VM Security Domain for Malware Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualization technologies, such as VMware, provide limited support for hardware-level virtualization and do not adequately ensure the security of virtual machines (VMs) by allowing potentially malicious activities to go undetected, as trusted boot mechanisms require loading special modules that take time to detect threats, and users cannot be assured that host or guest systems are not compromised.
Innovation Solution
Implementing a security domain within Virtual Machines (VMs) as a bounded area for protected objects, using secure rules to ensure that only trusted software and hardware units can access these objects, with authentication required for connections and certain areas made read-only, allowing for secure communication and protection against malware, without requiring hardware virtualization support.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If trusted boot mechanisms are used to track security in Virtual Environment, then security monitoring capability is improved, but system startup time increases due to loading special modules
Solution Approach 1:
The security domain is created and initialized during the VM startup process before the guest OS loads, pre-establishing security boundaries and trusted execution environments. This preliminary setup allows security monitoring to be active from the beginning without requiring additional module loading during runtime, thus avoiding startup time delays while maintaining continuous security coverage.
2Adaptability or versatility
If multiple VMs are created on a host operating system with resource isolation, then virtualization capability is improved, but hardware acceleration support is limited
Solution Approach 1:
The invention segments the hardware resources into distinct domains that can be assigned to specific VMs. By creating separate security domains with dedicated hardware access rights, the system enables hardware acceleration for individual VMs without compromising the isolation and virtualization capabilities of other VMs running on the same host.
3Productivity
If conventional virtualization solutions are used, then VM creation and execution is improved, but security verification is insufficient
Solution Approach 1:
The security domain implements continuous verification mechanisms that monitor and validate the integrity of objects within the VM environment. This feedback loop constantly checks security conditions, object authenticity, and access rights, providing real-time security verification without interfering with the productivity of VM creation and execution operations.
Data Source
AI summary
A system, method and computer program product for an isolated security domain which is a bounded area of the VM for protected objects. The objects include executable code and/or data, hardware units (e.g., ports) or a combination thereof. The secure units in this area are accessible using secure rules used to ensure that objects are not malware. Authentication for connections to security domain is required and certain areas of the domain are made to be read only.