Technologies for distributed detection of security anomalies

Patent metadata

Field	Value
Publication number	US-9705849-B2
Application number	US-201414513140-A
Country	US
Kind code	B2
Filing date	Oct 13, 2014
Priority date	Sep 30, 2014
Publication date	Jul 11, 2017
Grant date	Jul 11, 2017

Abstract

Technologies for distributed detection of security anomalies include a computing device to establish a trusted relationship with a security server. The computing device reads one or more packets of at least one of an inter-virtual network function network or an inter-virtual network function component network in response to establishing the trusted relationship and performs a security threat assessment of the one or more packets. The computing device transmits the security threat assessment to the security server.

First claim

The invention claimed is:

1. A computing device for distributed detection of security anomalies, the computing device comprising:
a memory;
a trusted execution environment module to (i) establish a trusted relationship with a security server, (ii) read, from a shared memory reserved by a hypervisor of the computing device, one or more packets of an inter-virtual network function component network that includes multiple components of a virtual network function distributed across the computing device and one or more other computing devices in response to establishment of the trusted relationship, and (iii) perform a security threat assessment of the one or more packets; and
a communication module to transmit the security threat assessment to the security server.

2. The computing device of claim 1 , wherein to establish the trusted relationship comprises to establish the trusted relationship with a corresponding trusted execution environment module of the security server.

3. The computing device of claim 2 , wherein to transmit the security threat assessment comprises to transmit the security threat assessment to the corresponding trusted execution environment module of the security server over an out-of-band communication channel established between the trusted execution environment module of the computing device and the corresponding trusted execution environment module of the security server.

4. The computing device of claim 1 , wherein the trusted execution environment module is further to transmit a security policy of the computing device to the security server.

5. The computing device of claim 1 , wherein the trusted execution environment module is further to transmit heuristic code of the computing device to the security server.

6. The computing device of claim 1 , wherein the trusted execution environment module is further to receive heuristic code from the security server.

7. The computing device of claim 1 , wherein the trusted execution environment module is further to boot the computing device in response to establishment of the trusted relationship.

8. The computing device of claim 7 , wherein to boot the computing device comprises to retrieve a configuration policy of the computing device.

9. The computing device of claim 1 , wherein the trusted execution environment module is further to determine a runtime posture of the computing device; and
wherein to perform the security threat assessment comprises to perform the security threat assessment of the one or more packets based on the runtime posture.

10. The computing device of claim 9 , wherein to determine the runtime posture of the computing device comprises to determine a runtime posture of a virtual network function of the computing device.

11. The computing device of claim 1 , wherein the communication module is further to receive a remediation action instruction for the one or more packets from the security server.

12. The computing device of claim 11 , wherein the trusted execution environment module is further to enforce a remediation action corresponding with the remediation action instruction.

13. The computing device of claim 1 , wherein the trusted execution environment module is further to:
perform the security threat assessment of a system that includes a plurality of servers; and
receive security information from a trusted execution environment of a second computing device that is to perform a security threat assessment of a subset of the system.

14. The computing device of claim 1 , wherein to read the one or more packets by the hypervisor comprises to read the one or more packets from a virtual switch of the inter-virtual network function component network.

15. The computing device of claim 1 , wherein the trusted execution module is further configured to read one or more fuses of the computing device to determine a security policy associated with enabling access to the computing device through microcode or a basic input output system (BIOS) of the computing device.

16. A method for distributed detection of security anomalies by a computing device, the method comprising:
establishing, by the computing device, a trusted relationship with a security server;
reading, by the computing device, from a shared memory reserved by a hypervisor of the computing device, one or more packets of an inter-virtual network function component network that includes multiple components of a virtual network function distributed across the computing device and one or more other computing devices in response to establishing the trusted relationship;
performing, by the computing device, a security threat assessment of the one or more packets; and
transmitting, by the computing device, the security threat assessment to the security server.

17. The method of claim 16 , wherein establishing the trusted relationship comprises establishing the trusted relationship with a corresponding trusted execution environment module of the security server.

18. The method of claim 17 , wherein transmitting the security threat assessment comprises transmitting the security threat assessment to the corresponding trusted execution environment module of the security server over an out-of-band communication channel established between the trusted execution environment module of the computing device and the corresponding trusted execution environment module of the security server.

19. The method of claim 16 , further comprising determining, by the computing device, a runtime posture of a virtual network function of the computing device; and
wherein performing the security threat assessment comprises performing the security threat assessment of the one or more packets based on the runtime posture.

20. The method of claim 16 , further comprising:
receiving, by the computing device, a remediation action instruction for the one or more packets from the security server; and
enforcing, by the computing device, a remediation action corresponding with the remediation action instruction.

21. A security server for distributed detection of security anomalies, the security server comprising:
a memory;
a trusted execution environment module to establish a trusted relationship with a computing device; and
a communication module to receive, from the computing device, a security threat assessment of one or more packets of an inter-virtual network function component network that includes multiple components of a virtual network function distributed across the computing device and one or more other computing devices;
wherein the trusted execution environment module is further to correlate the security threat assessment with a security threat database of the security server and simulate execution of the one or more packets based on a configuration of the computing device to determine whether the one or more packets pose a security threat.

22. The security server of claim 21 , wherein to establish the trusted relationship comprises to establish the trusted relationship with a corresponding trusted execution environment module of the computing device; and
wherein to receive the security threat assessment comprises to receive the security threat assessment from the corresponding trusted execution environment module of the computing device over an out-of-band communication channel established between the trusted execution environment module of the security server and the corresponding trusted execution environment module of the computing device.

Assignees

• Sood Kapil
• Ergin Mesut A
• Fastabend John R
• Woo Shinae
• Shaw Jeffrey B
• Skerry Brian J
• Intel Corp

Inventors

• Sood Kapil
• Ergin Mesut A
• Fastabend John R
• Woo Shinae
• Shaw Jeffrey B
• Skerry Brian J

Classifications

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• H04L63/0272 Primary

  Virtual private networks · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title