, the drive manager locks the optical disc drive to grant the first virtual machine exclusive access to the optical disc drive.

Dynamically controlling virtual machine access to optical disc drive by selective locking to a transacting virtual machine determined from a transaction stream of the drive

The methods and systems provide for allocating a universal serial bus (USB) device to one of a trusted virtual machine and a non-trusted virtual machine. A control program receives data indicating a USB port on the computing machine received a USB device and identifies at least one attribute of the USB device. The control program selects, based on application of a policy to the identified at least one device attribute, one of a trusted virtual machine and a non-trusted virtual machine executing. The control program grants, to the virtual machine selected by the control program, access to the USB device.

The methods and systems provide for preventing a non-trusted virtual machine from reading the graphical output of a trusted virtual machine. A graphics manager receives a request from a trusted virtual machine to render graphical data using a graphics processing unit. The graphics manager assigns, to the trusted virtual machine, a secure section of a memory of the graphics processing unit. The graphics manager renders graphics from the trusted virtual machine graphical data to the secure section of the graphics processing unit memory. The graphics manager receives a request from a non-trusted virtual machine to read graphics rendered from the trusted virtual machine graphical data and stored in the secure section of the graphics processing unit memory, and prevents the non-trusted virtual machine from reading the trusted virtual machine rendered graphics stored in the secure section of the graphics processing unit memory.

Growing community of inventors

Cambridge, United Kingdom

James McKenzie