VM Checkpoint Security Tagging for Malware-Resistant Disaster Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Replication solutions in virtualized computing environments are vulnerable to malware and viruses, as they may infect checkpoints during data replication, leading to increased recovery time and application downtime due to the need to scan each checkpoint for validity before deployment.
Innovation Solution
An in-guest agent monitors VM behavior and synchronizes with a replication module to tag potentially infected checkpoints, allowing secure checkpoints to be used for disaster recovery, thereby reducing the need to scan all checkpoints and minimizing downtime.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virus scans are applied to all checkpoints before deployment, then security of restored VM is improved, but recovery time and application downtime increase
Solution Approach 1:
The system performs preliminary virus scanning and security validation on checkpoints during the replication process before they are needed for recovery. Security tags are assigned to checkpoints in advance based on their security status, so that during disaster recovery, pre-validated secure checkpoints can be immediately deployed without time-consuming scans.
Solution Approach 2:
The patent replaces the mechanical approach of scanning all checkpoints during recovery with an information-based system using security tags and metadata. Instead of physically scanning each checkpoint file, the system uses pre-stored security information (tags, hashes, validation results) to quickly identify and select secure checkpoints, dramatically reducing recovery time.
2Reliability
If all checkpoints are scanned to ensure security, then infected checkpoints are detected, but the number of checkpoints requiring scanning increases recovery time
Solution Approach 1:
The system segments the checkpoint set into multiple groups based on security tags and validation status. Checkpoints are divided into secure, unvalidated, and infected categories, allowing the recovery process to focus only on scanning and selecting from relevant segments rather than examining every checkpoint, thereby improving both detection efficiency and recovery speed.
Solution Approach 2:
The patent introduces security tags and metadata as intermediary elements between the checkpoints and the recovery process. These tags serve as pre-computed security indicators that mediate the selection process, allowing the system to quickly identify secure checkpoints without performing full scans during recovery, thus maintaining detection capability while improving productivity.
3Ease of operation
If security tags are associated with checkpoints during replication, then secure checkpoints can be quickly identified, but the replication process becomes more complex
Solution Approach 1:
The system merges the security validation function with the existing replication process by integrating virus scanning and tag assignment into the checkpoint creation workflow. This consolidation allows security tags to be attached during replication without requiring separate scanning steps, making the process easier to operate while managing complexity through functional integration.
Solution Approach 2:
The replication system performs self-service security validation by automatically scanning checkpoints, generating security tags, and assigning them during the replication process itself. This automated self-validation eliminates the need for manual security assessment and simplifies operation, as the system handles security tagging autonomously as part of its normal replication duties.
Data Source
AI summary
An in-guest agent in a virtual machine (VM) operates in conjunction with a replication module. The replication module performs continuous data protection (CDP) by saving images of the VM as checkpoints at a disaster recovery site over time. Concurrently, the in-guest agent monitors for behavior in the VM that may be indicative of the presence of malicious code. If the in-guest agent identifies behavior (at a particular point in time) at the VM that may be indicative of the presence of malicious code, the replication module can tag a checkpoint that corresponds to the same particular point in time as a security risk. One or more checkpoints generated prior to the particular time may be determined to be secure checkpoints that are usable for restoration of the VM.