Cloud Security Dispatcher VM with Docker Containers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security practices focused on securing company headquarters are inadequate in distributed enterprise environments with remote users and cloud-based applications, leading to challenges in providing scalable and cost-effective security services across multiple sites and users.
Innovation Solution
A cloud-based security service architecture using docker containers and virtual machines that chains multiple security services such as firewalls, anti-virus, and intrusion detection systems, allowing for flexible updating and resource optimization, reducing the need for multiple virtual machines and minimizing disruption during updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security infrastructure is deployed at each enterprise site, then local security coverage is improved, but the expense and complexity increase significantly for smaller sites that cannot justify the cost
Solution Approach 1:
The patent extracts the security service functionality from local enterprise infrastructure and relocates it to a centralized cloud data center. The dispatcher VM in the cloud receives network requests from remote clients and routes them through security service VMs, eliminating the need for each site to maintain its own security infrastructure while providing consistent security coverage across all locations.
Solution Approach 2:
The cloud-based security service creates a universal security platform that serves multiple enterprise sites through a single centralized infrastructure. The dispatcher VM and security service VMs provide multi-functional security capabilities (firewall, intrusion detection, anti-virus, etc.) that can be shared across all remote clients, replacing the need for separate security systems at each location.
2Reliability
If multiple security services are deployed at each site, then comprehensive security protection is improved, but the cost becomes prohibitive for smaller distributed sites
Solution Approach 1:
The patent merges multiple security services (firewall, intrusion detection, anti-virus, anti-malware, etc.) into a unified cloud-based security platform. Multiple security service VMs execute within a single dispatcher VM infrastructure, consolidating what would traditionally require separate hardware appliances at each site into a shared cloud resource that reduces overall financial cost while maintaining comprehensive security protection.
Solution Approach 2:
The security services are instantiated as virtual machine copies within the cloud infrastructure. The dispatcher VM creates and manages copies of security service VMs that can be dynamically allocated to handle requests from multiple remote clients, providing comprehensive security protection through virtualized copies rather than physical hardware at each site.
3Reliability
If security products are updated frequently at enterprise sites, then protection against evolving threats is improved, but the likelihood of errors increases with more sites
Solution Approach 1:
The cloud-based architecture enables preliminary action by allowing security service updates to be prepared and tested in the cloud environment before being deployed to all remote clients. The dispatcher VM can update security service VMs centrally, ensuring consistent and accurate updates across all sites without the errors that occur when manual updates are performed at each location.
Solution Approach 2:
The security service VMs in the cloud can be automatically updated and managed by the dispatcher VM without requiring manual intervention at each enterprise site. The centralized cloud infrastructure performs self-service updates, distributing security patches and updates uniformly across all remote clients, thereby eliminating human error in the update process while maintaining protection against evolving threats.
4Ease of operation
If separate VMs are used for each security service, then service isolation and management are improved, but the number of VMs increases and financial cost increases
Solution Approach 1:
The patent implements a nested architecture where multiple security service VMs are nested within a single dispatcher VM. The dispatcher VM acts as a parent container that hosts and coordinates multiple child security service VMs (firewall, intrusion detection, anti-virus, etc.). This nesting reduces the total number of top-level VMs required while maintaining the isolation and management benefits of separate security services through virtualization within the dispatcher VM.
Data Source
AI summary
The disclosed embodiments disclose techniques for providing a cloud-based security service. During operation, a dispatcher virtual machine (VM) executing in a cloud data center receives a network request from a remote enterprise client. The dispatcher VM executes multiple docker containers, including a set of ingress docker containers that decode the request and then forward it to a session router docker container that in turn forwards the request to a set of security service VMs. After these security service VMs have analyzed the contents of the request and determined that the request is valid and permitted, a SNAT docker container then sends the request out to an untrusted network to be serviced.