Similarity Arbitrator for Cloud VM Security Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, managing security policies across virtual machines with varying security requirements is challenging, as highly secured systems can be compromised by less secure systems within the same infrastructure, leading to potential security breaches.
Innovation Solution
Implementing a similarity arbitrator within a virtualization environment manager that compares and codifies security policies of candidate virtual machines to existing ones, recommending inclusion or exclusion based on predefined thresholds, ensuring that virtual machines with similar security policies are grouped together for enhanced security management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtual machines with different security requirements are hosted in the same cloud computing system, then resource utilization is improved, but security risk increases due to potential attacks on highly secured systems through less secure systems
Solution Approach 1:
The patent segments virtual machines into separate security domains based on their security requirements. Highly secured virtual machines are isolated from less secure ones, creating distinct security zones that prevent attacks from propagating between different security levels while still allowing resource sharing within appropriate domains.
Solution Approach 2:
The patent introduces a similarity arbitrator as an intermediary component that mediates between virtual machines with different security requirements. This arbitrator assesses security policy similarities and makes decisions about domain membership, acting as a buffer that prevents direct conflicts between different security levels while enabling controlled resource access.
2Reliability
If security policies are strictly enforced for each virtual machine, then security reliability is improved, but system complexity increases due to manual configuration and management requirements
Solution Approach 1:
The patent implements self-service by enabling virtual machines to automatically declare their own security policies and by having the similarity arbitrator autonomously assess security similarities and make domain assignment decisions. This eliminates the need for manual security configuration while maintaining high security reliability through automated policy enforcement.
Solution Approach 2:
The patent changes the approach from manual security configuration to automated parameter-based assessment. The similarity arbitrator evaluates security policies using defined parameters and thresholds, automatically determining domain membership based on quantitative security similarity metrics rather than manual rules, thereby reducing complexity while maintaining reliability.
3Extent of automation
If a similarity arbitrator is introduced to manage security domains, then security management capability is improved, but computational overhead increases due to security policy comparisons
Solution Approach 1:
The patent applies partial action by having the similarity arbitrator perform security policy comparisons only when necessary - specifically when virtual machines need to be assigned to domains or when security policies change. Rather than continuously monitoring all virtual machines, the system performs targeted assessments at critical decision points, reducing computational overhead while maintaining effective security management.
Data Source
AI summary
A method includes receiving at a similarity arbitrator information about a security policy of a candidate virtual machine that is proposed to be included in a cluster of virtual machines, comparing the security policy of the candidate virtual machine to the security policies of a plurality of virtual machines in the cluster, and in response to the comparison, recommending that a virtualization environment manager exclude the candidate virtual machine from the cluster or include the candidate virtual machine in the cluster. Related systems and computer program products are also disclosed.