Edge Hypervisor Shadow Bridging for Secure Remote Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized management of virtualization components in private networks is challenging due to their inaccessibility from public networks, and opening these networks to the public introduces security issues.
Innovation Solution
Implementing an edge hypervisor shadow instance and edge agent within the private network to facilitate communication with a virtualization service using HTTP over MQTT, allowing seamless management without modifying the virtualization service code or exposing the private network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the private network is opened to be accessible from the Internet, then centralized management of virtualization components is enabled, but security issues are introduced
Solution Approach 1:
The patent introduces a message broker service as an intermediary component that sits between the virtualization service and the private network. The broker receives management requests from the virtualization service, translates them into appropriate protocols (such as MQTT), and forwards them to edge devices within the private network. This mediator enables centralized management without requiring direct network access, thus maintaining security while achieving operational control.
Solution Approach 2:
The system segments the management architecture into distinct components: the virtualization service in the public cloud, the message broker service as an intermediary, and edge agents/discovery services within the private network. This segmentation allows each component to operate in its appropriate network zone, with controlled communication channels that maintain security boundaries while enabling management functionality.
2Object-affected harmful factors
If the private network remains closed and inaccessible, then security is maintained, but centralized management of virtualization components cannot be performed
Solution Approach 1:
The message broker service acts as a secure gateway that allows management operations to pass through the network boundary without compromising security. It translates management protocols into formats suitable for the isolated private network environment, enabling control while maintaining network isolation.
Solution Approach 2:
The patent replaces direct network connectivity (mechanical/physical connection) with message-based communication protocols. Instead of opening network ports or establishing direct TCP/IP connections, the system uses protocol translation and message queuing mechanisms to achieve management access, substituting physical network access with logical communication channels.
3Ease of operation
If a message broker service is introduced to enable communication, then remote management is achieved, but device discovery and addressing become more complex
Solution Approach 1:
The patent implements a self-service discovery mechanism where edge devices automatically publish their presence and capabilities to the message broker service. The virtualization service can then discover these devices through standardized subscription mechanisms without requiring manual configuration or complex addressing schemes. Devices self-register and self-describe, simplifying the overall discovery process.
Solution Approach 2:
The message broker service provides universal discovery and addressing functionality that works across different device types and network configurations. By using standardized publish-subscribe patterns and topic-based routing, the system achieves a unified approach to device discovery that simplifies complexity rather than increasing it.
Data Source
AI summary
Aspects of remote edge virtualization management are described. An edge hypervisor shadow application is executed. The edge hypervisor shadow application acts as an Input/Output for an edge hypervisor that is IP inaccessible to a virtualization service. The edge hypervisor shadow application receives a hypertext transport protocol (HTTP) communication from the virtualization service. A Message Queue Telemetry Transport (MQTT) message is generated to include the HTTP request, and is published to an MQTT broker service, the MQTT message comprising the HTTP request.