Hypervisor Port Controller Isolating Peripheral Tasks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual machines are susceptible to malicious attacks from peripherals connected via plug and play, which can infect the system without user involvement, posing a risk to the operating system and other domains.
Innovation Solution
Implementing a hypervisor-managed computing device with a privileged domain that isolates and executes a peripheral-related task to validate and authenticate peripherals before allowing communication with guest domains, using a virtual appliance to scan for malicious code and enforce policy settings to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If plug and play is enabled to allow peripheral connection without user involvement, then ease of operation is improved, but security is worsened due to potential malicious attacks
Solution Approach 1:
The patent introduces a port controller as an intermediary component between the peripheral device and the guest domain. The port controller intercepts and validates communication between the peripheral and the virtual machine, preventing malicious code execution while allowing legitimate plug-and-play functionality. This mediator validates peripheral devices and blocks harmful interactions without requiring user involvement in the connection process.
Solution Approach 2:
The system segments the virtualization environment into distinct components: the guest domain, the port controller, and the peripheral device. By separating the validation function into a dedicated port controller component, the system can enforce security policies independently while maintaining plug-and-play convenience for authorized devices.
2Reliability
If peripheral validation is implemented to prevent malicious attacks, then security is improved, but device complexity is worsened due to additional validation components
Solution Approach 1:
The port controller is designed as a universal component that handles multiple functions: peripheral validation, communication interception, and security policy enforcement. By consolidating these functions into a single multi-functional component rather than adding separate validation systems, the patent improves security while minimizing the increase in device complexity.
Solution Approach 2:
The port controller automatically validates peripheral devices and enforces security policies without requiring external intervention or complex configuration. The validation process is self-contained within the port controller, which independently assesses peripheral legitimacy and blocks malicious connections, reducing the operational complexity of the security system.
3Reliability
If communication with peripheral is blocked until validation to prevent malicious code execution, then security is improved, but productivity is worsened due to delayed peripheral access
Solution Approach 1:
The port controller performs validation of peripheral devices in advance, during the plug-and-play connection process, before the guest domain needs to access the peripheral. This preliminary validation ensures that by the time the peripheral is needed for legitimate operations, the validation is already complete, minimizing the impact on productivity while maintaining security.
Solution Approach 2:
For validated legitimate peripherals, the port controller skips further validation checks and allows rapid communication between the peripheral and the guest domain. The validation process is rushed through efficiently for trusted devices, reducing the perceived delay and maintaining high productivity for authorized peripheral access.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A first guest domain and an isolated peripheral related task. A peripheral related task to communicate with the peripheral and prevent the first guest domain from communicating with the peripheral.