Virtual Appliance Agent Insertion via VM Exception Handlers

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional virtual-appliance agent insertion and invocation methods are inefficient and vulnerable to kernel compromises, particularly in security-related applications, due to the need for manual installation and potential interference by malware within user virtual machines.

Innovation Solution

The implementation of an agent-insertion module that inserts and invokes an agent within a virtual machine by exploiting exception handlers and memory allocation functions, allowing for transparent and secure deployment of in-guest agents without direct kernel involvement, thereby protecting the agent's integrity.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If an agent is manually installed in each user virtual machine, then the virtual appliance can interact with user virtual machines, but the deployment complexity and time consumption increase significantly

Engineering Contradiction:

Improveagent functionalityVSAvoiddeployment complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The virtual machine performs self-service by automatically installing the agent through its own exception handler during normal execution, eliminating the need for manual administrator intervention. The agent insertion is triggered automatically when the virtual machine encounters an exception, making the deployment process autonomous and significantly reducing administrative overhead.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The exception handler is pre-configured with agent insertion instructions before the virtual machine runs. When an exception occurs, the pre-prepared handler automatically executes the agent installation, eliminating the need for real-time manual configuration and reducing deployment time.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If an agent is installed in a user virtual machine for security monitoring, then security events can be detected, but the agent may be disabled or tampered with by kernel rootkits or malware

Engineering Contradiction:

Improvesecurity monitoring capabilityVSAvoidkernel compromise risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The exception handler acts as an intermediary between the virtual machine and the agent. Instead of the agent being directly installed in the vulnerable user virtual machine, the exception handler (which executes in a controlled manner) mediates the agent insertion process, providing a layer of protection against direct tampering by kernel rootkits.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The invention converts the harmful effect of exceptions (which are typically error conditions) into a beneficial mechanism for secure agent deployment. By utilizing the exception handling pathway, the system transforms a potential vulnerability into a protected insertion channel that is difficult for malware to interfere with.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

3Loss of energy

If memory de-duplication is used to eliminate redundancy among virtual machines, then resource usage is reduced, but page alignment mismatches prevent effective uncovering of all memory-level redundancy

Engineering Contradiction:

Improvememory resource wasteVSAvoidmemory redundancy detection accuracy

Core Design Contradiction:

Loss of energyVSManufacturing precision

Solution Approach 1:

The invention changes the parameter of memory comparison by using content-based hashing instead of strict page alignment matching. This allows the system to detect redundancy based on actual content similarity rather than being constrained by memory page boundaries, thereby improving the detection accuracy of memory-level redundancy.

Inventive Principle:

Principle #35Parameter changes

4Productivity

If kernel components are refactored into a separate virtual appliance, then resource usage is reduced and development effort is minimized, but the virtual appliance needs efficient agent insertion capability to interact with user virtual machines

Engineering Contradiction:

Improveresource efficiencyVSAvoidagent insertion efficiency

Core Design Contradiction:

ProductivityVSEase of operation

Solution Approach 1:

The virtual appliance performs self-service by automatically inserting agents into user virtual machines through the exception handling mechanism, eliminating the need for manual administrator intervention and significantly improving operational efficiency.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS8225317B1Insertion and invocation of virtual appliance agents through exception handling regions of virtual machines

Publication Date: 2012.07.17 COHESITY INC

AI summary

A method for inserting an agent of a virtual appliance into a virtual machine. The method may include inserting, into an exception handler memory location of a virtual machine, one or more computer-executable instructions configured to facilitate transfer of control from the virtual machine to an agent-insertion module. The method may also include triggering an exception during execution of the virtual machine to cause the one or more computer-executable instructions in the exception handler memory location to be executed. The method may further include obtaining control from the virtual machine after the at least one computer-executable instruction executes. The method may include inserting the agent of the virtual appliance into the virtual machine. Various other methods, systems, and computer-readable media are also disclosed.