VM Access Redirection via Control VM for Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Companies face challenges in isolating employee personal data from work-related data within virtual machines, as employees often access both personal and corporate resources on the same machines, risking exposure of sensitive corporate information.
Innovation Solution
A system and method for redirecting requests from secure to unsecure virtual machines and vice versa, based on the security classification of the requested resource, using a control virtual machine to intercept and manage access, ensuring that sensitive corporate resources are not accessed from unsecure environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If employees access both personal and corporate resources on the same virtual machine, then ease of operation is improved, but data security deteriorates due to exposure of sensitive corporate information
Solution Approach 1:
The system segments the virtual machine environment into secure and unsecure domains, creating distinct isolation zones. The control virtual machine intercepts requests and routes them to appropriate domains based on security classification, allowing employees to access both personal and corporate resources while maintaining strict separation between secure corporate data and unsecure personal data.
Solution Approach 2:
The control virtual machine acts as an intermediary between applications and resources, intercepting requests and determining their security classification. It mediates access by redirecting requests to secure or unsecure virtual machines based on the resource type, thereby protecting corporate resources without blocking employee access to personal resources.
2Reliability
If requests are redirected between secure and unsecure virtual machines, then data security is improved, but device complexity increases due to additional control mechanisms
Solution Approach 1:
The control virtual machine performs multiple functions: intercepting requests, classifying resources as secure or unsecure, determining appropriate destination virtual machines, and redirecting requests. This multi-functional approach consolidates complexity into a single component rather than requiring separate mechanisms for each function.
Solution Approach 2:
The system automatically classifies resources and redirects requests without requiring manual user intervention or complex configuration. The control virtual machine autonomously determines security classifications and routing decisions, reducing operational complexity despite the sophisticated security mechanisms.
3Reliability
If corporate resources are isolated from personal data, then data security is improved, but adaptability deteriorates as employees cannot access both types of resources
Solution Approach 1:
The system dynamically routes requests to secure or unsecure virtual machines based on the specific resource being accessed. Rather than static isolation, the system adapts its behavior per request, allowing employees to access both personal and corporate resources with appropriate security measures applied to each.
Solution Approach 2:
Different security levels are applied to different resources based on their classification. Corporate resources receive secure handling through the secure virtual machine, while personal resources are accessed through the unsecure virtual machine. This local quality approach ensures appropriate security for each resource type while maintaining overall system versatility.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
The present invention is directed towards methods and systems for redirecting an access request to an unsecure virtual machine. A computing device may execute a hypervisor hosting a secure virtual machine and an unsecure virtual machine. A control virtual machine, hosted by a hypervisor executing on the computing device, may intercept a request to access an unsecure resource. The unsecure resource may include one of: a file, an application and an uniform resource locator (URL). The control virtual machine may further determine that the request originates from a secure virtual machine executing on the computing device. The control virtual machine may redirect, responsive to the determination, the request to an unsecure virtual machine executing on the computing device, whereupon the unsecure virtual machine may provide access to the requested unsecure resource.