Stateless Virtualization Management Through Firewalls
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional virtual machine management tools face connectivity issues and security risks due to their active and stateful nature, which are problematic in organizations with strict firewall policies, leading to implementation delays and potential security exposures.
Innovation Solution
Implementing a stateless management approach using agents on host machines that communicate with a central management service via HTTP/HTTPS protocols, allowing agents to initiate communication without a standing connection and using bidirectional protocols like WebSockets for real-time interactions, while maintaining security through certificate-based authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If active and stateful management approach is used, then real-time communication and control capability is improved, but connectivity issues occur due to firewall restrictions
Solution Approach 1:
The patent introduces an intermediary communication layer using standard HTTP/HTTPS protocols as a mediator between the management service and managed agents. This intermediary approach allows communication to pass through firewalls that restrict direct connections, as HTTP ports are typically allowed through security devices. The agent initiates communication by sending HTTP requests to the management service, enabling indirect but reliable connectivity.
Solution Approach 2:
The patent changes the communication parameters from stateful protocols requiring persistent connections and complex port configurations to stateless HTTP/HTTPS requests. By using standard web protocols with well-known ports (80, 443), the system transforms the communication approach to be firewall-friendly, improving connectivity reliability without sacrificing real-time interaction capabilities.
2Reliability
If open ports are configured for management communication, then connectivity between management tools and agents is improved, but security risks increase
Solution Approach 1:
The patent uses HTTP/HTTPS as an intermediary protocol that operates through standard web infrastructure. Instead of opening specialized management ports, the system communicates through the intermediary layer of web traffic, which is already permitted by firewalls. This eliminates the need to open restrictive ports while maintaining communication connectivity.
Solution Approach 2:
The patent employs stateless HTTP requests that create temporary, disposable connections rather than persistent stateful connections. Each HTTP request is independent and short-lived, reducing the attack surface compared to persistent open ports. The stateless nature means no long-term connections need to be maintained open, improving security while preserving functional connectivity.
3Ease of operation
If stateful management approach is implemented, then active communication capability is improved, but implementation delays occur due to policy configuration
Solution Approach 1:
The patent fundamentally changes the communication parameters from stateful protocols requiring complex firewall configuration to stateless HTTP/HTTPS. This parameter change eliminates the need for administrators to configure specialized ports and policies, as standard web traffic rules already permit the communication. Implementation is accelerated because no custom security policies need to be created or modified.
Solution Approach 2:
By using HTTP/HTTPS as an intermediary, the patent leverages existing infrastructure and policies that are already in place for web traffic. This eliminates the need for new policy configurations, as firewalls and security devices already allow ports 80 and 443. The intermediary approach thus eliminates implementation delays associated with configuring stateful communication policies.
4Object-affected harmful factors
If restricted ports and protocols are enforced at firewall level, then security is improved, but connectivity issues occur
Solution Approach 1:
The patent changes the communication parameters to use standard HTTP/HTTPS protocols on well-known ports that are typically permitted through firewalls. By aligning with standard web traffic parameters, the system maintains communication reliability even when restrictive port and protocol policies are in place. The stateless nature of HTTP requests ensures connectivity without requiring exceptions to security policies.
Data Source
AI summary
Systems and methods for providing stateless management of a virtualization platform are disclosed. In some aspects, the techniques described herein relate to a method including: listening, at an agent executing on a host machine of a plurality of host machines that include a cluster for hosting virtual machines, for an event triggered on a virtual machine manager associated with the agent; determining, by the agent and based on the event, parameters needed for an API call at a central management service that manages a plurality of virtual machines and virtual machine managers; sending a Hypertext Transfer Protocol (HTTP) request to the central management service, wherein the parameters are included in the HTTP request; receiving, by the agent and from the central management service, a response to the HTTP request including return data based on the determined parameters and the API call.