Virtual Machine Snapshot Security via Guest OS Locking

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing virtual machine snapshot systems do not adequately secure sensitive information, as users accessing snapshots can potentially access network resources they should not, due to embedded security protocols being left intact during snapshot creation and restoration.

Innovation Solution

A method that forces the guest operating system of a virtual machine into a locked state before creating a snapshot, requiring credentials for access upon restoration, using executable scripts or network packets to lock the OS and ensure secure snapshot creation and restoration.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If snapshots are encrypted to secure sensitive information, then security is improved, but the time required to create and restore snapshots increases significantly

Engineering Contradiction:

ImprovesecurityVSAvoidsnapshot creation and restoration time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary locking of the guest operating system before creating the snapshot. By forcing the OS into a locked state beforehand, sensitive information is protected without requiring time-consuming encryption of the entire snapshot. The locking action is completed in advance, ensuring security while maintaining fast snapshot operations.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If decryption keys are managed and transmitted securely between users, then security is improved, but system complexity increases

Engineering Contradiction:

ImprovesecurityVSAvoidkey management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The invention extracts and removes the need for decryption key management entirely. Instead of encrypting snapshots and managing keys, the system locks the guest OS before snapshot creation, making decryption keys unnecessary. This eliminates the complex key management infrastructure while maintaining security through the locked state of the OS.

Inventive Principle:

Principle #2Taking out (Extraction)

3Ease of operation

If users are granted access to snapshots, then ease of operation is improved, but security deteriorates as users can access network resources they should not

Engineering Contradiction:

Improvesnapshot accessibilityVSAvoidunauthorized network access

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary locking of the guest operating system before snapshot creation. This ensures that when users restore and access snapshots, the OS remains in a locked state, preventing unauthorized access to network resources while still allowing users to operate with the snapshot. The locking action is completed in advance, maintaining both accessibility and security.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS9317315B2Method for generating secure snapshots

Publication Date: 2016.04.19 VMWARE INC

AI summary

In a technique for creating a secure snapshot of a virtual machine, a guest operating system of the virtual machine is caused to enter a locked state prior to the snapshot of the virtual machine being created. When the snapshot is subsequently used to restore the virtual machine, the guest operating system of the virtual machine is restored in a locked state and credentials are required to access the guest operating system.