Management of addresses in virtual machines

Patent metadata

Field	Value
Publication number	US-9634948-B2
Application number	US-201314074178-A
Country	US
Kind code	B2
Filing date	Nov 7, 2013
Priority date	Nov 7, 2013
Publication date	Apr 25, 2017
Grant date	Apr 25, 2017

Abstract

Methods for managing an address on a switching device, managing an address on a network switch, and screening addresses in a cloud computing environment are provided. One embodiment is directed towards a computer-implemented method for managing an address on a switching device that is communicatively coupled to a plurality of virtual machines. The method includes accessing an address pool that includes an assigned address for each virtual machine from the plurality of virtual machines. The method includes determining, on the switching device, a used address for the virtual machine from the plurality of virtual machines. The method includes determining whether the used address is matching the assigned address for each virtual machine. The method also includes routing traffic from the virtual machine to a hypervisor in response to the used address matching the assigned address.

First claim

What is claimed is:

1. A computing system for screening addresses in a cloud computing environment, comprising:
a plurality of virtual machines, wherein each virtual machine includes a virtual network interface card (vNIC) that maps to a network hardware adapter;
an address pool that includes a plurality of assigned addresses, wherein an address of the plurality of assigned addresses is assigned for each virtual machine of the plurality of virtual machines, wherein the assigned address is given to a first virtual machine of the plurality of virtual machines for configuring purposes;
a memory;
a computing processor communicatively coupled to the memory; and
a virtual switch (vSwitch) that connects one or more virtual machines of the plurality of virtual machines to a hypervisor and wherein the vSwitch is configured to provide access to a physical function of the network hardware adapter to the plurality of virtual machines operating on one or more computing processors and communicatively coupled to the plurality of virtual machines, wherein the vSwitch is configured to:
receive vNIC configuration data from the address pool, wherein the vNIC configuration data indicates an assigned address of each vNIC for a second virtual machine wherein the assigned address in the address pool is created by a cloud controller;
receive an enforcement rule for the vSwitch, wherein the enforcement rule allows the vSwitch to block a third virtual machine with a first vNIC that has a used address matching an assigned address of a second vNIC for a fourth virtual machine, wherein the used address is a packet address for a source of a network packet from a fifth virtual machine, and wherein the used address is a Media Access Control (MAC) address;
receive the network packet from the third virtual machine through the first vNIC, the network packet indicates configuration settings of the third virtual machine via metadata;
determine that the enforcement rule applies to the network packet; and
enforce the enforcement rule by blocking the network packet from the third virtual machine to an intended destination the enforcement rule applies to the network packet; and
notify a system administrator, selected from the plurality of virtual machines, that the traffic from the first virtual machine is blocked.

2. The computing system of claim 1 , wherein the vSwitch is further configured to:
rout traffic from the first virtual machine to the intended destination if the enforcement rule does not apply to the network packet.

3. The computing system of claim 1 , wherein the vSwitch operates in layer 2.

4. The computing system of claim 1 , wherein the address pool includes an available address that is an address available to a sixth virtual machine, wherein the address available to the sixth virtual machine is different than the assigned address for each of the virtual machines of the plurality of virtual machines.

5. A system for managing an address on a virtual switch (vSwitch), comprising:
a memory;
a plurality of virtual machines, wherein each virtual machine includes a virtual network interface card (vNIC) that maps to a network hardware adapter;
an address pool that includes a plurality of assigned addresses, wherein an address of the plurality of assigned addresses is assigned for each virtual machine of the plurality of virtual machines;
a computing processor communicatively coupled to the memory; and
a virtual switch that connects one or more virtual machines to a hypervisor and wherein the vSwitch provides access to a physical function of the network hardware adapter to the plurality of virtual machines operating on one or more computing processors, wherein the vSwitch is configured to:
receive a network packet from a first virtual machine, the network packet having configuration settings of the first virtual machine, the configuration settings including an address of the first virtual machine;
determine an assigned address for the first virtual machine;
determine whether a received address is matching the assigned address;
block the network packet from a vNIC via a hypervisor in response to the received address not matching the assigned address;
receive vNIC configuration data from the address pool, wherein the vNIC configuration data indicates an assigned address of each vNIC for a second virtual machine wherein the assigned address in the address pool is created by a cloud controller;
receive an enforcement rule for the vSwitch, wherein the enforcement rule allows the vSwitch to block a third virtual machine with a first vNIC that has a used address matching an assigned address of a second vNIC for a fourth virtual machine, wherein the used address is a packet address for a source of a second network packet from a fifth virtual machine, and wherein the used address is a Media Access Control (MAC) address;
receive the second network packet from the third virtual machine through the first vNIC, the second network packet indicates configuration settings of the third virtual machine via metadata;
determine that the enforcement rule applies to the second network packet;
enforce the enforcement rule by blocking the second network packet from the third virtual machine to an intended destination if the enforcement rule applies to the second network packet; and
notify a system administrator, selected from the plurality of virtual machines, that the traffic from the first virtual machine is blocked.

6. The system of claim 5 , wherein the vSwitch is configured to determine an assigned address by:
sending a Dynamic Host Configuration Protocol (DHCP) request to a DHCP server; and
receiving the assigned address for the first virtual machine from the DHCP server.

7. The system of claim 5 , wherein the vSwitch is configured to receive a network packet by:
monitoring the network packet using a deep packet inspection, wherein the address is an internet protocol address and the virtual switch works in layer 3.

8. The system of claim 5 , wherein the vSwitch is provided as a service in a cloud environment.

Assignees

• IBM

Inventors

• Brown Deanna L Q
• Crowell Susan F
• Nikolai Jason A
• Thorstensen Andrew T

Classifications

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• G06F15/173

  using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L49/00

  Packet switching elements · CPC title

• H04L49/70

  Virtual switches · CPC title