Hypervisor Persistent Reservation for Dangling Volume Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dangling volumes in containerized environments are vulnerable to attacks as they remain accessible after the associated container is deleted, posing a risk to sensitive information.
Innovation Solution
The use of persistent reservation (PR) commands, managed by the hypervisor, to control access to dangling volumes, blocking unauthorized access until the volume is deleted or migrated to an authorized owner.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dangling volumes are left accessible after container deletion, then data persistence and space utilization are maintained, but security vulnerability increases
Solution Approach 1:
The hypervisor performs preliminary actions by automatically detecting when a volume becomes dangling (no active containers) and proactively applying security measures before an attacker can exploit the vulnerability. The system monitors volume associations with containers and triggers reservation commands in advance when containers are deleted, ensuring security is established before the volume remains accessible.
Solution Approach 2:
The hypervisor acts as an intermediary between the storage system and the container runtime. It intercepts volume access requests and introduces a reservation mechanism that mediates access control. The reservation command serves as an intermediate layer that validates whether a volume should be accessible, blocking unauthorized access while maintaining legitimate access for associated containers.
2Object-affected harmful factors
If persistent reservation commands are applied to dangling volumes, then access security is improved, but system complexity increases
Solution Approach 1:
The hypervisor implements self-service by automatically managing the reservation state of volumes without requiring manual intervention. When a container is deleted, the hypervisor autonomously detects the dangling volume state, applies the reservation command, and maintains security until the volume is properly cleaned up or reassigned. This automated self-service approach reduces operational complexity while maintaining strong access security.
3Object-affected harmful factors
If automatic volume deletion is implemented, then security risk is reduced, but data loss risk increases
Solution Approach 1:
The system applies dynamic state management where the reservation command adapts its behavior based on real-time conditions. The hypervisor continuously monitors which volumes are associated with active containers versus dangling volumes. When containers are actively using a volume, the reservation allows normal access. When containers are deleted and volumes become dangling, the reservation automatically blocks access. This dynamic approach ensures security without causing unintended data loss.
Data Source
AI summary
The disclosure provides a method for securing, by a hypervisor of a host, a first persistent volume used to maintain data for one or more first containers on the host. The method generally includes receiving a request to retain the first persistent volume when the one or more first containers are removed from the host, receiving a first container image associated with one of the one or more first containers, generating a first key for reserving the first persistent volume, the key based, at least in part, on the first container image, and reserving the first persistent volume for exclusive access by the hypervisor using the first key.