1. A method for data access by a virtual machine, the method (300) comprising:
implementing, by a hypervisor (110), a first Virtual Machine (VM) (112-1) and
a second VM (112-2) in a computing environment (100);
requesting, by the first VM (112-1), access of data from the second VM (112-
2);
assigning, by the Hypervisor Security Framework (HSF) (114) implemented in
the hypervisor (110), a unique identity to each of the first VM (112-1) and the second
VM (112-2);
authenticating, by the HSF (114), each of the first VM (112-1) and the second
VM (112-2) by:
obtaining a Message Authentication Code (MAC) associated with each of
the first VM (112-1) and the second VM (112-2);
computing the MAC of each of the first VM (112-1) and the second VM
(112-2) based on the unique identity;
determining a successful match between the MAC obtained by the HSF
(114) and the MAC computed by the HSF (114) for each of the first VM (112-
1) and the second VM (112-2) for validating authenticity, and
establishing a communication channel (116) between the first VM (112-1) and
the second VM (112-2) upon validation of the authenticity;
providing, by the HSF (114), the data access to the first VM (112-1) from the
second VM (112-2) over the communication channel (116).
2. The method as claimed in claim 1, wherein the unique identity includes an Internet
Protocol (IP) address and an identity number.
3. The method as claimed in claim 1, comprising terminating the communication channel
(116), by the HSF (114), after determining inactivity over the communication channel
(116) for a time period greater than a pre-defined threshold time-period.
4. A method for data access by a virtual machine, the method comprising:
implementing, by a hypervisor (110), a Virtual Machine (VM) (112-1, 112-2)
in a computing environment (100);
14
requesting, by the VM (112-1, 112-2) to the Hypervisor Security Framework
(HSF) (114) implemented in the hypervisor (110), access of memory (106) of the
computing environment (100);
authenticating, by the HSF (114), the VM (112-1, 112-2) by:
receiving a first security key from the VM (112-1, 112-2);
generating a second security key for the VM (112-1, 112-2) based on a
security policy applicable for the VM (112-1, 112-2),
determining a successful match between the first security key and the
second security key for validating authenticity, and
providing, by the HSF (114), the data access to the VM (112-1, 112-2) from the
memory (106).
5. The method as claimed in claim 4, comprising:
monitoring, by the HSF (114), update in the security policy of the VM (112-1,
112-2) for continuing the data access, wherein the security policy is updated based on
a change in one or more parameters;
generating, by the HSF (114), a new security key based on application of an
updated security policy; and
providing, by the HSF (114), the data access from the memory (106) upon
validation of authenticity of the VM (112-1, 112-2) based on the new security key.
6. The method as claimed in claim 5, wherein the one or more parameters includes
security type, role, and user of the VM (112-1, 112-2).
7. A system (100) for data access by a virtual machine, the system (100) comprising:
one or more processors (104); and
a memory (106) storing programmed instructions executable by the one or more
processors (104), wherein the one or more processors (104) execute the programmed
instructions to:
implement a hypervisor (110) hosting a first Virtual Machine (VM) (112-
1) and a second VM (112-2), and a Hypervisor Security Framework (HSF) (114)
for managing the data access;
request, by the first VM (112-1) access of data to the second VM (112-
2), ;
15
assign, by the HSF (114), a unique identity to each of the first VM (112-
1) and the second VM (112-2);
authenticate, by the HSF (114), each of the first VM (112-1) and the
second VM (112-2) by:
obtaining a Message Authentication Code (MAC) associated with
each of the first VM (112-1) and the second VM (112-2);
computing the MAC of each of the first VM (112-1) and the
second VM (112-2) based on the unique identity;
determining a successful match between the MAC obtained by the
HSF (114) and the MAC computed by the HSF (114) for each of the first
VM (112-1) and the second VM (112-2) for validating authenticity, and
establish a communication channel (116) between the first VM (112-1)
and the second VM (112-2) upon validation of the authenticity;
provide, by the HSF (114), the data access to the first VM (112-1) from
the second VM (112-2) over the communication channel (116).
8. The system (100) as claimed in claim 7, wherein the unique identity includes Internet
Protocol (IP) address and an identity number.
9. The system (100) as claimed in claim 7, wherein the HSF (114) terminates the
communication channel (116) after determining inactivity over the communication
channel (116) for a time period greater than a pre-defined threshold time-period.
10. The system (100) as claimed in claim 7, wherein the computing environment (100) is
an embedded system or a system implemented over a cloud network.