Virtual Machine Security via Clock Access Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing environments face security threats from malicious software applications that perform side-channel attacks by exploiting clock accesses to compromise encryption processes on virtual machines, which existing technologies fail to effectively prevent.
Innovation Solution
A system that monitors clock accesses on virtual machines, detects excessive usage beyond a threshold, limits clock access frequency, and migrates virtual machines to different physical machines to prevent hostile processes from compromising encryption processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If virtual machines are hosted on the same physical machine to improve resource utilization, then productivity increases, but security reliability deteriorates due to side-channel attacks
Solution Approach 1:
The patent segments virtual machines into different security zones based on their security requirements and threat levels. High-security virtual machines (e.g., those running encryption processes) are isolated from low-security virtual machines (e.g., those executing unverified code) through virtualization layers and security policies, preventing side-channel attacks while maintaining resource sharing
Solution Approach 2:
The patent introduces intermediary security mechanisms including virtualization layers, security agents, and monitoring systems that act as mediators between virtual machines and physical hardware. These intermediaries detect and block malicious clock accesses before they can compromise encryption processes, enabling secure multi-tenant environments
2Difficulty of detecting and measuring
If clock access monitoring is implemented to detect malicious processes, then security detection capability improves, but system complexity increases
Solution Approach 1:
The patent implements self-service security monitoring where the virtualization layer and security agents automatically detect, analyze, and respond to malicious clock access patterns without requiring external intervention. The system autonomously identifies side-channel attacks through anomaly detection and executes countermeasures such as isolating affected virtual machines or blocking malicious processes
Solution Approach 2:
The patent changes monitoring parameters dynamically based on system conditions, adjusting the granularity and intensity of clock access monitoring. Instead of continuous high-level monitoring that would overwhelm the system, the patent uses threshold-based triggering and adaptive sampling rates to maintain detection effectiveness while minimizing overhead
Data Source
AI summary
Among other disclosed subject matter, a computer-implemented method includes executing a plurality of virtual machines on a physical machine, wherein a first virtual machine of the plurality of virtual machines executes an encryption process. Execution of a hostile process that is configured to compromise the encryption process is detected, wherein the hostile process executes in a second virtual machine of the plurality of virtual machines. Migrating at least the second virtual machine to a different second physical machine based on the detection of the execution of the hostile process.