Hypervisor VM Image Patching Security Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized computing environments, VM images remain vulnerable to attacks until patches are applied, and existing patch management systems do not ensure secure updating processes, leaving them exposed during the patching process.
Innovation Solution
A hypervisor-managed system that retrieves patches from a secure site, blocks all network access to the VM image except for the secure site, applies the patches, and then unblocks access, ensuring secure and isolated patch updates to prevent external attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If VM images are kept connected to the network for normal operation, then ease of operation is improved, but security is worsened because the VM images remain vulnerable to attacks during the patching process
Solution Approach 1:
The system performs preliminary actions by suspending the VM image before patching begins, blocking network access, and only then applying patches. This preliminary isolation prevents attack vectors from being active during the vulnerable patching window, resolving the contradiction by ensuring security measures are in place before the vulnerability window opens.
Solution Approach 2:
The patent introduces an intermediary mechanism (patch management system) that mediates between network access and patching operations. This intermediary controls network connectivity, allowing it to be blocked during patching while maintaining normal access during operation, thus resolving the contradiction through controlled intermediation.
2Reliability
If patches are applied individually to each VM image, then security is improved by ensuring each image is patched, but productivity is worsened due to the time-consuming individual update process
Solution Approach 1:
The patent merges multiple patching operations into a single coordinated process. By suspending the VM image once and applying multiple patches during the suspended state, the system combines what would otherwise be multiple separate patching cycles into one efficient operation, resolving the contradiction between comprehensive patch coverage and patching speed.
Solution Approach 2:
The system maintains continuous useful action by keeping the VM image in a suspended but preserved state throughout the patching process. Rather than repeatedly suspending and resuming the VM for each patch, the system continues the patching workflow uninterrupted during the single suspension period, maximizing productivity while ensuring complete patch coverage.
3Reliability
If the VM image is suspended during patching, then security is improved by blocking network access, but ease of operation is worsened due to service interruption
Solution Approach 1:
The system performs the service interruption as a preliminary, controlled action before patching begins. By suspending the VM image once at the start and maintaining that state throughout patching, the system minimizes the duration and frequency of service interruptions while ensuring security protection is in place, resolving the contradiction through efficient preliminary action.
Solution Approach 2:
The patent applies the skipping principle by rapidly completing all necessary patching operations during the suspended state, minimizing the time the VM image remains non-operational. This rushes through the patching process efficiently, reducing the impact on service availability while maintaining security protection throughout.
Data Source
AI summary
Virtual Machine (VM) images in a virtualized environment are updated through the use of patches. A virtualization data processing system includes a hypervisor that manages a VM image. The hypervisor is configured to retrieve a patch for an instance of the VM image from a secure site. The hypervisor blocks all other network access to the VM image. The hypervisor is configured to apply the patch to the instance of the VM image and unblock all network access to the VM image