Virtualization OSID Manager Dynamic Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualization systems are vulnerable to brute force attacks by malicious guest OSs, which can access unallocated resources by sequentially changing OSIDs, and current methods to change OSIDs frequently require system restarts or degrade performance.
Innovation Solution
Implementing an OSID manager that periodically updates OSIDs in a virtualization system, allowing for frequent OSID changes while the system is running, and using an update controller to prevent mismatches and invalidate stolen OSIDs, thereby enhancing security and robustness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OSID is changed frequently to prevent brute force attacks, then security is improved, but system restart is required which degrades productivity
Solution Approach 1:
The patent implements dynamic OSID assignment where OSIDs are not fixed but can be changed periodically or on-demand. The OSID management unit generates new OSIDs and updates the mapping between virtual machine identifiers and OSIDs without requiring system restart, allowing the system to adapt its security parameters dynamically while maintaining continuous operation.
Solution Approach 2:
The patent generates new OSIDs in advance and stores them in the OSID management unit before they are needed. When a security update is required, the pre-generated OSIDs are already available for immediate assignment, eliminating the need for system restart and ensuring continuous operation while maintaining security.
2Adaptability or versatility
If OSID is stored in software to allow flexible configuration, then adaptability is improved, but vulnerability to software attacks increases
Solution Approach 1:
The patent introduces an OSID management unit as an intermediary layer between the virtual machine management software and the actual OSID values. This management unit handles OSID generation, storage, and assignment, isolating the critical OSID data from direct software access while maintaining the flexibility of software-based configuration. The intermediary structure prevents malicious software from directly manipulating OSIDs while preserving legitimate configuration capabilities.
3Reliability
If OSID is hidden in hardware registers to prevent attacks, then security is improved, but device complexity increases
Solution Approach 1:
The patent creates a logical copy of the hardware register functionality within the OSID management unit. Instead of requiring physical hardware registers for each virtual machine, the management unit maintains software-based OSID storage that replicates the security properties of hardware registers. This approach achieves hardware-like protection without the complexity of duplicating physical register structures for each virtual machine instance.
Data Source
AI summary
In a virtualization system that includes a hypervisor that performs OSID management for linking a plurality of OSs with resources, a guest OS that receives an initial value from the hypervisor and sets a OSID for each resource, and a OSID manager that sets a OSID for each resource, a new OSID created by OSID generator in OSID manager after a certain period of time has elapsed after setting the initial value is set to the guest OS and the IP (resource), and is requested to be updated to a new OSID set by the update controller in OSID manager. This enables simultaneous updating of OSID of the guest operating system and the resources, thus achieving high robustness.