Virtual Computer Security with Startup Verification and Decoy Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems fail to effectively guide and observe attacks by attackers while preventing them from accessing legitimate networks, especially in the context of verifying device authenticity in virtual computers.
Innovation Solution
A security system that verifies device authenticity using verification information generated from the startup information of an information processing device and, if authenticity is not verified, redirects communication to a decoy network mimicking the legitimate network, thereby guiding attacks to a controlled environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If device authenticity verification is implemented using startup information, then security against attackers is improved, but system complexity increases
Solution Approach 1:
The system performs preliminary verification of device authenticity during the startup phase by generating verification information from startup information (BIOS, bootloader, kernel) before the device fully operates. This allows security checks to be conducted in advance, preventing unauthorized devices from accessing the network without adding complex verification mechanisms during normal operation.
Solution Approach 2:
The patent introduces a communication control device as an intermediary between the virtual computer and the network. This mediator handles the complexity of verification by receiving verification information, determining device authenticity, and controlling communication accordingly, thereby isolating the complexity from the core device while maintaining security.
2Loss of information
If attackers are redirected to decoy networks, then observation of attacks is improved, but loss of legitimate communication increases
Solution Approach 1:
The system applies different communication routing policies to different devices based on their verification status. Verified devices maintain normal communication paths to legitimate networks, while unverified devices are redirected to decoy networks. This localized differentiation ensures that only potentially malicious traffic is diverted, preserving legitimate communication efficiency while enabling attack observation.
Solution Approach 2:
The patent creates decoy networks that replicate the structure and appearance of legitimate networks. These copied network environments allow attackers to be redirected and observed without affecting actual legitimate communications, as the decoys are indistinguishable from real networks to attackers but controlled by the security system.
3Reliability
If communication control is implemented based on verification results, then security against unauthorized access is improved, but device operation flexibility decreases
Solution Approach 1:
The communication control mechanism dynamically adjusts network access based on real-time verification results. Devices that pass verification maintain full operational flexibility and access to legitimate networks, while those that fail verification are redirected to decoy networks. This dynamic approach ensures that security controls are applied only when necessary, preserving device operation flexibility for authenticated devices while preventing unauthorized access.
Data Source
AI summary
A security system according to an aspect of the present disclosure includes: at least one memory storing a set of instructions; and at least one processor configured to execute the set of instructions to: verify device authenticity by using verification information, the device authenticity being authenticity of hardware of an information processing device that achieves a virtual computer, the verification information being generated from information about starting up of the information processing device; and instruct a communication control device that controls communication from the virtual computer to set a communication partner of the virtual computer to a decoy network in a case where the device authenticity is not verified, the decoy network mimicking a connection destination of the virtual computer.