Securely virtualizating network services

Patent metadata

Field	Value
Publication number	US-9325666-B2
Application number	US-201414578788-A
Country	US
Kind code	B2
Filing date	Dec 22, 2014
Priority date	Oct 30, 2007
Publication date	Apr 26, 2016
Grant date	Apr 26, 2016

Abstract

Services in a network device are added through providing virtual environments. Virtualization allows services based on other platforms or architectures to be run with minimum modification and in a secure manner. Connecting services to the host through a stateful firewall allows dynamic integration, and passes only traffic of interest to the service. Virtualization allows services written for different instruction architectures to be supported. Multiple virtualized environments each supporting a service may be run.

First claim

What is claimed is:

1. A method of adding a service to a host device, comprising:
providing a virtual environment to support a service that is not native to the host device;
executing the service in the virtual environment; and
providing isolation between the service and the host device through an isolation component that is separate from the virtual environment, wherein a failure of the service does not cause a failure of another service connected to the host device.

2. The method of claim 1 , wherein providing isolation between service and the host device comprises providing the isolation between the service and the host device by a stateful firewall.

3. The method of claim 1 , further comprising executing multiple services in the virtual environment.

4. The method of claim 1 , further comprising executing multiple services are in the virtual environment, wherein one of the multiple services is native to the host device.

5. The method of claim 1 , wherein the virtual environment provides a different instruction set architecture than the host device.

6. The method of claim 1 , wherein the service and a native service are cascaded.

7. The method of claim 1 , further comprising:
providing an intrusion detection service that receives all data prior to the data being forwarded to another service.

8. A computing device, comprising:
one or more processors; and
a memory having instructions stored thereon, which when executed by the one or more processors, cause the computing device to:
provide a virtual environment to support a service that is not native to the host device;
execute the service in the virtual environment; and
provide isolation between the service and the host device through an isolation component that is separate from the virtual environment, wherein a failure of the service does not cause a failure of another service connected to the host device.

9. The computing device of claim 8 , wherein the isolation between the service and the host device is provided by a stateful firewall.

10. The computing device of claim 8 , wherein multiple services are executed in the virtual environment.

11. The computing device of claim 8 , wherein multiple services are executed in the virtual environment, and wherein one of the multiple services is native to the host device.

12. The computing device of claim 8 , wherein the virtual environment provides a different instruction set architecture than the host device.

13. The computing device of claim 8 , wherein the service and a native service are cascaded.

14. The computing device of claim 8 , further comprising instructions, which when executed by the one or more processors, cause the computing device to:
provide an intrusion detection service that receives all data prior to the data being forwarded to another service.

15. A non-transitory machine-readable storage medium, including instructions that when executed by a data processing apparatus, cause the data processing apparatus to:
provide a virtual environment to support a service that is not native to the host device;
execute the service in the virtual environment; and
provide isolation between the service and the host device through an isolation component that is separate from the virtual environment, wherein a failure of the service does not cause a failure of another service connected to the host device.

16. The non-transitory machine-readable storage medium of claim 15 , wherein the isolation between the service and the host device is provided by a stateful firewall.

17. The non-transitory machine-readable storage medium of claim 15 , wherein multiple services are executed in the virtual environment.

18. The non-transitory machine-readable storage medium of claim 15 , wherein multiple services are executed in the virtual environment, and wherein one of the multiple services are native to the host device.

19. The non-transitory machine-readable storage medium of claim 15 , wherein the virtual environment provides a different instruction set architecture than the host device.

20. The non-transitory machine-readable storage medium of claim 15 , wherein the service and a native service are cascaded.

21. The non-transitory machine-readable storage medium of claim 15 , wherein the instructions are further to cause the data processing apparatus to:
provide an intrusion detection service that receives all data prior to the data being forwarded to another service.

Assignees

• Aruba Networks Inc

Inventors

• Taylor John
• Chou Randy
• Iyer Pradeep
• Logan Dave

Classifications

• H04Q2213/13095

  PIN / Access code, authentication · CPC title

• H04Q2213/13106

  Microprocessor, CPU · CPC title

• H04L67/16

  Electricity · mapped topic

• H04Q2213/13399

  Virtual channel/circuits · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title