Client Virtualization for Logical Server Separation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network separation techniques primarily focus on restricting client access to servers through authentication, lacking a method to logically separate servers from specific networks, making them ineffective against unauthorized access from external networks.
Innovation Solution
A system and method using client virtualization to logically separate a server by generating a virtual environment on the client terminal, where only authorized clients can access the virtualized server through a virtualization environment, with authentication performed by an authentication server and filtered by virtualization filter drivers on both client and server sides.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional authentication methods are used to restrict client access to servers, then access control is improved, but the server cannot be logically separated from specific networks, making it vulnerable to bypass attacks
Solution Approach 1:
The patent segments the network access path by introducing a virtualization layer between the client terminal and the server. The virtual environment generation unit creates a virtual network space that separates the physical network from the server access path, preventing direct network bypass attacks while maintaining authentication control.
Solution Approach 2:
The virtualization filter driver acts as an intermediary component installed in the client terminal's kernel. It mediates all access requests to the server by first checking virtual environment validity and authentication status, thereby blocking unauthorized access paths while allowing authenticated users to access the server through the virtualized environment.
2Object-affected harmful factors
If firewalls are deployed to secure internal information against external attacks, then security protection is improved, but they cannot prevent accesses which bypass the firewalls
Solution Approach 1:
The system performs preliminary authentication and virtual environment validation before allowing any access request to reach the server. The virtualization filter driver checks whether the client is properly authenticated and connected through a valid virtual environment, preventing bypass attacks before they can reach the server or firewall.
Solution Approach 2:
The patent replaces traditional physical firewall mechanisms with a software-based virtualization approach. Instead of relying solely on hardware firewalls that can be bypassed, the system uses kernel-level virtualization filters and virtual network spaces to enforce access control, making bypass attacks impossible through the virtualized access path.
3Object-affected harmful factors
If network separation technology is used to separate internal and external networks, then network security is improved, but it requires complex authentication mechanisms that cannot be globally applied to general clients and servers
Solution Approach 1:
The virtualization filter driver is designed as a universal component that can be installed in any client terminal regardless of its specific hardware or software configuration. It provides multi-functional capabilities including virtual environment validation, authentication checking, and access control filtering, making the same mechanism applicable to general clients and servers without requiring complex custom authentication systems.
Solution Approach 2:
The system implements self-service authentication where the virtualization filter driver automatically handles authentication decisions based on pre-established virtual environment configurations. The driver autonomously validates access requests against the virtual environment and authentication server without requiring manual intervention or complex authentication workflows, simplifying deployment across general networks.
Data Source
AI summary
A system for logically separating a server using client virtualization includes a client terminal including a virtual environment generation unit for generating a virtual environment, and a virtualized server including a local storage unit, an authentication server for performing authentication on the client terminal when a request for access to the local storage unit is received from a process executed in the virtual environment, and a virtualization filter drier for allowing or blocking the access request to the local storage unit based on the authentication result of the client terminal. The client terminal further includes a virtualization filter driver for transmitting the access request from the process executed in the virtual environment to the local storage unit, and blocking the access request from the process without being made through the virtual environment to the local storage unit.