VM Security via Mandatory Access Control Labels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Process-based virtualization systems, such as KVM, lack effective security measures to isolate virtual machines from each other, making them vulnerable to attacks and data breaches, as they share the same physical hardware and have minimal security protections between guests.
Innovation Solution
Implementing a security policy using mandatory access control (MAC) and discretionary access control (DAC) through security labeling to assign unique labels to each virtual machine, enforcing isolation and access control between VMs, similar to running on separate hardware, and utilizing a virtualization library to manage and enforce these policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If process-based virtualization consolidates multiple virtual machines on the same physical hardware, then resource utilization and productivity are improved, but security isolation between virtual machines deteriorates
Solution Approach 1:
The patent applies segmentation by assigning unique security labels to each virtual machine, effectively dividing the shared physical hardware into isolated security domains. Each VM operates within its own labeled security context, preventing unauthorized access to other VMs while maintaining consolidated resource utilization on the same physical hardware.
2Ease of operation
If all virtual machines are launched as the same user with the same security class, then ease of operation and management are improved, but security isolation between virtual machines deteriorates
Solution Approach 1:
The patent implements local quality by assigning distinct security labels to each virtual machine while maintaining uniform user management. This allows each VM to have its own security context and access control policy, providing fine-grained security isolation without complicating the overall management structure. The security label acts as a local security attribute that differentiates each VM's access rights.
3Object-affected harmful factors
If mandatory access control and security labeling are implemented to isolate virtual machines, then security isolation between VMs is improved, but system complexity increases
Solution Approach 1:
The patent introduces security labels as intermediary elements that mediate access control between virtual machines. Rather than implementing complex direct access control checks between all VM pairs, the security label acts as an intermediary attribute that the kernel uses to enforce access policies. This simplifies the enforcement mechanism by providing a clear, label-based access control model.
Data Source
AI summary
In one embodiment, a mechanism to implement security in process-based virtualization is disclosed. In one embodiment, a method includes maintaining a security policy for a process-based virtualization system, initializing a virtual machine (VM) in the process-based virtualization system, assigning a security label to the VM, and enforcing the security policy on the VM based on the security label of the VM in order to isolate the VM from other VM's in the process-based virtualization system.