Virtual Machine File System Content Protection via Hardware Partitioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Providing security for multiple virtual machines on a single physical computer is overhead-intensive due to the need for separate security services for each virtual machine, which can be circumvented by malicious code.
Innovation Solution
Creating a first virtual machine with a remote file system that securely redirects input/output from a second virtual machine, using hardware-enforced partitioning to protect the file system, and providing a single security application for multiple virtual machines, ensuring that even if malicious code attacks the file system interface, access to the remote file system is disabled, implementing a fail-closed model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a separate security service is provided for each virtual machine, then security coverage is improved, but system overhead increases
Solution Approach 1:
The patent merges security services into a single centralized service that protects multiple virtual machines. Instead of deploying separate antivirus scanners in each VM, a unified security service is implemented that can scan and protect files across multiple VMs, thereby reducing system overhead while maintaining comprehensive security coverage.
Solution Approach 2:
The security service is designed with multi-functionality to serve multiple virtual machines simultaneously. It can scan files, detect malicious code, and provide protection across different VMs through a single instance, making the security system universal rather than dedicated to each individual VM.
2Reliability
If hardware-enforced partitioning is implemented, then security protection is improved, but system complexity increases
Solution Approach 1:
The patent introduces a file system interface as an intermediary layer between virtual machines and the remote file system. This interface acts as a mediator that enforces access control and security policies, protecting the file system from malicious code while managing the complexity of hardware-enforced partitioning through a standardized interface layer.
Solution Approach 2:
The system segments the file system access control into distinct components: the remote file system, the file system interface, and individual virtual machine instances. This segmentation allows hardware-enforced partitioning to be implemented in a modular way, where each component has a specific security function, making the overall system more manageable despite the increased protection requirements.
3Device complexity
If a single security application is provided for multiple virtual machines, then overhead is reduced, but security isolation between virtual machines decreases
Solution Approach 1:
The file system interface serves as an intermediary that maintains security isolation between virtual machines while enabling a single security application to protect multiple VMs. The interface enforces access control policies that prevent malicious code in one VM from accessing or corrupting files in other VMs, thereby preserving security isolation despite the centralized security architecture.
Solution Approach 2:
The security system implements local quality by applying different security policies and access controls to different virtual machines through the file system interface. Each VM can have customized security permissions and access rules enforced at the interface level, allowing a single security application to provide both centralized protection and localized security isolation for each VM.
Data Source
AI summary
A method includes creating a first virtual machine comprising a remote file system. The method further includes causing all input/output from a second virtual machine to be redirected to the remote file system, the first virtual machine and the second virtual machine being on a single physical computer. The file system is securely protected from any malicious code executing on the second virtual machine by the hardware enforced partitioning between the first virtual machine and the second virtual machine.