Virtual Environment Security via Host-Mediated File Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In container-type virtualization technologies, there is a need to dynamically manage and secure the execution of applications within virtual environments, as existing methods are vulnerable to attacks that delete or modify security files, leading to unauthorized software execution.
Innovation Solution
An information processing apparatus is designed with a deployment unit, a virtual environment creator, a recorder, a manager, and a normality determinator. This apparatus deploys image files to create virtual environments, records information about security files, and determines whether to execute software based on the security settings, while also checking for any abnormalities in the security files to prevent malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If security files are stored in the virtual environment for convenience of management, then ease of operation is improved, but reliability deteriorates due to vulnerability to deletion attacks
Solution Approach 1:
The patent introduces a host environment as an intermediary layer between the virtual environment and the security configuration. The host OS manages security files externally to the container, preventing direct access and deletion by applications within the virtual environment. This mediator approach allows convenient management through the host while protecting against reliability issues by isolating security-critical files from the virtual environment's attack surface.
2Reliability
If the host checks security settings at application launch time, then reliability is improved by preventing unauthorized execution, but device complexity increases due to additional checking mechanisms
Solution Approach 1:
The patent implements preliminary action by pre-configuring security settings and policies in the host environment before applications are launched in virtual environments. The host OS prepares security configurations, access control lists, and policy rules in advance, so that when an application attempts to launch, the security check is simply a validation against pre-established rules rather than complex real-time analysis. This reduces the complexity of the checking mechanism while maintaining strong security enforcement.
Data Source
AI summary
An information processing apparatus has a deployment unit configured to deploy an image file and to create files used for a virtual environment, a virtual environment creator configured to create the virtual environment using the files, a recorder configured to record information about a first file included in the files, a manager configured to access the first file stored in the virtual environment and to determine, based on information acquired by accessing the first file, whether to execute software whose execution was detected in the virtual environment, and a normality determinator configured to determine, based on a difference between information acquired by accessing the first file and information about the recorded first file, whether the first file is normal.