Live Virtual Disk Cloning for Snapshot-Free Threat Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing environments face challenges in efficiently detecting cybersecurity threats due to the resource-intensive nature of agent-based and agentless solutions, particularly when dealing with multiple disks and encrypted data, which complicate snapshot generation and require additional computational burdens.
Innovation Solution
A method and system for inspecting live virtual instances by cloning the disk of a virtual machine, utilizing a disk descriptor to create a cloned disk that can be instantly inspected without generating a snapshot, thus reducing resource usage and maintaining the live instance's operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If agent-based solutions are used to scan workloads, then detection capability is improved, but computational burden increases due to additional memory and processing requirements
Solution Approach 1:
The patent extracts the inspection workload from the live virtual instance by cloning its disk to a separate inspection environment. The inspector workload inspects the cloned disk independently, separating detection functions from the production workload, thereby improving detection capability without burdening the original system's computational resources.
Solution Approach 2:
The patent creates a copy of the virtual instance's disk through cloning rather than using agents that run on the original system. This copy can be inspected independently, providing detection capability while avoiding the computational overhead of agent-based solutions on the live system.
2Use of energy by moving object
If agentless snapshot-based solutions are used, then resource consumption is reduced, but inspection complexity increases due to snapshot generation and mounting requirements
Solution Approach 1:
The patent performs disk cloning as a preliminary action before inspection, creating a ready-to-inspect copy of the virtual instance's disk. This pre-prepared clone eliminates the need for snapshot generation and mounting during the inspection process, reducing both resource consumption and inspection complexity.
Solution Approach 2:
Instead of using snapshot-based approaches that require generation and mounting steps, the patent directly clones the disk to create an immediate, inspectable copy. This copying approach reduces resource consumption while simplifying the inspection process by eliminating intermediate snapshot management steps.
3Adaptability or versatility
If multiple disks are present in the virtual instance, then functionality is improved, but snapshot generation becomes more complex and resource-intensive
Solution Approach 1:
The patent segments the inspection process by cloning each disk of the virtual instance separately. This allows the inspector workload to inspect multiple disks independently, maintaining the functionality of multi-disk configurations while simplifying the inspection process compared to snapshot-based approaches that would require coordinating multiple snapshots.
Solution Approach 2:
The patent creates separate copies of each disk through cloning rather than attempting to snapshot multiple disks as a unified structure. This approach maintains the versatility of multi-disk functionality while reducing the complexity of the inspection process by treating each disk as an independent, inspectsable unit.
4Productivity
If disk cloning is used instead of snapshot generation, then inspection speed is improved, but storage requirements increase due to duplicate disk data
Solution Approach 1:
The patent implements a strategy where the cloned disk is used for inspection and then discarded after the inspection is complete. This allows for fast inspection using disk cloning without permanent storage overhead, as the duplicate disk data is temporary and removed after serving its inspection purpose.
Solution Approach 2:
The patent creates temporary copies of disks through cloning for the purpose of inspection. These copies enable faster inspection compared to snapshot approaches, and the storage requirements are managed by discarding the clones after inspection, making the storage usage temporary and purpose-specific.
Data Source
AI summary
A system and method for inspecting live virtual instance in a cloud computing environment for cybersecurity threats utilizes a disk cloning technique. The method includes selecting a live virtual instance in a cloud computing environment, wherein the live virtual instance includes a disk having a disk descriptor with an address in a cloud storage system. An instruction to clone the disk of the live virtual instance is generated, and when executed causes generation of a cloned disk descriptor, the cloned disk descriptor having a data field including the address of the disk of the live virtual instance. The cloned disk is inspected for a cybersecurity threat and the cloned disk is released in response to completing the inspection of the disk.