Secure enclave-based guest firewall

Patent metadata

Field	Value
Publication number	US-11178105-B2
Application number	US-201916442579-A
Country	US
Kind code	B2
Filing date	Jun 17, 2019
Priority date	Apr 26, 2019
Publication date	Nov 16, 2021
Grant date	Nov 16, 2021

Abstract

Techniques for implementing a secure enclave-based guest firewall are provided. In one set of embodiments, a host system can load a policy enforcer for a firewall into a secure enclave of a virtual machine (VM) running on the host system, where the secure enclave corresponds to a region of memory in the VM's guest memory address space that is inaccessible by processes running in other regions of the guest memory address space (including privileged processes that are part of the VM's guest operating system (OS) kernel). The policy enforcer can then, while running within the secure enclave: (1) obtain one or more security policies from a policy manager for the firewall, (2) determine that an event has occurred pertaining to a new or existing network connection between the VM and another machine, and (3) apply the one or more security policies to the network connection.

First claim

What is claimed is:

1. A method for implementing a secure enclave-based guest firewall, the method comprising:
loading, by a host system, a policy enforcer for a firewall into a secure enclave of a virtual machine (VM) running on the host system, the secure enclave corresponding to a region of memory in a guest memory address space of the VM that is inaccessible by processes running in other regions of the guest memory address space, the processes including privileged processes that are part of a guest operating system (OS) kernel of the VM;
performing, by a policy manager for the firewall, a remote attestation of the policy enforcer to verify that the policy enforcer is loaded into the secure enclave and that the secure enclave is genuine;
obtaining, by the policy enforcer while running within the secure enclave, one or more security policies from the policy manager for the firewall;
determining, by the policy enforcer while running within the secure enclave, that an event has occurred pertaining to a new or existing network connection between the VM and another machine; and
in response to the determining, applying, by the policy enforcer while running within the secure enclave, the one or more security policies to the new or existing network connection.

2. The method of claim 1 wherein the secure enclave is created in the VM using a hypervisor-based enclave technology.

3. The method of claim 1 wherein obtaining the one or more security policies from the policy manager comprises:
transmitting, to the policy manager over a secured communication channel, an IP (Internet Protocol) address of the VM; and
receiving, from the policy manager over the secured communication channel, one or more IP address-based security policies associated with the IP address of the VM.

4. The method of claim 1 wherein obtaining the one or more security policies from the policy manager comprises, each time a user logs into the VM:
determining a security identifier (ID) associated with the user, the security ID being based on a user name and a group name for the user defined in a directory service;
transmitting, to the policy manager over a secured communication channel, the security ID; and
receiving, from the policy manager over the secured communication channel, one or more ID-based policies associated with the security ID.

5. The method of claim 4 wherein applying the one or more security policies comprises:
determining another security ID for a user associated with the new or existing network connection; and
finding, from among the one or more ID-based policies received from the policy manager, at least one ID-based policy pertaining to said another security ID; and
applying the at least one ID-based policy.

6. The method of claim 1 wherein the one or more security policies are stored within the secure enclave.

7. The method of claim 1 wherein determining that an event has occurred pertaining to a new or existing network connection between the VM and another machine comprises:
trapping, by the policy enforcer, the event via a synchronous event trapping mechanism supported by the secure enclave.

8. A non-transitory computer readable storage medium having stored thereon program code executable by a host system for implementing a secure enclave-based guest firewall, the method comprising:
loading a policy enforcer for a firewall into a secure enclave of a virtual machine (VM) running on the host system, the secure enclave corresponding to a region of memory in a guest memory address space of the VM that is inaccessible by processes running in other regions of the guest memory address space, the processes including privileged processes that are part of a guest operating system (OS) kernel of the VM;
performing, by a policy manager for the firewall, a remote attestation of the policy enforcer to verify that the policy enforcer is loaded into the secure enclave and that the secure enclave is genuine;
obtaining, by the policy enforcer while running within the secure enclave, one or more security policies from the policy manager for the firewall;
determining, by the policy enforcer while running within the secure enclave, that an event has occurred pertaining to a new or existing network connection between the VM and another machine; and
in response to the determining, applying, by the policy enforcer while running within the secure enclave, the one or more security policies to the new or existing network connection.

9. The non-transitory computer readable storage medium of claim 8 wherein the secure enclave is created in the VM using a hypervisor-based enclave technology.

10. The non-transitory computer readable storage medium of claim 8 wherein obtaining the one or more security policies from the policy manager comprises:
transmitting, to the policy manager over a secured communication channel, an IP (Internet Protocol) address of the VM; and
receiving, from the policy manager over the secured communication channel, one or more IP address-based security policies associated with the IP address of the VM.

11. The non-transitory computer readable storage medium of claim 8 wherein obtaining the one or more security policies from the policy manager comprises, each time a user logs into the VM:
determining a security identifier (ID) associated with the user, the security ID being based on a user name and a group name for the user defined in a directory service;
transmitting, to the policy manager over a secured communication channel, the security ID; and
receiving, from the policy manager over the secured communication channel, one or more ID-based policies associated with the security ID.

12. The non-transitory computer readable storage medium of claim 11 wherein applying the one or more security policies comprises:
determining another security ID for a user associated with the new or existing network connection; and
finding, from among the one or more ID-based policies received from the policy manager, at least one ID-based policy pertaining to said another security ID; and
applying the at least one ID-based policy.

13. The non-transitory computer readable storage medium of claim 8 wherein the one or more security policies are stored within the secure enclave.

14. The non-transitory computer readable storage medium of claim 8 wherein determining that an event has occurred pertaining to the new or existing network connection between the VM and another machine comprises:
trapping, by the policy enforcer, the event via a synchronous event trapping mechanism supported by the secure enclave.

15. A host system comprising:
a processor; and
a non-transitory computer readable medium having stored thereon program code for implementing a secure enclave-based guest firewall for a virtual machine (VM) running on the host system, the program code causing the host system to:
load a policy enforcer for a firewall into a secure enclave of the VM, the secure enclave corresponding to a region of memory in a guest memory address space of the VM that is inaccessible by processes running in other regions of the guest memory address space, the processes including privileged processes that are part of a guest operating system (OS) kernel of the VM;
perform, by a policy manager for the firewall, a remote attestation of the policy enforcer to verify that the policy enforcer is loaded into the secure enclave and that the secure enclave is genuine;

obtain, via the policy enforcer while running within the secure enclave, one or more security policies from the policy manager for the firewall;
determine, via the policy en

Assignees

• Vmware Inc

Inventors

• Vijayvargiya Shirish
• Kataria Alok Nemchand
• Shah Deep

Classifications

• H04L63/0218 Primary

  Distributed architectures, e.g. distributed firewalls · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/0263

  Rule management · CPC title