Virtual Machine Security Clustering via Controller Segregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, the co-location of virtual machines with different security levels poses a security risk, as lower security systems can be exploited to access highly secured systems, and existing security systems lack efficient mechanisms to dynamically manage and adjust to changes in security levels.
Innovation Solution
A security controller is implemented to manage virtualization environments by monitoring and comparing the security data of candidate virtual machines with existing machines, recommending exclusion or reassignment based on predefined thresholds and policy similarities, ensuring that virtual machines with compatible security levels are grouped together.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If virtual machines with different security levels are co-located in the same virtualization environment, then resource utilization is improved, but security risk increases
Solution Approach 1:
The patent segments virtual machines into different security clusters based on their security levels and sensitivity data. The virtualization environment is divided into multiple isolated clusters, each with a designated security level. Virtual machines are assigned to clusters matching their security requirements, preventing lower-security VMs from compromising higher-security systems while maintaining efficient resource utilization across segmented environments.
2Reliability
If security monitoring and comparison mechanisms are implemented, then security level compatibility is improved, but system complexity increases
Solution Approach 1:
The patent implements a self-service security monitoring system where virtual machines automatically provide their security data and sensitivity levels to the virtualization environment manager. The manager autonomously compares security levels, determines compatibility, and assigns VMs to appropriate clusters without requiring manual intervention. This automated approach maintains high security reliability while minimizing the operational complexity burden on administrators.
3Reliability
If security data collection and comparison is performed for each candidate virtual machine, then security assurance is improved, but processing overhead increases
Solution Approach 1:
The patent performs preliminary security data collection and analysis during the virtual machine deployment phase, before the VM becomes operational. The virtualization environment manager evaluates security compatibility in advance and makes deployment decisions based on pre-computed security assessments. This preliminary action ensures high security assurance while minimizing ongoing processing overhead, as the intensive comparison work is completed before deployment rather than continuously.
Data Source
AI summary
A method of operating a virtual computing system includes receiving at a security controller security data corresponding to a candidate virtual machine that is proposed to be included in a virtualization environment managed by a virtualization environment manager, comparing the security data of the candidate virtual machine to security data of other virtual machines in the virtualization environment, and in response to the comparison, recommending that the virtualization environment manager exclude the candidate virtual machine from the virtualization environment. Related systems and computer program products are disclosed.