VM-Based Configuration Compliance Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

It is challenging to determine whether a computing device is in its intended configuration state, especially when managing multiple configuration sources, as traditional approaches fail to verify the enforcement of policies and resource provisioning effectively due to conflicting values and context-based triggers.

Innovation Solution

The computing device operates in a configuration compliance evaluation mode, applying configuration requests in a virtual machine to test and verify the enforced configuration state, allowing for the identification of misconfigurations and ensuring compliance with intended settings through data storage and attestation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If configuration requests are applied directly to the computing device, then configuration management efficiency is improved, but the ability to verify enforcement and identify misconfigurations deteriorates

Engineering Contradiction:

Improveconfiguration management efficiencyVSAvoidverification capability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent introduces a debugger component as an intermediary between the configuration management system and the computing device. This debugger captures configuration requests, applies them through a virtual machine, and verifies enforcement, thereby maintaining both efficient configuration management and reliable verification capabilities without directly modifying the production system.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent creates a virtual machine copy of the computing device environment to test and verify configuration requests. By applying configurations to this virtual copy rather than the production system, the patent enables safe verification and misconfiguration identification while maintaining configuration management efficiency in the actual system.

Inventive Principle:

Principle #26Copying

2Adaptability or versatility

If multiple configuration sources are managed simultaneously, then device management flexibility is improved, but the difficulty of verifying configuration enforcement deteriorates

Engineering Contradiction:

Improvedevice management flexibilityVSAvoidverification difficulty

Core Design Contradiction:

Adaptability or versatilityVSDifficulty of detecting and measuring

Solution Approach 1:

The debugger component serves as an intermediary that intercepts and tracks configuration requests from multiple configuration sources. It applies these requests sequentially in a controlled virtual environment and verifies enforcement, making it possible to manage multiple configuration sources flexibly while maintaining the ability to detect and measure their individual and combined effects.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the configuration verification process by tracking each configuration request separately through the virtual machine. This segmentation allows the system to manage multiple configuration sources independently while verifying their enforcement individually and collectively, reducing the complexity of verification despite increased flexibility.

Inventive Principle:

Principle #1Segmentation

3Measurement precision

If configuration changes are applied to test configuration requests, then verification accuracy is improved, but the loss of time for reverting changes deteriorates

Engineering Contradiction:

Improveverification accuracyVSAvoidrevert time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies configuration changes to a virtual machine copy rather than the production system. This copying approach enables accurate verification of configuration enforcement while eliminating the need to revert changes on the production system, as the virtual machine can be reset or discarded without impacting actual device operations.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The virtual machine environment allows the system to discard test configuration changes easily by simply resetting or deleting the virtual machine instance. This approach maintains high verification accuracy while minimizing the time and effort required to revert changes, as the virtual environment can be quickly restored to its initial state without affecting the production system.

Inventive Principle:

Principle #34Discarding and recovering

Data Source

PatentUS10437625B2Evaluating configuration requests in a virtual machine

Publication Date: 2019.10.08 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Various technologies described herein pertain to evaluating configuration compliance of a computing device. The computing device operates in a configuration compliance evaluation mode to test a set of configuration requests for a configuration source. Configuration changes to the computing device can be applied in a virtual machine run on the computing device when operating in the configuration compliance evaluation mode. Responsive to each configuration request being received and when the computing device is operating in the configuration compliance evaluation mode, the computing device can store the configuration request in a data store, apply the configuration request in the virtual machine to cause a configuration change in the virtual machine, and store data for verifying enforcement of the configuration change in the data store. The configuration changes to the computing device applied in the virtual machine can be removed when the computing device discontinues operating in the configuration compliance evaluation mode.