Host-based firewall for distributed computer systems

• US 10,142,290 B1
• Filed: 03/30/2016
• Issued: 11/27/2018
• Est. Priority Date: 03/30/2016
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Brandwine, Eric Jason, Fitzgerald, Robert Eric, Lucas, Alexander Robin Gordon
• Primary Examiner(s): Poltorak, Piotr
• Application Number:
  US15/085,608
• Time in Patent Office: 972 Days
• Field of Search: None
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Customers of a computing resource service provider may utilize computing resources of the computing resources service provided to implement one or more computer systems. Furthermore, the customer may cause a host-based firewall to be executed by the one or more computer systems. The host-based firewall may collect network traffic information. The customer may then be provided with the network traffic information and be prompted to provide decisions associated with the network traffic information. The decisions may be used to generate a set of rules which may be enforced by the host-based firewall.

Claims

1. A computer-implemented method, comprising:

executing a host-based firewall loaded into memory of a virtual machine instance operated by a customer of a plurality of customers of a computing resource service provider, where the virtual machine instance is a computing resource that is a member of a set of computing resources provided to the plurality of customers by the computing resource service provider;

obtaining network traffic information from the host-based firewall, the network traffic information indicating a set of connection attempts between the virtual machine instance and at least one other computer system and a particular application of one or more applications executed by the virtual machine instance associated with a particular connection attempt of the set of connection attempts;

prompting the customer for decisions to allow or deny the set of connection attempts by at least providing the customer with a notification of the set of connection attempts;

obtaining, from the customer, a first set of decisions to allow or deny the set of connection attempts;

obtaining, from a different customer, a second set of decisions to allow or deny another set of connection attempts between a virtual machine instance of the different customer and at least one other computer system;

generating a rule set by the host-based firewall based at least in part on the first set of decisions and the second set of decisions; and

enforcing, by the host-based firewall, the generated rule set.

2. The computer-implemented method of claim 1, wherein executing the host-based firewall further comprises providing the host-based firewall with a default rule set for enforcing network traffic decisions on the computing resource operated by the customer while network traffic is obtained prior to receiving the first set of decisions.

3. The computer-implemented method of claim 1, wherein the computer-implemented method further comprises:

obtaining a request to generate a finding associated with a first application of the one or more applications executed by the computing resource operated by the customer, where the finding indicates additional information to aid the customer with the first set of decisions;

generating the finding associated with a first application based at least in part on network traffic information indicating the first application; and

providing the customer with the finding associated with a first application.

4. The computer-implemented method of claim 1, wherein the computer-implemented method further comprises executing a training phase of the host-based firewall by at least:

allowing a plurality of network connections directed to the computing resource operated by the customer for an interval of time; and

wherein prompting the customer for decisions to allow or deny the set of connection attempts corresponds to a set of network connections established during the interval of time.

5. A system, comprising:

one or more processors; and

memory that includes instructions that, when executed by the one or more processors, cause the system to;

obtain network traffic information from one or more host-based firewalls implemented by a plurality of virtual machine instances operated by a plurality of customers of a computing resource service provider, the network traffic information indicating one or more processes executed by the plurality of virtual machine instances and associated with one or more network connections included in the network traffic information;

generate a set of rules for network traffic based at least in part on decisions received from at least two of the plurality of customers, the decisions identifying whether to allow or deny a set of connection attempts between virtual machine instances of the at least two of the plurality of customers and other computer systems;

provide the set of rules to the one or more host-based firewalls; and

enforce, by the host-based firewalls, the set of rules.

6. The system of claim 5, wherein memory further comprises instructions that, when executed by the one or more processors, cause the system to prompt, by at least invoking an application programming interface call, the plurality of customers for additional information associated with allowing or denying the one or more network connections included in the network traffic.

7. The system of claim 5, wherein memory further comprises instructions that, when executed by the one or more processors, cause the system to display, through a management console accessible to the plurality of customers, the network traffic information, the plurality of customers provide decisions on the network traffic information through the management console.

8. The system of claim 5, wherein memory further comprises instructions that, when executed by the one or more processors, cause the system to aggregate at least a portion of the network traffic information based at least in part on metadata associated with the plurality of virtual machine instances indicating a relationship between at least a portion of the plurality of virtual machine instances.

9. The system of claim 8, wherein generating the set of rules for network traffic further comprises generating, based at least in part on the metadata, a subset of the set of rules for the portion of the plurality of virtual machine instances.

10. The system of claim 5, wherein memory further comprises instructions that, when executed by the one or more processors, cause the system to provide the set of rules to one or more edge sensors that are responsible for distributing network traffic to plurality of virtual machine instances.

11. The system of claim 5, memory further comprises instructions that, when executed by the one or more processors, cause the system to:

detect an event provided by a customer of the plurality of customers; and

as a result of detecting the event, modify one or more settings of at least one host-based firewall of the one or more host-based firewalls.

12. The system of claim 5, wherein generating the set of rules further comprises correlating decisions corresponding to the one or more network connections included in the network traffic information between the plurality of customers.

13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:

execute a host-based firewall, the host-based firewall included in memory of the computer system as a result of a command from a customer of a plurality of customers of a computing resource service provider;

cause the host-based firewall to obtain network traffic information indicating a process associated with network traffic;

provide the network traffic information to a security service;

obtain, from the security service, a set of rules for network traffic to be enforced by the host-based firewall, the set of rules for network traffic generated based at least in part on rule decisions made by a plurality of the customers, the rule decisions identifying whether to allow or deny a set of connection attempts between virtual machines of the customers and other computer systems; and

enforce, by the host-based firewall, the set of rules.

14. The non-transitory computer-readable storage medium of claim 13, wherein the instructions that cause the computer system to execute the host-based firewall further include instructions that cause the computer system to provide the host-based firewall with a default set of rules.

15. The non-transitory computer-readable storage medium of claim 14, wherein the instructions that cause the computer system to provide the host-based firewall with the default set of rules further include instructions that cause the computer system to:

as a result of the default set of rules, deny one or more connection attempts to the computer system without a rule of the set of rules allowing the connection; and

prompt a customer for a decision to allow or deny the one or more connection attempts to the computer system.

16. The non-transitory computer-readable storage medium of claim 15, wherein the instructions that cause the computer system to prompt the customer for the decision further include instructions that cause the computer system to transmit a notification to the customer indicating whether to allow or deny the one or more connection attempts to the computer system.

17. The non-transitory computer-readable storage medium of claim 13, wherein the instructions that cause the computer system to receive the set of rules for network traffic further include instructions that cause the computer system to receive a threat score that is associated with the set of rules.

18. The non-transitory computer-readable storage medium of claim 17, wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to allow network connections associated with an particular address if the threat score is above a threshold as a result of enforcing a particular rule of the set of rules.

19. The non-transitory computer-readable storage medium of claim 13, wherein the instructions that cause the computer system to enforce the set of rules further include instructions that cause the computer system to enforce a particular rule based at least in part on the particular rule being associated with a metadata tag and an application executed by the computer system being associated with the metadata tag.

20. The non-transitory computer-readable storage medium of claim 13, wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to modifying a previous set of rules based at least in part on receiving the set of rules.