Containerized Runtime for Virtual Machine Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current virtual machine technologies lack robust security measures to prevent malicious code from affecting operations and safeguard data, particularly in networked computing environments where virtual machines share resources.
Innovation Solution
A secure runtime system is implemented that sandboxes app execution and provides apps with a copy of virtual machine data instead of direct access, using containerized runtimes and targeted APIs to manage data access and prevent modifications to the data source.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If virtual machines share resources in networked computing environments, then resource utilization and productivity are improved, but security vulnerabilities increase allowing malicious code to affect operations
Solution Approach 1:
The system segments the computing environment by implementing containerized runtimes for each application within the virtual machine. This creates isolated execution contexts that allow multiple apps to share the virtual machine resources while preventing malicious code from affecting other applications or the host system. The segmentation is achieved through namespace isolation and resource control mechanisms.
Solution Approach 2:
The patent introduces an intermediary layer between applications and the virtual machine data through targeted APIs. This intermediary controls and mediates all data access requests, providing read-only access where appropriate and blocking potentially harmful operations. The intermediary ensures that apps can utilize virtual machine resources while maintaining security boundaries.
2Ease of operation
If apps are given direct access to virtual machine data, then ease of operation is improved, but data integrity is compromised allowing malicious modifications
Solution Approach 1:
The system creates controlled copies of virtual machine data that are provided to applications through targeted APIs. These copies can be read-only or have restricted write permissions, allowing applications to access and process data without the ability to make unauthorized modifications to the source data. This copying mechanism maintains data integrity while providing necessary access.
Solution Approach 2:
Targeted APIs serve as an intermediary layer between applications and virtual machine data. This intermediary enforces access control policies, monitoring and filtering all data access requests. It allows legitimate read operations while blocking or restricting write operations that could compromise data integrity, thus maintaining both ease of operation and reliability.
3Reliability
If containerized runtimes are implemented to sandbox app execution, then security is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal containerized runtime platform that can execute multiple different applications with varying security requirements using the same underlying infrastructure. This multi-functional approach consolidates what would otherwise require multiple separate systems, reducing overall complexity while maintaining security. The runtime provides standardized sandboxing mechanisms that work across different application types.
Solution Approach 2:
The system employs nested virtualization where containerized runtimes are nested within the virtual machine environment. This nested structure allows applications to be sandboxed at the container level while the virtual machine provides an additional layer of isolation. The nesting approach organizes complexity in a hierarchical manner, making the system more manageable while enhancing security through multiple layers of protection.
Data Source
AI summary
A computer-implemented method at a data management system comprises: generating, with one or more processors, a containerized runtime in a memory in communication with the one or more processors; instantiating, with the one or more processors, an app in the runtime; receiving, with the one or more processors, a request from the app for data; retrieving, with the one or more processors, a copy of the requested data from a data source; and transmitting, with the one or more processors, the data to the containerized runtime for the app to operate on.