Virtual Disk Cloning for Low-Overhead Cloud Threat Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing environments face challenges in efficiently detecting cybersecurity threats due to the resource-intensive nature of agent-based and agentless solutions, particularly when dealing with multiple disks and encryption, which complicates snapshot generation and requires additional computational burden.
Innovation Solution
A method involving disk cloning is employed, where a cloned disk descriptor is generated with a data field containing the original disk's address, allowing for instant inspection without generating a snapshot, thus reducing resource usage and maintaining the live virtual instance's operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If agent-based solutions are used to scan workloads, then detection capability is improved, but computational burden increases due to additional memory and processing requirements
Solution Approach 1:
The patent extracts the detection functionality from the live virtual instance by creating a snapshot of the disk, which can then be inspected independently. This removes the computational burden from the production system while maintaining detection capability on the snapshot copy.
Solution Approach 2:
The patent creates a copy of the disk data through snapshot generation, allowing inspection of the copied data without affecting the original running system. This copying approach enables detection without adding computational load to the live instance.
2Measurement precision
If snapshots are generated for inspection, then detection capability is improved, but resource usage increases due to intermediate snapshot file generation and disk mounting
Solution Approach 1:
The patent extracts only the necessary disk data into a snapshot that can be directly mounted for inspection, avoiding the generation of intermediate snapshot files. This reduces the quantity of data that needs to be processed and stored temporarily.
Solution Approach 2:
The patent performs preliminary actions by pre-configuring the snapshot to be directly mountable without requiring intermediate file generation steps. This eliminates unnecessary processing steps and reduces resource consumption during the inspection process.
3Adaptability or versatility
If multiple disks are handled in cloud environments, then functionality is improved, but snapshot generation complexity increases
Solution Approach 1:
The patent creates a universal snapshot mechanism that can handle multiple disk types (OS disk, temporary disk, data disk) through a single inspection process. The snapshot system is designed to work with any disk attached to the virtual instance, providing multi-functional capability without increasing complexity.
4Measurement precision
If snapshot generation is performed, then inspection capability is improved, but time is lost due to garbage collection mechanisms and potential interruptions
Solution Approach 1:
The patent performs preliminary actions by ensuring the snapshot generation process is atomic and interruption-free from the start. By designing the snapshot mechanism to complete in a single operation without requiring garbage collection, time is saved by eliminating retry cycles and data purification steps.
Data Source
AI summary
A system and method for inspecting virtual instances in a cloud computing environment for cybersecurity threats utilizing disk cloning is presented. The method includes: selecting a virtual instance in a cloud computing environment, wherein the virtual instance includes a disk having a disk descriptor with an address in a cloud storage system; generating an instruction to clone the disk of the virtual instance, the instruction when executed causes generation of a cloned disk descriptor, the cloned disk descriptor having a data field including the address of the disk of the virtual instance; inspecting the cloned disk for a cybersecurity threat; and releasing the cloned disk in response to completing the inspection of the cloned disk.