Virtual Machine Image Certification via Validator VM
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, customers face challenges in trusting the security of pre-built virtual machine images, as they cannot verify if these images are free from malware, and existing methods like provenance validation are insufficient due to limited metadata and difficulty in inspecting virtual machine images without instantiation.
Innovation Solution
A method involving the installation of anti-malware in virtual machines to scan for malware, generate and store a fingerprint for certified images, and utilize a validator virtual machine to inject a security module for scanning and reporting, ensuring the image's safety before listing it in a catalog, thereby providing a trusted certification process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If pre-built virtual machine images are provided in cloud computing environments, then service setup and deployment are simplified and accelerated, but security trust and malware verification become problematic
Solution Approach 1:
The patent applies preliminary action by performing malware scanning and security verification on virtual machine images before they are deployed to customers. The images are pre-scanned in a controlled environment, and security certificates are generated in advance, allowing customers to deploy images quickly without performing time-consuming security checks themselves.
Solution Approach 2:
The patent introduces an intermediary security certification mechanism that acts as a trusted third party between the image provider and the customer. A validator virtual machine with security modules serves as this intermediary, verifying image integrity and generating certificates that customers can trust without having to perform their own comprehensive security analysis.
2Reliability
If malware scanning is performed on virtual machine images, then security verification is improved, but processing time and computational resources increase
Solution Approach 1:
Malware scanning is performed in advance during the image preparation phase rather than at deployment time. The validator virtual machine scans images before they are made available in the marketplace, so that when customers deploy images, the security verification has already been completed, eliminating time loss for end-users.
Solution Approach 2:
The patent uses a validator virtual machine that creates a copy of the target virtual machine image for scanning purposes. This allows the original image to remain unchanged and ready for deployment while a separate copy undergoes time-consuming security analysis, thus not delaying the deployment process.
3Reliability
If validator virtual machines are executed to scan images, then security certification is enhanced, but cloud processing costs increase
Solution Approach 1:
The validator virtual machine is designed to be self-contained with all necessary security modules and scanning tools included. It autonomously performs scanning operations without requiring continuous cloud resource allocation or manual intervention, reducing ongoing processing costs while maintaining high certification reliability.
Solution Approach 2:
Instead of continuously running validator virtual machines, the system performs scanning operations periodically or on-demand when new images are submitted for certification. This periodic action reduces energy consumption and processing costs compared to maintaining constant validation capabilities, while still providing reliable certification when needed.
Data Source
AI summary
Virtual machine images in a cloud computing environment may be certified using a validator machine image. The validator machine image is configured to boot a validator virtual machine, which boots a virtual machine off a virtual machine image from among virtual machine images available in the catalog of the cloud computing environment. The validator virtual machine may scan the virtual machine for malware, including computer viruses. A virtual machine image from among the virtual machine images may be packaged to include a certifier agent that verifies the virtual machine image upon execution. Reputation of virtual machine images may be stored in a virtual machine image reputation database and made available by way of a portal.