Distributed identity-based firewalls

Patent metadata

Field	Value
Publication number	US-10798058-B2
Application number	US-201816041698-A
Country	US
Kind code	B2
Filing date	Jul 20, 2018
Priority date	Oct 1, 2013
Publication date	Oct 6, 2020
Grant date	Oct 6, 2020

Abstract

Systems and techniques are described for monitoring network communications using a distributed firewall. One of the techniques includes receiving, at a driver executing in a guest operating system of a virtual machine, a request to open a network connection from a process associated with a user, wherein the driver performs operations comprising: obtaining identity information for the user; providing the identity information and data identifying the network connection to an identity module external to the driver; and receiving, by a distributed firewall, data associating the identity information with the data identifying the network connection from the identity module, wherein the distributed firewall performs operations comprising: receiving an outgoing packet from the virtual machine; determining that the identity information corresponds to the outgoing packet; and evaluating one or more routing rules based at least in part on the identity information.

First claim

What is claimed is:

1. For a virtual machine (VM) executing on a host computer, a method for providing a firewall service on the host computer, the method comprising:
on the host computer, outside of the VM,
after a process of the VM requests a network connection to send a packet flow, receiving, from a guest driver module of the VM, identity information comprising a set of header values of the packet flow and an identifier associated with the process and related to the requested network connection;
in response to the received identity information, generating and storing a record associating the set of header values with the identifier;
for a packet of the flow sent by the VM, identifying the record as matching the sent packet by using a set of header values of the sent packet;
using the identifier stored in the record to identify a firewall rule that is applicable to the sent packet from a plurality of firewall rules; and
performing a firewall operation on the sent packet based on the identified firewall rule.

2. The method of claim 1 , wherein performing the firewall operation comprises forwarding the sent packet when the identified firewall rule specifies that the packet should be allowed to pass through.

3. The method of claim 2 , wherein forwarding the sent packet comprises forwarding the packet to a virtual switch executing on the host computer for distribution to a destination of the packet.

4. The method of claim 1 , wherein performing the firewall operation comprises dropping the sent packet when the identified firewall rule specifies that the packet should be blocked.

5. The method of claim 1 , wherein performing the firewall operation comprises redirecting the sent packet to a different destination according to the identified firewall rule.

6. The method of claim 1 , wherein the identifier is a security identifier (SID) of a user associated with the process.

7. The method of claim 1 , wherein the identifier identifies a user logged onto the VM.

8. The method of claim 7 , wherein the user identifier comprises a username or a group identifier that identifies a user group to which the user belongs.

9. The method of claim 1 , wherein the set of header values comprises an Internet Protocol (IP) address and one or more port numbers assigned to the network connection.

10. The method of claim 1 , wherein identifying the record as matching the sent packet comprises matching the set of header values of the sent packet with the set of header values stored in the record.

11. A non-transitory machine readable medium storing a program for execution by at least one processing unit, the program for providing a firewall service for a virtual machine (VM) executing on a host computer, the program comprising sets of instructions for:
on the host computer, outside of the VM,
after a process of the VM requests a network connection to send a packet flow, receiving, from a guest driver module of the VM, identity information comprising a set of header values of the packet flow and an identifier associated with the process and related to the requested network connection;
in response to the received identity information, generating and storing a record associating the set of header values with the identifier;
for a packet of the flow sent by the VM, identifying the record as matching the sent packet by using a set of header values of the sent packet;
using the identifier stored in the record to identify a firewall rule that is applicable to the sent packet from a plurality of firewall rules; and
performing a firewall operation on the sent packet based on the identified firewall rule.

12. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for performing the firewall operation comprises a set of instructions for forwarding the sent packet when the identified firewall rule specifies that the packet should be allowed to pass through.

13. The non-transitory machine readable medium of claim 12 , wherein the set of instructions for forwarding the sent packet comprises a set of instructions for forwarding the packet to a virtual switch executing on the host computer for distribution to a destination of the packet.

14. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for performing the firewall operation comprises a set of instructions for dropping the sent packet when the identified firewall rule specifies that the packet should be blocked.

15. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for performing the firewall operation comprises a set of instructions for redirecting the sent packet to a different destination according to the identified firewall rule.

16. The non-transitory machine readable medium of claim 11 , wherein the identifier is a security identifier (SID) of a user associated with the process.

17. The non-transitory machine readable medium of claim 11 , wherein the identifier identifies a user logged onto the VM.

18. The non-transitory machine readable medium of claim 17 , wherein the user identifier comprises a username or a group identifier that identifies a user group to which the user belongs.

19. The non-transitory machine readable medium of claim 11 , wherein the set of header values comprises an Internet Protocol (IP) address and one or more port numbers assigned to the network connection.

20. The non-transitory machine readable medium of claim 11 , wherein the identity information is retrieved by the guest driver module using an application programming interface (API) provided by a guest operating system of the VM.

Assignees

• Nicira Inc

Inventors

• Sengupta Anirban
• Manuguri Subrahmanyam
• Christensen Mitchell T
• Feroz Azeem
• Sabin Todd

Classifications

• H04L67/63

  Routing a service request depending on the request content or context · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L63/0218 Primary

  Distributed architectures, e.g. distributed firewalls · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• H04L67/327

  Electricity · mapped topic