Dynamically defining network access rules

Patent metadata

Field	Value
Publication number	US-9253156-B2
Application number	US-201113157199-A
Country	US
Kind code	B2
Filing date	Jun 9, 2011
Priority date	Jun 9, 2011
Publication date	Feb 2, 2016
Grant date	Feb 2, 2016

Abstract

Systems and computer program products are provided for dynamically defining network access control rules. A placeholder for a parameter of an interface to an endpoint such as a data processing system or virtual machine may be provided in a network access control rule, instead of a static parameter. The parameter may be dynamically determined, by a firewall or a hypervisor for example, and the placeholder may be replaced with the dynamically determined parameter.

First claim

What is claimed is:

1. A system for filtering packets sent to and received from a virtual machine, comprising:
a processor;
a memory;
a bus operably coupling the processor and memory;
a network access control rule stored in the memory, the network access control rule including a placeholder for an identifier for the virtual machine, the placeholder comprising a first parameter for a network address of the virtual machine and a second parameter for a network port of the virtual machine, the placeholder having the format “first_parameter@second_parameter”; and
a hypervisor computer program including instructions stored in the memory that are executed by the processor to:
determine the network address and the network port for the virtual machine during runtime of the hypervisor computer program, the hypervisor computer program determining the network address and the network port for the virtual machine by polling the virtual machine at predetermined intervals; and
replace the placeholder with the determined network address and the determined network port during runtime of the hypervisor computer program, the “first_parameter” portion of the placeholder being replaced with the determined network address and the “second_parameter” portion of the placeholder being replaced with the determined network port.

2. The system of claim 1 , further comprising a kernel interface for detecting the network address and the network port for the virtual machine during runtime.

3. The system of claim 1 , wherein the network address and the network port for the virtual machine is one of a virtual MAC address, an IP address and a VLAN.

4. A computer program product for filtering network packets sent to and received from a virtual machine, comprising:
a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
computer readable program code configured to define a network access control rule, the network access control rule comprising a placeholder for an interface identifier for the virtual machine, the placeholder comprising a first parameter for a network address of the virtual machine and a second parameter for a network port of the virtual machine, the placeholder having the format “first_parameter@second_parameter”;
computer readable program code configured to determine the network address and the network port for the virtual machine during runtime of a hypervisor computer program, the hypervisor computer program determining the network address and the network port for the virtual machine by polling the endpoint at predetermined intervals; and
computer readable program code configured to dynamically replace the first and second parameters of the placeholder in the network access control rule with the determined network address and the determined network port of the virtual machine during runtime of the hypervisor computer program, the “first_parameter” portion of the placeholder being replaced with the determined network address and the “second_parameter” portion of the placeholder being replaced with the determined network port.

5. The computer program product of claim 4 , wherein the computer readable program code further comprises:
computer readable program code configured to determine the network address and the network port for the virtual machine when a packet targeted at the virtual machine is received.

6. The computer program product of claim 4 , wherein the network address for the virtual machine is one of a MAC address and a VLAN.

7. The computer program product of claim 4 , wherein the network address for the virtual machine is an IP address.

8. The computer program product of claim 7 , wherein the computer readable program code configured to determine the interface identifier for the virtual machine includes computer readable program code configured to monitor network traffic to detect the IP address.

9. The computer program product of claim 4 , wherein the computer readable program code is configured to automatically determine, at a point in time after the definition of the network access control rule, the interface identifier for the virtual machine, the computer readable program code further configured to automatically determine at a kernel interface the interface identifier for the virtual machine.

Assignees

• Kashyap Vivek
• IBM

Inventors

• Kashyap Vivek

Classifications

• H04L45/76

  Routing in software-defined topologies, e.g. routing between virtual machines · CPC title

• H04L29/06578

  Electricity · mapped topic

• H04L63/0263 Primary

  Rule management · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• H04L29/06612

  Electricity · mapped topic