Systems and methods for preventing data loss over virtualized networks

Patent metadata

Field	Value
Publication number	US-9300693-B1
Application number	US-201414495637-A
Country	US
Kind code	B1
Filing date	Sep 24, 2014
Priority date	Sep 24, 2014
Publication date	Mar 29, 2016
Grant date	Mar 29, 2016

Abstract

The disclosed computer-implemented method for preventing data loss over virtualized networks may include (1) receiving, by a data loss prevention callout driver registered to a switch, a network packet from a virtual machine, (2) identifying, by the data loss prevention callout driver registered to the switch, flow context information that specifies a context associated with transmitting the network packet, (3) providing the flow context information and the network packet to a data loss prevention service, and (4) applying, by the data loss prevention service, a data loss prevention policy to the network packet based on the flow context information. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for preventing data loss over virtualized networks, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
receiving, by a data loss prevention callout driver registered to a switch, a network packet from a virtual machine;
identifying, by the data loss prevention callout driver registered to the switch, flow context information that specifies a context associated with transmitting the network packet;
providing the flow context information and the network packet to a data loss prevention service;
applying, by the data loss prevention service, a data loss prevention policy to the network packet based on the flow context information.

2. The method of claim 1 , wherein identifying, by the data loss prevention callout driver registered to the switch, the flow context information that specifies the context associated with transmitting the network packet comprises identifying at least one of the following:
an executable path of an application that is attempting to transmit the network packet;
a user identification that identifies a user logged into the virtual machine that sent the network packet;
a local internet protocol address, a local port number, a remote internet protocol address, and a remote port number that together describe a socket connection maintained by the switch.

3. The method of claim 1 , wherein providing the flow context information and the network packet to the data loss prevention service further comprises receiving, by the data loss prevention callout driver, a plurality of network packets transmitted to the switch and storing the plurality of network packets in a flow queue that is associated with the flow context information.

4. The method of claim 3 , wherein providing the flow context information and the network packet to the data loss prevention service further comprises assembling the network packets contained within the flow queue into a network stream.

5. The method of claim 1 , wherein the data loss prevention service resides within a parent partition associated with a hypervisor that manages the virtual machine.

6. The method of claim 1 , wherein the data loss prevention service prevents data loss across multiple virtual machines, each virtual machine associated with a respective child partition, the virtual machines being managed by a hypervisor.

7. The method of claim 1 , wherein the switch comprises a virtualized extensible switch within a virtual network.

8. The method of claim 7 , wherein the virtualized extensible switch executes within a kernel mode of a parent partition that includes a hypervisor that manages the virtual machine.

9. The method of claim 1 , wherein receiving, by the data loss prevention callout driver registered to the switch, the network packet from the virtual machine further comprises the switch receiving the network packet via a virtual bus.

10. The method of claim 1 , wherein applying the data loss prevention policy to the network packet further comprises:
determining that the network packet does not violate the data loss prevention policy;
forwarding the network packet to an original destination via the switch based on determining that the network packet does not violate the data loss prevention policy.

11. The method of claim 1 , further comprising delivering a user interface component to a child partition upon creation of the virtual machine at the child partition.

12. The method of claim 11 , wherein applying the data loss prevention policy further comprises at least one of:
warning, by the user interface component, a user that the user may be taking actions that violate the data loss prevention policy;
requesting, by the user interface component, verification that the user would like to continue an action.

13. The method of claim 1 , wherein applying the data loss prevention policy further comprises filtering the network packet to prevent the network packet from being forwarded by the switch.

14. The method of claim 1 , wherein receiving the network packet from the virtual machine further comprises capturing the network packet from a network connection that transmitted the network packet from the virtual machine to the switch.

15. The method of claim 1 , wherein identifying the flow context information that specifies the context associated with transmitting the network packet further comprises identifying the flow context information when the virtual machine successfully completes a socket connection.

16. The method of claim 15 , further comprising determining, by the data loss prevention callout driver based on the flow context information, that the socket connection is subject to the data loss prevention policy.

17. A system for preventing data loss over virtualized networks, the system comprising:
a reception module, stored in memory, that receives, through a data loss prevention callout driver registered to a switch, a network packet from a virtual machine;
an identification module, stored in memory, that identifies, through the data loss prevention callout driver registered to the switch, flow context information that specifies a context associated with transmitting the network packet;
a provisioning module, stored in memory, that provides the flow context information and the network packet to a data loss prevention service;
an application module, stored in memory, that applies, through the data loss prevention service, a data loss prevention policy to the network packet based on the flow context information;
at least one physical processor configured to execute the reception module, the identification module, the provisioning module, and the application module.

18. The system of claim 17 , wherein the identification module identifies, through the data loss prevention callout driver registered to the switch, the flow context information that specifies the context associated with transmitting the network packet by identifying at least one of the following:
an executable path of an application that is attempting to transmit the network packet;
a user identification that identifies a user logged into the virtual machine that sent the network packet;
a local internet protocol address, a local port number, a remote internet protocol address, and a remote port number that together describe a socket connection maintained by the switch.

19. The system of claim 17 , wherein the provisioning module provides, through the data loss prevention callout driver, the flow context information and the network packet to the data loss prevention service.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
receive, by a data loss prevention callout driver registered to a switch, a network packet from a virtual machine;
identify, by the data loss prevention callout driver registered to the switch, flow context information that specifies a context associated with transmitting the network packet;
provide the flow context information and the network packet to a data loss prevention service;
apply, by the data loss prevention service, a data loss prevention policy to the network packet based on the flow context information.

Assignees

• Symantec Corp

Inventors

• Manmohan Sarin Sumit
• Daramwar Ravindra
• Sharma Jogesh

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title