Virtual host security profiles

Patent metadata

Field	Value
Publication number	US-9531674-B2
Application number	US-61616309-A
Country	US
Kind code	B2
Filing date	Nov 11, 2009
Priority date	Nov 11, 2009
Publication date	Dec 27, 2016
Grant date	Dec 27, 2016

Abstract

Architecture that creates and applies a virtual firewall profile for each network to which a multi-homed device is connected. In one implementation, the virtual profiles can be based on address ranges of the networks. This ensures seamless concurrent connectivity of the multi-homed device to multiple networks.

First claim

What is claimed is:

1. A computer-implemented security system, comprising:
a set of security profiles that provides communications security for a multi-homed device, each of the security profiles including a set of rules that constrains device connectivity according to that profile, the security profiles being associated with connections from which data packets are being received, the set of security profiles comprising a first security profile being constrained to apply to a first address range for all traffic from a first active connection, and a second security profile being constrained to apply to a second address range for all traffic from a second concurrently active connection, the first security profile being different from the second security profile such that the first security profile does not affect security of the second concurrently active connection and the second security profile does not affect security of the first active connection; and
a security component for determining if the connections are active by examining the data packets received, and responsive to determining that one or more of the connections is active automatically selecting and applying corresponding security profiles to the one or more active connections.

2. The system of claim 1 , wherein the connections are network connections.

3. The system of claim 1 , wherein the set of security profiles includes firewall profiles that configure secure access to the multi-homed device.

4. The system of claim 1 , wherein the set of security profiles includes a security profile associated with a virtual network.

5. The system of claim 1 , wherein the set of security profiles includes a security profile associated with a physical network.

6. The system of claim 1 , further comprising an administration component for creating the security profiles and downloading the security profiles to the security component of the multi-homed device.

7. The system of claim 3 , wherein each firewall profile comprises one or more firewall rules, and each firewall profile is applicable to one or more connections.

8. A computer-implemented security system, comprising:
a set of firewall profiles that provides communications security for a multi-homed device, the set of firewall profiles configuring firewall access to the multi-homed device, and being associated with connections from which data packets are being received, the set of firewall profiles comprising a first firewall profile being constrained to apply to a first address range for all traffic from a first active connection, and a second firewall profile being constrained to apply to a second address range for all traffic from a second concurrently active connection to provide seamless concurrent connectivity of the multi-homed device to the first and second active connections, the first firewall profile being different from the second firewall profile; and
a security component for determining if the connections are active by examining the data packets received, and responsive to determining that one or more of the connections is active automatically selecting and applying specific firewall profiles to the one or more active connections.

9. The system of claim 8 , wherein the set of firewall profiles includes a firewall profile associated with a virtual network.

10. The system of claim 8 , wherein the set of firewall profiles includes a firewall profile associated with a physical network.

11. The system of claim 8 , further comprising an administration component for creating the firewall profiles and downloading the firewall profiles to the security component of the multi-homed device.

12. The system of claim 8 , wherein the connections are network connections.

13. The system of claim 8 , wherein each firewall profile comprises one or more firewall rules, and each firewall profile is applicable to one or more connections.

14. A computer-implemented security method for a multi-homed device, comprising:
detecting concurrently active connections at the multi-homed device by examining data packets received from multiple connections;
selecting a security profile from a set of security profiles for each active connection, the security profiles being different from one another such that one security profile does not affect security of an active connection associated with another security profile;
applying the security profile for each active connection to provide secure communications over the active connections; and
constraining communications to the active connections based on address ranges associated with the active connections as defined in the security profile corresponding to each of the active connections.

15. The method of claim 14 , further comprising creating the security profiles and downloading the security profiles to the multi-homed device.

16. The method of claim 14 , further comprising constraining communications to a virtual network as defined in the security profile.

17. The method of claim 14 , further comprising constraining communications to a physical network as defined in the security profile.

18. The method of claim 14 , further comprising storing the security profiles, which are firewall profiles, on a host firewall for selective imposition according to active connections.

19. The method of claim 18 , wherein each firewall profile comprises one or more firewall rules, and each firewall profile is applicable to one or more connections.

Assignees

• Rangegowda Dharshan
• Goldian Jeffrey R
• Microsoft Technology Licensing Llc

Inventors

• Rangegowda Dharshan
• Goldian Jeffrey R

Classifications

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F2221/2149

  Restricted operating environment · CPC title

• H04L63/0263 Primary

  Rule management · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title