Virtual Machine Forking for Malware Isolation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional virtual machine systems fail to effectively isolate authorized applications from malware attacks when both authorized and unauthorized applications are executed within the same application program group, leading to potential attacks on authorized applications.

Innovation Solution

A virtual machine system with a hypervisor that detects scheduled application programs and generates a new virtual machine to execute only specific programs, while the parent virtual machine runs a dummy program instead of the authorized application, preventing unauthorized applications from executing on the child virtual machine and ensuring authorized applications are not executed on parent virtual machines with unauthorized programs.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a child virtual machine is generated by copying the parent virtual machine to execute an authorized application program, then the child virtual machine can run the authorized application, but the child virtual machine will also inherit unauthorized application programs containing malware from the parent, leading to potential attacks on the authorized application

Engineering Contradiction:

Improvesecurity of authorized applicationVSAvoidmalware attack risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system segments the virtual machine into two distinct entities: a parent virtual machine that runs unauthorized applications and a child virtual machine that exclusively runs authorized applications. This segmentation is achieved by creating a child virtual machine copy that inherits the parent's structure but then isolating its executable content through selective program group management, preventing malware from the parent from affecting the child's authorized applications

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system extracts and removes unauthorized application programs from the child virtual machine's executable content after creation. The program group management unit identifies and eliminates unauthorized programs from the inherited program group, retaining only authorized applications in the child virtual machine, thereby preventing malware inheritance while preserving the benefits of virtual machine copying

Inventive Principle:

Principle #2Taking out (Extraction)

2Productivity

If the parent virtual machine executes both authorized and unauthorized application programs together, then resource utilization is efficient, but the authorized applications are exposed to malware attacks from unauthorized applications

Engineering Contradiction:

Improveresource utilization efficiencyVSAvoidmalware attack on authorized application

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system divides the application execution environment into separate parent and child virtual machines, each with distinct program groups. The parent VM handles unauthorized applications while the child VM exclusively runs authorized applications, achieving security isolation without sacrificing overall system resource utilization efficiency

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The child virtual machine acts as an intermediary execution environment for authorized applications. By routing authorized application execution through the isolated child VM rather than allowing direct execution in the parent VM alongside unauthorized applications, the system creates a protective mediation layer that prevents malware attacks while maintaining efficient resource sharing

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS9460270B2Generating child virtual machine to execute authorized application with reduced risk of malware attack

Publication Date: 2016.10.04 SUN PATENT TRUST

AI summary

When a predetermined application program becomes the target of execution on a virtual machine that is currently being executed, the virtual machine that is currently being executed is designated as a parent virtual machine, and a child virtual machine to execute the predetermined application program is generated by forking. The generated child virtual machine is configured not to execute any application program other than the predetermined application program. The parent virtual machine executes a dummy application program instead of the predetermined application program.