Hypervisor Same-Host VM Communication Encryption Bypass
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized network environments, there is a need for improved performance by disabling unnecessary encryption and decryption operations, particularly between virtual machines sharing a common host, and for enhanced techniques in Lawful Interception.
Innovation Solution
A method where a hypervisor examines the context of communications to determine if encryption and decryption operations are needed, and if not, processes communications without encryption or decryption, allowing unencrypted communications to be forwarded for Lawful Interception, thereby reducing redundant operations and optimizing performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption and decryption operations are performed for all communications between virtual machines, then security is improved, but system performance deteriorates due to redundant operations
Solution Approach 1:
The patent applies local quality by differentiating encryption requirements based on the specific communication context. Virtual machines on the same host bypass encryption while those on different hosts use encryption, creating localized security policies that optimize performance without compromising overall security.
Solution Approach 2:
The patent changes the parameter of encryption state based on host context. By evaluating whether source and destination VMs reside on the same host, the system dynamically adjusts the encryption parameter, disabling it for same-host communications to eliminate redundant cryptographic operations.
2Productivity
If encryption is disabled for same-host virtual machine communications, then system performance is improved, but security may be compromised
Solution Approach 1:
Security is maintained through local quality by applying encryption selectively based on communication context. Same-host VMs receive unencrypted treatment for performance, while cross-host VMs maintain encrypted channels, ensuring security is preserved where needed without sacrificing performance unnecessarily.
3Adaptability or versatility
If Lawful Interception is implemented in virtualized environments, then compliance requirements are met, but system complexity increases
Solution Approach 1:
The patent extracts the interception function from the general communication processing flow by placing intercepted traffic into a separate queue. This allows Lawful Interception to be implemented as a distinct, optional function that can be enabled or disabled independently, reducing overall system complexity while maintaining compliance capability.
Solution Approach 2:
The patent introduces an intermediary interception mechanism that operates at the hypervisor level, mediating between the encryption/decryption processes and the actual data flow. This intermediary layer enables compliance functionality without requiring complex modifications to the underlying virtual machine communication protocols.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Improved virtualized application performance is provided through disabling of unnecessary functions, such as unnecessary encryption and decryption operations. An example method performed by a hypervisor includes the steps of obtaining a request to one or more of encrypt and decrypt a communication between a first virtual machine and a second virtual, machine; determining if the first and second virtual machines execute on a same host as the hypervisor (e.g., by evaluating a context of the communication); and processing the communication without encrypting or decrypting the communication if the first and second virtual machines execute on the same host. Lawful interception is performed by forwarding an unencrypted version of the communication to an authorized agency. When the communication traverses a switch and/or a router between the first virtual machine and the second virtual machine, an unencrypted version of the communication is placed in a queue within a buffer and a random value and/or an all-zero value is returned to a caller.