VM Migration with Attached Security Policies for Zero-Trust Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual machine migration and cloning methods lack security visibility, making it challenging to maintain 'zero trust security' during VM migrations, especially when security policies are unknown or management planes are non-functional.
Innovation Solution
A management node maintains a VM object with attached security policies, enabling secure migration or cloning by identifying compliant host systems and applying compatible security profiles, ensuring continuous security visibility even in non-functional management planes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If VM migration or cloning is performed without security policy verification, then migration speed and productivity are improved, but security reliability deteriorates
Solution Approach 1:
The patent applies preliminary action by maintaining security policies in VM objects before migration occurs. The security policy is attached to the VM object in advance, allowing the destination host to verify compliance without waiting for post-migration security configuration. This pre-prepared security information enables fast migration while maintaining security reliability.
Solution Approach 2:
The patent uses the VM object as an intermediary that carries security policy information between source and destination hosts. The VM object acts as a mediator that transports the security policy attached to it, enabling the destination host to verify security compliance without requiring continuous connection to the central management plane during migration.
2Reliability
If security policy verification is performed during VM migration, then security reliability is improved, but migration complexity increases
Solution Approach 1:
The patent applies self-service by enabling the destination host to autonomously verify security policy compliance using the security policy embedded in the VM object. The destination host independently determines whether it complies with the security policy without requiring complex coordination with the source host or central management plane, simplifying the migration process while maintaining security visibility.
Solution Approach 2:
The security policy is preliminarily embedded in the VM object before migration, so the destination host has immediate access to security requirements. This pre-configured security information eliminates the need for complex real-time security negotiations during migration, reducing migration complexity while maintaining security reliability.
3Reliability
If security profiles are applied after VM migration, then security compliance is improved, but the time window for security vulnerabilities increases
Solution Approach 1:
The patent applies preliminary action by embedding the security policy in the VM object before migration. The destination host uses this pre-configured security policy to immediately verify compliance and apply appropriate security profiles during the migration process itself, rather than waiting until after migration completes. This eliminates the security exposure window while ensuring compliance.
Solution Approach 2:
The patent implements feedback by having the destination host continuously verify security policy compliance during migration using the security policy in the VM object. This real-time feedback mechanism ensures that security profiles are applied immediately when compliance is confirmed, rather than delaying security enforcement until after migration completes.
Data Source
AI summary
In an example, a method may include maintaining a virtual machine (VM) object storing a security policy of a VM running on a first host computing system. Further, the method may include attaching the VM object to the VM. In response to detecting a trigger event, the method may include identifying a second host computing system that is in compliance with the security policy in the VM object. Furthermore, the method may include executing a management operation to migrate or clone the VM along with the attached VM object from the first host computing system to the second host computing system.