Live Migration Configuration Synchronization for VM Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
During live migration of a virtual machine, the lack of synchronous configuration information migration leads to IP/MAC address forgery attacks, preventing the virtual machine from accessing the network on the new host.
Innovation Solution
A method and system that involve acquiring and sending prestored configuration information to the target forwarding switch and deleting it from the source switch, ensuring the target switch has necessary configuration for network access, thereby preventing address forgery attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DHCP SNOOPING binding table is stored on forwarding switch to filter unreliable configuration information, then security of virtual machine running is improved, but compatibility with live migration mechanism deteriorates because virtual machine cannot sense migration and does not actively initiate DHCP procedure
Solution Approach 1:
The management server proactively pushes the DHCP SNOOPING binding table configuration information to the target forwarding switch before the virtual machine actually migrates. This preliminary action ensures that the binding table is already in place on the target switch, allowing the virtual machine to immediately use it after migration without needing to sense the migration event and initiate a new DHCP procedure.
2Device complexity
If configuration information is not migrated synchronously during live migration, then migration process simplicity is maintained, but network access capability deteriorates because virtual machine is identified as IP/MAC address forgery attack
Solution Approach 1:
The management server acts as an intermediary that coordinates the configuration information migration between the source and target forwarding switches. It receives the virtual machine's configuration information from the source switch, processes it, and pushes it to the target switch before the actual migration occurs. This intermediary role ensures synchronous configuration migration without complicating the overall migration process.
3Reliability
If configuration information is pushed to target forwarding switch before migration, then network access after migration is improved, but additional communication overhead is introduced
Solution Approach 1:
The management server integrates the configuration information push operation into the existing live migration workflow, making it a continuous and seamless process. By pushing the binding table configuration before migration and using the same communication channel for both configuration transfer and migration coordination, the system minimizes additional communication overhead while ensuring network access continuity.
Data Source
AI summary
A method for migrating configuration information during live migration of a virtual machine is disclosed. The method includes, after receiving a message of live migration that a virtual machine migrates from a source physical host to a target physical host sent by a virtual machine management server, acquiring an identifier of a source forwarding switch of the virtual machine and an identifier of a target forwarding switch of the virtual machine, and sending prestored configuration information to the target forwarding switch corresponding to the identifier of the target forwarding switch, so that the target forwarding switch stores the configuration information. The method also includes sending a configuration information deletion instruction to the source forwarding switch corresponding to the identifier of the source forwarding switch, so that the source forwarding switch deletes the prestored configuration information.