Proxy Server Isolating Network Resources in Virtualized Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized environments, existing methods fail to effectively isolate network resources, particularly when a hypervisor acts as a network client, bypassing host OS access controls and risking security by allowing direct access to network storage devices without proper isolation.
Innovation Solution
The implementation of security context labels and a proxy server or unique login accounts to enforce access control checks on network resources, ensuring that each virtual machine has restricted access to its allocated resources, even when the hypervisor connects directly to network storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the hypervisor acts as a network client and connects directly to network storage devices, then system performance is improved through direct access, but security is worsened due to bypassing host OS access controls and lacking proper isolation
Solution Approach 1:
The patent introduces a proxy server as an intermediary component between the hypervisor and network storage devices. The proxy server receives I/O requests from the hypervisor, applies security context labels to determine authorized access, and forwards requests only to permitted network resources. This mediator enables direct hypervisor access for performance while maintaining security controls, resolving the contradiction between productivity and reliability.
2Ease of operation
If the hypervisor bypasses host OS access controls for direct network access, then ease of operation is improved through simplified access paths, but isolation is worsened by risking security and allowing unauthorized access
Solution Approach 1:
The proxy server serves as a security intermediary that maintains simple direct access paths for the hypervisor while enforcing security policies. It transparently applies access control checks based on security context labels without requiring complex configuration or changing the hypervisor's operation model, thus preserving ease of operation while eliminating unauthorized access risks.
Solution Approach 2:
The system performs preliminary security context label assignment to network resources before the hypervisor accesses them. The proxy server pre-configures access rules and security contexts, so that when the hypervisor makes I/O requests, the security checks are already in place and executed automatically, preventing unauthorized access before it can occur.
Data Source
AI summary
Embodiments of the disclosure provide techniques for isolating network resources in a virtualized environment. A method is provided that includes identifying a security context data structure including a first security context label, a resource identifier and a plurality of access types. The first security context label is associated with a virtual machine. Each of the plurality of access types represents a type of access permitted to a resource associated with the resource identifier. The first security context label is associated with a network resource. A request to validate an access right of a client with respect to the network resource is received. The request comprises a second security context label associated with the client and the first security context label associated with the resource. The request is validated in view the first and second security context labels and the security context data structure.