Virtual Machine Message Routing via Intermediary Layer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computing systems face security vulnerabilities as malicious virtual machines can bypass monitoring utilities by transmitting data over alternative communications channels, such as the PCI bus or serial data link, thereby evading detection.
Innovation Solution
Implementing a message manager that dynamically routes messages from virtual device queues to socket queues, allowing messages to be transmitted via different communications hardware devices based on message characteristics, thereby preventing the circumvention of monitoring utilities and enhancing security by enforcing security policies through a policy table.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtual machines transmit data over alternative communications channels (PCI bus, serial data link), then communication flexibility and speed are improved, but security monitoring capability deteriorates as malicious VMs can bypass monitoring utilities
Solution Approach 1:
The patent introduces a hypervisor as an intermediary layer between virtual machines and physical communication channels. The hypervisor intercepts and monitors all communication traffic regardless of which channel is used, preventing malicious VMs from bypassing security utilities. This mediator ensures centralized control and monitoring of data flows across multiple communication paths.
Solution Approach 2:
The monitoring system is designed to be universal by implementing multiple monitoring utilities that can monitor different types of communication channels (network interfaces, PCI bus, serial data links) simultaneously. This multi-functional approach ensures that no matter which alternative channel a malicious VM uses, there is an appropriate monitoring utility in place to detect and prevent security threats.
2Reliability
If multiple communications hardware devices are used for virtual machine communication, then system reliability and communication options are improved, but device complexity and routing management increase
Solution Approach 1:
The patent extracts the routing management complexity from the individual virtual machines and centralizes it in the hypervisor. The hypervisor maintains routing tables and policies that determine which communication channel should be used for each message based on destination VM, message characteristics, and current system state. This extraction simplifies the overall system by providing a single point of control for managing multiple communication hardware devices.
Solution Approach 2:
The routing system is designed to be dynamic, allowing the hypervisor to adaptively select communication channels based on real-time conditions. The system can dynamically route messages through different hardware devices based on message characteristics, current channel availability, load balancing requirements, and security policies. This dynamic approach optimizes system performance and reliability while managing the complexity of multiple communication devices.
Data Source
AI summary
A method is provided comprising: retrieving a message that is designated for transmission via a first one of a plurality of communications hardware devices, the message being retrieved from a virtual device queue that is associated with the first communications hardware device, the message being generated by a first virtual machine, and the message being designated for transmission to a second virtual machine; selecting a second one of the plurality of communications hardware devices based on a characteristic of the message; and storing the message in a socket queue that is associated with the second communications hardware device, wherein storing the message in the socket queue that is associated with the second communications hardware device causes the message to be transmitted to the second virtual machine via the second communications hardware device rather than the first communications hardware device.