Hypervisor Security Layer for VM Malware-Resistant Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to adequately protect virtual machines from malware attacks that exploit security vulnerabilities in hypervisors during communications, posing a significant risk to virtualization-based computing environments.
Innovation Solution
Implementing a network security layer in the hypervisor that authenticates and authorizes incoming communications by intercepting and decrypting network packets using single-use cryptographic keys, comparing packet parameters with expected values, and monitoring communication pathways to ensure secure data exchange between virtual machines and remote nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a network security layer is implemented in the hypervisor to intercept and authenticate network packets, then security against malware attacks is improved, but device complexity increases
Solution Approach 1:
A network security layer is introduced as an intermediary component within the hypervisor that sits between network packets and virtual machines. This layer intercepts, authenticates, and authorizes packets before they reach the virtual machines, providing security without requiring changes to the virtual machine operating systems or applications.
Solution Approach 2:
The security function is segmented from the hypervisor core and implemented as a separate network security layer that can operate independently. This allows the security functionality to be added without redesigning the entire hypervisor architecture, reducing the complexity impact.
2Reliability
If single-use cryptographic keys are used to decrypt network packets, then authentication security is improved, but processing time increases
Solution Approach 1:
Cryptographic keys and authentication parameters are pre-established and stored in the network security layer before actual packet processing occurs. When packets arrive, the system only needs to retrieve and apply the appropriate pre-configured keys rather than performing complex key generation or exchange operations during packet processing.
Solution Approach 2:
The system uses single-use cryptographic keys that are discarded after one use, eliminating the need for complex key management and rotation mechanisms. Each packet or packet batch can be authenticated with a fresh key that is then discarded, simplifying the cryptographic operations.
3Reliability
If network packets are decrypted and packet parameters are compared with expected values, then data integrity is improved, but processing overhead increases
Solution Approach 1:
Instead of decrypting and validating every packet parameter thoroughly, the system applies different levels of inspection based on packet characteristics. Critical packets requiring full validation are processed deeply, while less critical packets receive minimal inspection, optimizing the balance between integrity verification and processing speed.
Solution Approach 2:
The system performs packet validation selectively rather than universally. By comparing packet parameters against expected values only for authorized communication pathways and critical data types, the system achieves sufficient integrity verification without the overhead of exhaustive validation for all packets.
Data Source
AI summary
The present disclosure relates to network security software cooperatively configured on plural nodes to authenticate and authorize devices, applications, users, and data protocol in network communications by exchanging nonpublic identification codes, application identifiers, and data type identifiers via pre-established communication pathways and comparing against pre-established values to provide authorized communication and prevent compromised nodes from spreading malware to other nodes.