Framework for coordination between endpoint security and network security services

Patent metadata

Field	Value
Publication number	US-11196773-B2
Application number	US-201916684400-A
Country	US
Kind code	B2
Filing date	Nov 14, 2019
Priority date	Apr 19, 2013
Publication date	Dec 7, 2021
Grant date	Dec 7, 2021

Abstract

Systems and techniques are described for virtual machine security. A described technique includes operating one or more virtual machines each in accordance with a respective security container, wherein the respective security container is associated with a respective rule that specifies transfer of the virtual machine from the respective security container to a quarantine container based on one or more criteria. One or more security services are operated on the one or more virtual machines to identify one or more security threats associated with one or more of the virtual machines. One or more tags generated by the endpoint security services are obtained, where each tag is for a virtual machine that is associated with one of the identified security threats. And one of the virtual machines is identified as requiring transfer to the quarantine container based on, at least, one or more of the obtained tags and the one or more criteria.

First claim

What is claimed is:

1. A method for applying security policies to virtual machines, the method comprising:
to detect a security threat, performing a security service on a virtual machine (VM) that operates based on a first set of network connectivity settings;
after detecting the security threat, associating a tag with the VM;
based on the tag, assigning to the VM a second set of network connectivity settings that is more restricted than the first set of network connectivity settings; and
after resolution of the security threat, removing the association of the tag with the VM and assigning the first set of network connectivity settings to the VM.

2. The method of claim 1 , wherein performing the security service on the VM comprises scanning the VM for viruses.

3. The method of claim 2 further comprising assigning the VM to a quarantine group until the virus has been removed.

4. The method of claim 3 , wherein
the VM is a first VM,
any VM assigned to the quarantine group has reduced network connectivity, and
the first VM is removed from the quarantine group once the virus has been removed.

5. The method of claim 1 , wherein the second set of network connectivity settings comprise a network firewall setting that allows no network access to the VM.

6. The method of claim 1 further comprising
detecting a login event on the VM; and
determining, based on the detected login event, that the security service has to be performed on the VM.

7. The method of claim 6 , wherein detecting the login event comprises determining that the login event is associated with a user membership group, and the determination to perform the security service is based on the login event being associated with the user membership group.

8. A method for applying security policies to virtual machines (VMs), the method comprising:
receiving through a user interface data to create a first security container to associate with the VMs;
defining the first security container and specifying a first set of network connectivity settings for the VMs associated with the first security container;
associating the first security container with a security service that is to be performed on any VM associated with the first security container to detect a security condition on the VM; and
defining a second security container to associate with any VM with the detected security condition, and specifying a reduced, second set of network connectivity settings for any VM associated with the second security container.

9. The method of claim 8 further comprising:
assigning a first VM to the first security container;
based on the assignment, performing the security service on the first VM to determine whether the security condition exists on the first VM.

10. The method of claim 8 , wherein associating a VM with the second security container removes the VM's association with the first security container.

11. The method of claim 8 , wherein a first VM is assigned to the first security container upon a login event on the first VM.

12. The method of claim 11 , wherein the login event is associated with a user membership group.

13. The method of claim 8 further comprising specifying a rule that requires a VM to be removed from the second security container and added to the first security container once a security condition on the VM has been resolved.

14. The method of claim 8 , wherein the security service scans a first security container VM for viruses.

15. The method of claim 8 , wherein the second set of network connectivity settings comprise a network firewall setting that restricts network connectivity of any VM associated with the second security container.

16. The method of claim 8 further comprising:
providing a security manager to specify security containers, to associate VMs with tags, and to specify tag-based rules for moving VMs between security containers based on the VMs association with tags; and
providing network security enforcers to enforce network security settings to VMs based on the VMs associated security containers.

17. A non-transitory machine readable medium storing a program for applying security policies to virtual machines, the program for execution by at least one processing unit, the program comprising sets of instructions for:
to detect a security threat, performing a security service on a virtual machine (VM) that operates based on a first set of network connectivity settings;
after detecting the security threat, associating a tag with the VM;
based on the tag, assigning to the VM a second set of network connectivity settings that is more restricted than the first set of network connectivity settings; and
after resolution of the security threat, removing the association of the tag with the VM and assigning the first set of network connectivity settings to the VM.

18. The non-transitory machine readable medium of claim 17 , wherein the program further comprises a set of instructions for assigning the VM to a quarantine group until the virus has been removed.

19. The non-transitory machine readable medium of claim 17 , wherein the second set of network connectivity settings comprise a network firewall setting that allows no network access to the VM.

20. The non-transitory machine readable medium of claim 17 , wherein the program further comprises sets of instructions for:
detecting a login event on the VM; and
determining, based on the detected login event, that the security service has to be performed on the VM.

21. The non-transitory machine readable medium of claim 17 , wherein the set of instructions for detecting the login event comprises a set of instructions for determining that the login event is associated with a user membership group, and the determination to perform the security service is based on the login event being associated with the user membership group.

Assignees

• Nicira Inc

Inventors

• Vaidya Sachin Mohan
• Feroz Azeem
• Sengupta Anirban
• Wiese James Christopher

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title