Kernel-Space Filter Driver for Multi-Tenant VM Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant data centers, the one-VM-per-user approach limits the number of users per host due to resource allocation inefficiencies, as VMs require minimal resources and often underutilize available resources, leading to inefficient use and allocation of computing resources.
Innovation Solution
Implementing a distributed firewall within each virtual machine that dynamically updates security policies in real-time, allowing multiple user sessions to share resources while enforcing user-specific security policies through a filter driver located in the kernel space, enabling flexible and efficient resource utilization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a one-VM-per-user approach is used, then security policies can be enforced effectively, but the number of users per host is limited and resource allocation is inefficient
Solution Approach 1:
The patent segments the traditional one-VM-per-user model into a multi-tenant VM architecture where multiple user sessions share a single VM. The distributed firewall within the hypervisor segments network traffic by creating separate security contexts for each user session, enabling independent security policy enforcement while allowing multiple users to share the same physical host resources.
Solution Approach 2:
The patent implements a universal VM that can serve multiple users simultaneously through session-based virtualization. The hypervisor-based distributed firewall provides multi-functional capability by enforcing security policies for multiple user sessions within a single VM, making the system both secure and resource-efficient.
2Productivity
If multiple users share a VM, then resource allocation efficiency improves, but security isolation between users becomes more difficult to maintain
Solution Approach 1:
The patent applies segmentation at the network session level within the shared VM. The hypervisor creates distinct network namespaces and security contexts for each user session, ensuring that while users share physical resources, their network traffic remains isolated and can be enforced with separate security policies.
Solution Approach 2:
The hypervisor acts as an intermediary between multiple user sessions sharing a VM. It mediates network traffic by intercepting packets, identifying the source user session, applying the appropriate security policy, and forwarding traffic accordingly. This intermediary ensures security isolation is maintained despite resource sharing.
3Loss of energy
If a distributed firewall is implemented within the hypervisor, then network traffic is reduced by blocking packets at the host level, but device complexity increases
Solution Approach 1:
The patent implements self-service by placing the distributed firewall functionality directly within the hypervisor itself rather than requiring separate firewall appliances or complex external systems. The hypervisor automatically enforces security policies for all user sessions, reducing network traffic at the source without adding external complexity.
Solution Approach 2:
The patent merges the virtualization and firewall functions into a single integrated hypervisor-based system. By combining resource virtualization with security enforcement in one component, the system reduces overall device complexity while maintaining effective packet filtering and traffic reduction capabilities.
Data Source
AI summary
The disclosure provides an approach for implementing a distributed firewall within a data center. The firewall is implemented as a kernel space filter driver within the operating system of virtual machines. Each virtual machine hosts several user sessions. The firewall may be dynamically updated with new security policies, either by an administrator or a component of the data center.