Description:
OBJECTIVE: This topic seeks to advance the state of the art towards being able to apply patches to a running guest virtual machine directly from the hypervisor without specialized software running on the guest. DESCRIPTION: Patch management plays an important role in ensuring the overall security posture of machines. Traditionally, enterprise level patch management is conducted through the use of privileged end-point software that runs on the manage system. The patches and configuration changes can then be pushed to the end-points from a central server. Patch management in Cloud Computing essentially follows the same concept where the same end-point software is installed onto the virtual machines. This same paradigm is used even for dormant virtual machine images that are not running [1,2]. Given the advancement of virtual machine introspection [3] techniques for digital forensics and malware analysis [4,5], there is an opportunity to investigate the ability to apply patches to a live virtual machine with limited or no guest support. In this manner, critical, user-managed, misconfigured or malfunctioning virtual machines can still receive critical patches or configuration updates. This topic seeks to advance the state of the art towards being able to apply patches to a running guest virtual machine directly from the hypervisor without specialized software running on the guest. The proposed solution needs to have a sound argument for and evidence to support the notion that the patch will be applied and the guest will not be rendered unstable. Additional metrics, such as the kind or type of patches that can be applied or the size of a guest module (if necessary), should also be proposed when necessary. PHASE I: Define the type or kind of patches that can be applied to a live virtual machine and a technique for patching. Develop and demonstrate live patching on a proof-of-concept prototype. PHASE II: Develop the prototype designed during Phase I and test it against the proposed metrics. Demonstrate live patching of virtual machines from the hypervisor using real-world patches on COTS systems. Prepare for commercialization. PHASE III DUAL USE APPLICATIONS: Work with the DoD to demonstrate that the prototype developed during Phase II can also be applied to DoD systems and software. Further demonstrate the capability through multiple Guest Operating System platforms, e.g., Windows 7, Ubuntu Linux, etc.
