Security Virtual Machine Selection in Virtual Infrastructure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus systems in virtual environments face challenges in efficiently managing input/output operations and workload balancing across security virtual machines (SVMs), leading to potential system failures and compliance issues with security policies, especially when migrating virtual machines between host machines or clusters.
Innovation Solution
A method and system for automatically selecting and connecting security virtual machines (SVMs) by forming a list of accessible SVMs based on restriction requirements, network accessibility, and marker matching, ensuring compliance with security policies and balancing workload while adhering to geographical and virtual location restrictions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a distributed antivirus system with SVMs is implemented, then the burden on host machine processors is reduced, but the complexity of selecting and connecting VMs to appropriate SVMs increases
Solution Approach 1:
The security agent on each VM automatically performs the selection and connection process to an appropriate SVM based on pre-established criteria (geographical location, security policies, workload). This self-service mechanism eliminates manual configuration complexity while maintaining efficient antivirus scanning through automated, policy-compliant SVM selection.
2Productivity
If VMs are migrated between host machines to balance workload, then resource utilization improves, but the risk of violating security policies increases
Solution Approach 1:
Before VM migration occurs, the system pre-establishes criteria including geographical location restrictions and security policy requirements for SVM selection. When migration happens, the security agent uses these pre-defined criteria to automatically select a new SVM that complies with security policies, ensuring policy adherence is built into the migration process rather than being a post-migration check.
3Speed
If automatic SVM selection is implemented without restrictions, then connection speed improves, but security policy violations occur
Solution Approach 1:
The system implements a two-stage filtering process: first, it quickly identifies SVMs that meet basic security policy requirements (partial action), then performs more detailed verification only on those candidates. This approach maintains fast connection speeds by avoiding exhaustive checks on all SVMs while still ensuring security compliance through targeted verification of policy-critical attributes.
4Adaptability or versatility
If the number of SVMs is increased to handle more VMs, then antivirus coverage improves, but the complexity of managing and selecting from more SVMs increases
Solution Approach 1:
The system segments the large pool of SVMs into distinct groups based on geographical location, security policy requirements, and functional characteristics. Each VM's security agent only needs to consider SVMs within its designated segment, dramatically reducing the search space and selection complexity while maintaining comprehensive antivirus coverage across all VMs through the distributed segmented architecture.
Data Source
AI summary
Disclosed herein are systems and methods of selecting security virtual machines (SVMs) for a virtual machine (VM) in a virtual infrastructure. In one aspect, an exemplary method comprises, forming a list of SVMs, wherein SVM performs security tasks for the VM, and VM includes a security agent configured to interact with the SVM, determining restriction requirements of the security agent and removing from the list SVMs not conforming to restriction requirements on limits of interaction area of the security agent, polling SVMs remaining on the list to determine network accessibility of said SVMs and removing inaccessible SVMs, for each accessible SVM remaining on the list, determining whether a marker of the SVM matches that of the security agent of the VM and removing SVMs whose markers do not match the marker of the security agent, and providing the list of remaining SVMs to the security agent of the VM.