Virtual machine migration

Abstract

Attesting a virtual machine that is migrating from a first environment to a second environment includes in response to initiation of migration of the virtual machine from the first environment to the second environment, accessing one or more stored trust values generated during the trusted boot of the virtual machine in the first environment, determining if the accessed trust values define a security setting sufficient for the second environment, and if the accessed trust values do not define a security setting sufficient for the second environment, performing a predetermined action in relation to the migration of the virtual machine to the second environment.

1 . A method of attesting a virtual machine migrating from a first environment to a second environment comprising:
 in response to initiation of migration of the virtual machine from the first environment to the second environment:
 accessing one or more stored trust values generated during trusted boot of the virtual machine in the first environment; 
 determining that the accessed trust values define a security setting that is not sufficient for the second environment; and 
 in response to the determination that the accessed trust values define the security setting that is not sufficient for the second environment, performing a predetermined action in relation to the migration of the virtual machine to the second environment. 
   
     
     
         2 . The method of  claim 1 , wherein performing the predetermined action in relation to the migration of the virtual machine to the second environment comprises preventing the migration of the virtual machine. 
     
     
         3 . The method of  claim 1 , wherein performing the predetermined action in relation to the migration of the virtual machine to the second environment comprises completing the migration of the virtual machine and placing limits on the operation of the virtual machine in the second environment. 
     
     
         4 . The method of  claim 1  further comprising transferring the stored trust values to a trusted management unit for the second environment. 
     
     
         5 . A system for attesting a virtual machine migrating from a first environment to a second environment comprising:
 a computer processor; and   a computer readable storage medium comprising a trusted management unit executable by the computer processor to:
 responsive to initiation of migration of the virtual machine from the first environment to the second environment:
 accessing one or more stored trust values generated during trusted boot of the virtual machine in the first environment; 
 determining that the accessed trust values define a security setting that is not sufficient for the second environment; and 
 in response to the determination that the accessed trust values define the security setting that is not sufficient for the second environment, performing a predetermined action in relation to the migration of the virtual machine to the second environment. 
 
   
     
     
         6 . The system of  claim 5 , wherein performing the predetermined action in relation to the migration of the virtual machine to the second environment comprises preventing the migration of the virtual machine. 
     
     
         7 . The system of  claim 5 , wherein performing the predetermined action in relation to the migration of the virtual machine to the second environment comprises completing the migration of the virtual machine and place limits on the operation of the virtual machine in the second environment. 
     
     
         8 . The system of  claim 5 , wherein the trusted management unit is further executable by the computer processor to transfer the stored trust values to a trusted management unit for the second environment. 
     
     
         9 . A computer program product on a tangible computer readable storage medium for attesting a virtual machine migrating from a first environment to a second environment, the product comprising instructions executable by a computer to cause the computer to perform:
 responsive to initiation of migration of the virtual machine from the first environment to the second environment:   accessing one or more stored trust values generated during trusted boot of the virtual machine in the first environment;   determining that the accessed trust values define a security setting that is not sufficient for the second environment; and   in response to the determination that the accessed trust values define the security setting that is not sufficient for the second environment, performing a predetermined action in relation to the migration of the virtual machine to the second environment.   
     
     
         10 . The computer program product of  claim 9 , wherein the instructions for performing the predetermined action in relation to the migration of the virtual machine to the second environment comprise instructions for preventing the migration of the virtual machine. 
     
     
         11 . The computer program product of  claim 9 , wherein the instructions for performing the predetermined action in relation to the migration of the virtual machine to the second environment comprise instructions for completing the migration of the virtual machine and placing limits on the operation of the virtual machine in the second environment. 
     
     
         12 . The computer program product of  claim 9 , further comprising instructions for transferring the stored trust values generated during the trusted boot of the virtual machine to a trusted management unit for the second environment.