Systems and methods for securing virtual machine computing environments

Abstract

Systems and methods are provided for securing data in virtual machine computing environments. A request is received for a security operation from a first virtual machine operating in a host operating system of a first device. In response to receiving the request, a first security module executes the security operation, the first security module implemented in a kernel of the host operating system. The result of the security operation is provided to the first virtual machine.

1 . (canceled) 
     
     
         2 . A method for securing data, the method comprising:
 generating, using a virtual machine operating in a host operating system of a computer device, a request for security operation, wherein the security operation may be performed by at least one of a plurality of security modules;   making a determination, using a hardware processor of the computer device, whether security modules of the plurality of security modules are able to execute the security operation;   selecting, using a hardware processor of the computer device, a security module from the plurality of security module based on the determination;   executing, using the selected security module, the security operation, wherein the selected security module is implemented in a kernel of the host operating system of the computer device; and   providing, using the hardware processor, a result of the security operation to the virtual machine.   
     
     
         3 . The method of  claim 2 , wherein the request for the security operation generated using the virtual machine is a request for a security operation to be executed by a security module of the plurality of security modules that is implemented in the kernel of the host operating system of the computer device. 
     
     
         4 . The method of  claim 2 , wherein the request for the security operation generated using the virtual machine is a request for a security operation to be executed by a security module of the plurality of security modules that is not implemented in the kernel of the host operating system of the computer device. 
     
     
         5 . The method of  claim 2 , wherein the request generated using the virtual machine is a request from an application running in the virtual machine. 
     
     
         6 . The method of  claim 2 , wherein executing the security operation using the selected security module comprises generating a plurality of shares, wherein each of the plurality of shares contains a distribution of data from a data set. 
     
     
         7 . The method of  claim 6 , wherein executing the security operation using the selected security module further comprises encrypting the data set. 
     
     
         8 . The method of  claim 2 , wherein making the determination comprises determining that at least one other security module of the plurality of security modules is unable to execute the requested security operation. 
     
     
         9 . The method of  claim 2 , wherein executing the security operation using the selected security module comprises receiving a request at the selected security module from another security module of the plurality of security modules. 
     
     
         10 . The method of  claim 2 , wherein making the determination comprises determining that the selected security module is able to execute the requested security operation. 
     
     
         11 . The method of  claim 2 , wherein making the determination comprises:
 determining whether one or more programmed conditions are satisfied; and   selecting, based on the determining, the selected security module from the plurality of security modules to perform the security operation.   
     
     
         12 . A system for securing virtual machines, the system comprising:
 a processor including processor circuitry, the processor being configured to:
 execute a host operating system having a kernel; 
 receive a request for security operation from a virtual machine, wherein the security operation may be performed by at least one of a plurality of security modules; 
 in response to receiving the request:
 make a determination whether security modules of the plurality of security modules are able to execute the security operation; 
 select a security module from the plurality of security module based on the determination; 
 execute, using the selected security module, the security operation, wherein the selected security module is implemented in the kernel of the host operating system; and 
 provide a result of the security operation to the virtual machine. 
 
   
     
     
         13 . The system of  claim 12 , wherein the request for the security operation received from the virtual machine is a request for a security operation to be executed by a security module of the plurality of security modules that is implemented in the kernel of the host operating system. 
     
     
         14 . The system of  claim 12 , wherein the request for the security operation received from the virtual machine is a request for a security operation to be executed by a security module of the plurality of security modules that is not implemented in the kernel of the host operating system. 
     
     
         15 . The system of  claim 12 , wherein the request received from the virtual machine is a request from an application running in the virtual machine. 
     
     
         16 . The system of  claim 12 , wherein executing the security operation using the selected security module comprises generating a plurality of shares, wherein each of the plurality of shares contains a distribution of data from a data set. 
     
     
         17 . The system of  claim 16 , wherein executing the security operation using the selected security module further comprises encrypting the data set. 
     
     
         18 . The system of  claim 12 , wherein making the determination comprises determining that at least one other security module of the plurality of security modules is unable to execute the requested security operation. 
     
     
         19 . The system of  claim 12 , wherein executing the security operation using the selected security module comprises receiving a request, using the selected security module from another security module of the plurality of security modules. 
     
     
         20 . The system of  claim 12 , wherein making the determination comprises determining that the selected security module is able to execute the requested security operation. 
     
     
         21 . The system of  claim 12 , wherein making the determination comprises:
 determining whether one or more programmed conditions are satisfied; and   selecting, based on the determining, the selected security module from the plurality of security modules to perform the security operation.