Security Virtual Machine Intercepts Cross-VM Network Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional network security software struggles to detect and contain malicious software attacks between virtual machines in a virtualization environment, as inter-VM attacks are difficult to monitor and filter, especially in public virtual cloud environments, and scaling back virtualization efforts defeats economic benefits.
Innovation Solution
Implementing a data traffic filtering technique that uses an authorized security virtual machine to inspect and filter network traffic between virtual machines, with a hook mechanism under the privileged domain and a circular buffer for efficient processing, allowing for detection and elimination of malicious software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network security software is used to monitor inter-VM traffic, then security detection capability is improved, but the traffic becomes visible to network monitoring tools which increases network latency and reduces productivity
Solution Approach 1:
The patent introduces a security virtual machine as an intermediary component within the virtualization environment. This security VM inspects inter-VM traffic internally without requiring traffic to leave the host computer, thus maintaining security detection capability while avoiding the network latency that would result from sending all traffic through external network monitoring tools.
2Reliability
If all inter-VM traffic is sent out to the network for detection, then security monitoring is improved, but network latency increases and productivity decreases
Solution Approach 1:
The security virtual machine acts as an internal intermediary that provides security monitoring capabilities without requiring traffic egress to external networks. The traffic remains within the virtualization environment, allowing inspection to occur without the latency penalties of external network traversal.
Solution Approach 2:
The patent moves security inspection from the external network dimension to the internal virtualization dimension. Instead of routing traffic through external network infrastructure for inspection, the security VM operates within the virtualization layer, creating a new dimension for security enforcement that is independent of external network latency.
3Reliability
If physical security products are used to detect attacks, then detection capability is improved, but they cannot detect attacks between virtual machines on the same host computer
Solution Approach 1:
The security virtual machine provides universal security protection that works across both traditional network traffic and virtualized inter-VM traffic. By operating at the virtualization layer, it can inspect all traffic types uniformly, making it adaptable to various attack vectors including those between virtual machines on the same host.
Solution Approach 2:
The security VM serves as an intermediary between the virtualization platform and the virtual machines, positioned to inspect traffic flows between VMs. This intermediary position enables detection of inter-VM attacks that physical security products placed outside the virtualization environment cannot detect.
4Reliability
If virtualization efforts are scaled back to improve security, then security risks are reduced, but economic benefits of virtualization are defeated
Solution Approach 1:
The security virtual machine provides security enforcement within the virtualization environment itself, allowing full virtualization benefits to be maintained. Organizations can continue consolidating multiple systems onto shared hardware while the security VM monitors and protects traffic between virtualized workloads, preserving both economic benefits and security.
Data Source
AI summary
A security virtual machine inspects all data traffic between other virtual machines on a virtualization platform in order to prevent an inter-VM attack. Data traffic between the machines is intercepted at the privileged domain and directed to the security virtual machine via a hook mechanism and a shared memory location. The traffic is read by the security machine and analyzed for malicious software. After analysis, the security machine sends back a verdict for each data packet to the privileged machine which then drops each data packet or passes each data packet on to its intended destination. The privileged domain keeps a copy of each packet or relies upon the security machine to send back each packet. The security machine also substitutes legitimate or warning data packets into a malicious data package instead of blocking data packets. The shared memory location is a circular buffer for greater performance. Traffic is intercepted on a single host computer or between host computers.