Methods and apparatus to provide network traffic support and physical security support

• US 20050086523A1
• Filed: 10/15/2003
• Published: 04/21/2005
• Est. Priority Date: 10/15/2003
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Zimmer, Vincent J., Rothman, Michael A.
• Granted Patent: US 7,496,961 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Methods and apparatus to provide network traffic support and physical security support are described herein. In an example method, a virtual machine monitor (VMM) in a processor system is initialized. At least one of a network traffic intrusion event and a physical security intrusion event is identified by the VMM. At least one of a network traffic support and a physical security support is implemented in response to at least one of the network traffic intrusion event and the physical security intrusion event.

Claims

1. A method to provide network traffic support and physical security support comprising:

initializing a virtual machine monitor (VMM) in a processor system during a pre-boot phase;

identifying at least one of a network traffic intrusion event and a physical security intrusion event with the VMM; and

implementing at least one of a network traffic support and a physical security support in response to the at least one of the network traffic intrusion event and the physical security intrusion event.

2. A method as defined in claim 1, wherein identifying the at least one of the network traffic intrusion event and the physical security intrusion event with the VMM comprises detecting at least one of a packet accessing a restricted port, a packet associated with a virus identifier, a SYN packet, and an alert standard format packet.

3. A method as defined in claim 1, wherein identifying the at least one of the network traffic intrusion event and the physical security intrusion event with the VMM comprises detecting opening of a chassis associated of the processor system via a chassis intrusion switch.

4. A method as defined in claim 1, wherein implementing the at least one of the network traffic support and the physical security support comprises discarding a packet associated with network traffic in response to identifying the network traffic intrusion event.

5. A method as defined in claim 1, wherein implementing the at least one of the network traffic support and the physical security support comprises disabling the processor system in response to identifying the physical security intrusion event.

6. A method as defined in claim 1, further comprising identifying a user authorization for the physical security intrusion event of the processor system.

7. A method as defined in claim 1, wherein the processor system is associated with at least one of a private internal network and the Internet.

8. A machine readable medium storing instructions, which when executed, cause a machine to:

initialize a virtual machine monitor (VMM) in a processor system during a pre-boot phase;

identify at least one of a network traffic intrusion event and a physical security intrusion event with the VMM; and

implement at least one of a network traffic support and a physical security support in response to detecting the at least one of the network traffic intrusion event and the physical security intrusion event.

9. A machine readable medium as defined in claim 8, wherein the instructions cause the machine to identify the at least one of the network traffic intrusion event and the physical security intrusion event within the VMM by detecting at least one of a packet accessing a restricted port, a packet associated with a virus identifier, a SYN packet, and an alert standard format packet.

10. A machine readable medium as defined in claim 8, wherein the instructions cause the machine to identify the at least one of the network traffic intrusion event and the physical security intrusion event within the VMM by detecting opening of a chassis of the processor system via a chassis intrusion switch.

11. A machine readable medium as defined in claim 8, wherein the instructions cause the machine to implement the at least one of the network traffic support and the physical security support by discarding a packet associated with network traffic in response to identifying the network traffic intrusion event.

12. A machine readable medium as defined in claim 8, wherein the instructions cause the machine to implement the at least one of the network traffic support and the physical security support by disabling the processor system in response to identifying the physical security intrusion event.

13. A machine readable medium as defined in claim 8, wherein the processor system is associated with at least one of a private internal network and the Internet.

14. A machine readable medium as defined in claim 8, wherein the machine readable medium comprises one of a programmable gate array, application specific integrated circuit, erasable programmable read only memory, read only memory, random access memory, magnetic media, and optical media.

15. An apparatus to provide network traffic support and physical security support comprising:

a data structure configured to store firmware of a processor system; and

a virtual machine monitor initialized from the firmware during a pre-boot phase to identify at least one of a network traffic intrusion event and a physical security intrusion event, and to implement at least one of a network traffic support and a physical security support in response to detecting the at least one of the network traffic intrusion event and the physical security intrusion event.

16. An apparatus as defined in claim 15, wherein the network traffic intrusion event comprises detection of at least one of a packet accessing a restricted port, a packet associated with a virus identifier, a SYN packet, and an alert standard format packet.

17. An apparatus as defined in claim 15, wherein the physical security intrusion event comprises opening a chassis of the processor system.

18. An apparatus as defined in claim 15, further comprising a chassis intrusion switch coupled to the VMM and configured to detect a physical security intrusion event of a chassis of the processor system.

19. An apparatus as defined in claim 15, wherein the VMM is configured to discard a packet associated with network traffic in response to identifying the network traffic intrusion event.

20. An apparatus as defined in claim 15, wherein the VMM is configured to disable the processor system in response to identifying the physical security intrusion event.

21. An apparatus as defined in claim 15, wherein the data structure comprises a flash memory.

22. An apparatus as defined in claim 15, wherein the processor system is associated with at least one of a private internal network and the Internet.

23. A processor system to provide network traffic support and physical security support comprising:

a flash memory configured to store code associated with a virtual machine monitor (VMM) of the processor system; and

a processor operatively coupled to the flash memory, the processor being programmed to initialize the VMM during a pre-boot phase, to identify at least one of a network traffic intrusion event and a physical security intrusion event with the VMM, and to implement at least one of a network traffic support and a physical security support in response to the at least one of the network traffic intrusion event and the physical security intrusion event.

24. A processor system as defined in claim 23, wherein the network traffic intrusion event comprises detection of at least one of a packet accessing a restricted port, a packet associated with a virus identifier, a SYN packet, and an alert standard format packet.

25. A processor system as defined in claim 23, wherein the physical security intrusion event comprises opening a chassis of the processor system.

26. A processor system as defined in claim 23, further comprising a chassis intrusion switch coupled to the processor and configured to detect a physical security intrusion event of a chassis of the processor system.

27. A processor system as defined in claim 23, wherein the processor is programmed to discard a packet associated with network traffic in response to detecting the network traffic intrusion event.

28. A processor system as defined in claim 23, wherein the processor is programmed to disable the processor system in response to detecting the physical security intrusion event.

29. A processor system as defined in claim 23 is associated with at least one of a private internal network and the Internet.