Protecting Virtual machine from being copied to other hosts

Question

I'm deploying a web application on a linux server (ubuntu) on virtual machine (In VMWare ESX 5.1 and the host machine is Windows)

I need to protect the entire application and guest OS from being copied to another physical host

Is this possible?
Can I make the Linux guest to work just on that host?
Can I identify host machine from guest OS?
How?

Thanks

Answer 1

In a well-working virtualisation environment, the guest can not, should not and may not be able to identify the host if the host doesn't explicitly allow so, this is of course completely oposite to your requirement of something like a DRM system for VMs.

This leaves you with a few options, some of which are:

• Demand the MAC address of the Host being entered into your application, then rarp and ping it - the roundtrip time should allow a diagnosis.
• Use cryptography and a USB passthrough dongle

Let me add, that the first rule of DRM is, that DRM does not work - so reconsider if you want to pour resources into what is finally a lost cause.

Answer 2

Let me give my overview, based on virtualization experience. Any malware with a network component will propagate to wherever their addressing/routing allows them to. Regular/well-known malwares tend to only operate in ‘user mode’, in a such a covert channel. If you are sharing CPU's, a busy process on one VM can effectively communicate state to another VM (that's your prototypical timing covert channel). Storage covert channel would be a bit harder as the virtual disks tend to have a hard limit on them, so unless you have a system that can over-commit disk space, it should not be an issue.