VDI Clone Security via Pre-scanned Inheritance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual desktop infrastructure (VDI) solutions face inefficiencies in security and resource utilization due to the need for each clone image to scan applications independently, which increases processing time and resource consumption.
Innovation Solution
Deploying clone images with pre-scanned results from a server, where the server manages and updates scan results across the network, allowing clients to execute applications without re-scanning if valid scan results are identified, thereby reducing processing time and resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each clone image scans applications independently, then security is maintained at the clone level, but processing time and resource consumption increase significantly
Solution Approach 1:
The base image is scanned for security threats before clone images are created. This preliminary scanning action ensures that the foundational image is secure, and subsequent clones inherit this security state without requiring independent scanning, thereby reducing processing time while maintaining security reliability.
Solution Approach 2:
Security scan results from the base image are copied to clone images. Instead of each clone performing independent scanning, the security validation data is replicated across clones, allowing them to inherit security properties without redundant processing, thus resolving the contradiction between security maintenance and time efficiency.
2Reliability
If each clone image scans applications independently, then security coverage is comprehensive, but resource consumption increases
Solution Approach 1:
Multiple clone images share a common base image that contains the security scan results. This merging approach consolidates the security scanning function at the base image level, allowing all clones to benefit from a single comprehensive security check rather than each clone performing separate scans, thereby reducing overall resource consumption while maintaining security coverage.
Solution Approach 2:
The base image serves multiple functions: it acts as the foundation for multiple clones and simultaneously provides security validation for all of them. This universal security approach allows a single security scan to protect multiple clone instances, reducing redundant resource consumption while ensuring comprehensive security coverage across all clones.
3Reliability
If scan results are updated across the network, then security is maintained with latest threats, but network traffic and update complexity increase
Solution Approach 1:
The system implements a feedback mechanism where security scan results are propagated from the base image to clone images. When the base image is re-scanned with updated threat information, this feedback is automatically transmitted to relevant clones, ensuring they receive security updates without complex manual intervention, thus maintaining timely security while managing update complexity through automated feedback loops.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Utilizing a virtual desktop interface, including receiving, from a server, a clone image comprising an instance of an operating system and an application executing on the server, and a copy of scan results, identify initiation of the application using the clone image, in response to identifying initiation of the application, determine that the copy of scan results includes scan results of the application, and in response to determining the copy of scan results includes scan results of the application, executing the application without any further scan of the application.