Virtual Machine Snapshot Differential Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems face challenges in preserving the state of virtual machines for forensic investigation and efficiently resuming operations after suspension, as frequent restarts and re-instantiations can eliminate evidence of attacks and system issues, and existing methods lack efficient mechanisms for storing and restoring snapshots.
Innovation Solution
A system and method for capturing and storing snapshots of virtual machines, including base and initial snapshots, and differences between them, allowing for efficient suspension and resumption, and enabling forensic analysis by isolating virtual machines and storing only local changes, which can be used to recreate the system state at a later date.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual machines are frequently restarted and re-instantiated from known-good software images to prevent security compromises, then security reliability is improved, but forensic evidence is lost
Solution Approach 1:
The system performs preliminary actions by capturing forensic snapshots of the virtual machine state before restarting or re-instantiating from known-good images. This ensures that evidence is preserved in advance before any security remediation actions are taken, resolving the contradiction between maintaining security reliability and preserving forensic evidence.
2Reliability
If full snapshots of virtual machines are stored for forensic investigation, then evidence integrity is maintained, but storage requirements increase significantly
Solution Approach 1:
The system extracts and stores only the differential changes from the baseline state rather than storing complete snapshots. By taking out only the modified portions of the virtual machine state, the system maintains evidence integrity while dramatically reducing storage requirements compared to storing full snapshots.
Solution Approach 2:
The system applies local quality by storing differential data with different storage characteristics - only the changed portions are stored with high fidelity for evidence integrity, while the unchanged baseline state is maintained separately. This allows evidence integrity to be maintained for the critical changed data without the storage overhead of duplicating entire virtual machine states.
3Productivity
If virtual machines are suspended and resumed using existing methods, then operational continuity is achieved, but the process is inefficient and lacks forensic capability
Solution Approach 1:
The system performs preliminary actions by capturing snapshots of the virtual machine state before suspension. When resumption is needed, the pre-captured snapshots are quickly restored, eliminating the need for time-consuming full system state preservation and restoration processes, thus improving operational continuity while reducing suspend/resume time.
4Productivity
If virtual machines are suspended and terminated without state preservation, then resources are freed for other uses, but the ability to resume operations is lost
Solution Approach 1:
The system extracts and stores only the essential state information needed for resumption in a compact differential format. This allows the majority of virtual machine resources to be freed for other uses while maintaining the critical capability to resume operations by restoring the captured state differences.
Data Source
AI summary
A plurality of virtual machines are each restored to a previous state, by, for each virtual machine of the plurality, obtaining a first snapshot of an exemplary virtual machine, obtaining a set of local changes of a virtual machine, deriving a snapshot of the virtual machine based at least in part on the first snapshot and the set of local changes, and restoring the virtual machine to a previous state based on the snapshot.