Distributed identity-based firewalls

Patent metadata

Field	Value
Publication number	US-10033693-B2
Application number	US-201314043714-A
Country	US
Kind code	B2
Filing date	Oct 1, 2013
Priority date	Oct 1, 2013
Publication date	Jul 24, 2018
Grant date	Jul 24, 2018

Abstract

Systems and techniques are described for monitoring network communications using a distributed firewall. One of the techniques includes receiving, at a driver executing in a guest operating system of a virtual machine, a request to open a network connection from a process associated with a user, wherein the driver performs operations comprising: obtaining identity information for the user; providing the identity information and data identifying the network connection to an identity module external to the driver; and receiving, by a distributed firewall, data associating the identity information with the data identifying the network connection from the identity module, wherein the distributed firewall performs operations comprising: receiving an outgoing packet from the virtual machine; determining that the identity information corresponds to the outgoing packet; and evaluating one or more routing rules based at least in part on the identity information.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, at a driver executing in a guest operating system of a virtual machine (VM) operating on a physical host machine, a request to open a network connection from a process associated with a user, wherein the driver performs operations comprising:
obtaining identity information for the user from the guest operating system of the VM, wherein the driver prevents transmission of any packets for the network connection until the identity information is obtained; and
providing the identity information and data identifying the network connection to an identity module external to the driver and operating within virtualization software of the physical host machine; and

at a firewall for the VM that operates within the virtualization software of the physical host machine:
receiving, from the identity module, data associating source information for an outgoing packet from the VM with an identifier associated with one or more firewall rules, the identifier based on the identity information provided to the identity module by the driver;
determining that the outgoing packet matches the associating data received from the identity module, based on a comparison between source information for the outgoing packet and source information in the associating data received from the identity module; and
based at least in part on the identifier in the associating data received from the identity module, evaluating one or more firewall rules to identify a firewall rule that is applicable to the outgoing packet, said evaluating comprising comparing a set of header values of the outgoing packet with a set of packet-matching values of an evaluated firewall rule.

2. The method of claim 1 further comprising forwarding the outgoing packet when approved according to the firewall rules.

3. The method of claim 1 further comprising blocking the packet when denied according to the firewall rules.

4. The method of claim 1 , wherein the firewall is a distributed firewall configured to monitor the VM, wherein additional distributed firewalls operate within the virtualization software, each additional distributed firewall configured to monitor a different additional VM operating on the physical host machine.

5. The method of claim 1 , wherein the identity information is a security identifier (SID) for the user.

6. The method of claim 1 , further comprising:
at the identity module operating on the physical host machine:
receiving the identity information and the data identifying the network connection;
generating the data associating source information for outgoing packets from the VM with the identifier associated with one or more firewall rules; and
providing the generated data to the firewall.

7. The method of claim 1 , wherein the data identifying the network connection comprises an Internet Protocol (IP) address and one or more port numbers assigned to the network connection.

8. The method of claim 2 , wherein forwarding the outgoing packet further comprises forwarding the packet to a virtual switch executing within the virtualization software for distribution to a destination of the packet.

9. The method of claim 1 further comprising storing, at the firewall, the received data associating source information with the identifier with an indication of whether the association between the source information and the identifier is temporary or permanent.

10. The method of claim 1 , wherein the driver is further configured to deny and modify outgoing packets before the outgoing packets are transmitted to the firewall.

11. The method of claim 1 , wherein the user is a user currently logged into the VM.

12. The method of claim 1 further comprising redirecting the outgoing packet to a different destination according to the firewall rules.

13. A computer comprising:
one or more processing units; and
one or more non-transitory machine-readable storage devices storing:
a first set of instructions, for a driver executing in a guest operating system of a virtual machine (VM) operating on the computer, that when executed by the one or more processing units causes the one or more processing units to perform operations comprising:
receiving, at the driver, a request to open a network connection from a process associated with a user:
obtaining identity information for the user from the guest operating system of the VM, wherein the driver prevents transmission of any packets for the network connection until the identity information is obtained; and
providing the identity information and data identifying the network connection to an identity module external to the driver and executing within virtualization software of the computer; and

a second set of instructions, for a distributed firewall for the VM that operates within the virtualization software of the computer, that when executed by the one or more processing units causes the one or more processing units to perform operations comprising:
receiving, from the identity module, data associating source information for an outgoing packet from the VM with an identifier associated with one or more firewall rules, the identifier based on the identity information provided to the identity module by the driver;
determining that the outgoing packet matches the associating data received from the identity module, based on a comparison between source information for theoutgoing packet and the source information in the associating data received from the identity module; and
based at least in part on the identifier in the associating data received from the identity module, evaluating one or more firewall rules to identify a firewall rule that is applicable to the outgoing packet, said evaluating comprising comparing a set of header values of the outgoing packet with a set of packet-matching values of an evaluated firewall rule.

14. The computer of claim 13 , wherein the second set of instructions further cause the one or more processing units to forward the outgoing packet when approved according to the firewall rules.

15. The computer of claim 13 , wherein the second set of instructions further cause the one or more processing units to block the packet when denied according to the firewall rules.

16. The computer of claim 13 , wherein the distributed firewall is configured to monitor the VM, wherein additional distributed firewalls operate within the virtualization software, each additional distributed firewall configured to monitor a different additional VM operating on the computer.

17. The computer of claim 13 , wherein the identity information is a security identifier (SID) for the user.

18. The computer of claim 13 , wherein the data identifying the network connection comprises an Internet Protocol (IP) address and one or more port numbers assigned to the network connection.

Assignees

• Nicira Inc

Inventors

• Sengupta Anirban
• Manuguri Subrahmanyam
• Christensen Mitchell T
• Feroz Azeem
• Sabin Todd

Classifications

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• H04L63/0218 Primary

  Distributed architectures, e.g. distributed firewalls · CPC title

• H04L67/327

  Electricity · mapped topic

• H04L67/63

  Routing a service request depending on the request content or context · CPC title