Using a proxy for endpoint access control

• US 20070234412A1
• Filed: 03/29/2006
• Published: 10/04/2007
• Est. Priority Date: 03/29/2006
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Smith, Ned, Klotz, Carl, Palanivel, Rajan
• Application Number:
  US11/392,277
• Publication Number:
  US 20070234412A1
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

A technique includes providing a virtual machine within a first enclave and a second enclave. A virtual machine is used as a proxy to negotiate a connection between the first enclave and the second enclave.

Claims

1. A method comprising:

providing a virtual machine within a first enclave and a second enclave; and

using the virtual machine as a proxy to negotiate a connection between the first enclave and the second enclave.

2. The method of claim 1, wherein using the proxy to function as a server with respect to the first enclave and using the proxy to function as a client with respect to the second enclave.

3. The method of claim 1, wherein the act of using the virtual machine as a proxy comprises establishing a virtual network connection for the first enclave.

4. The method of claim 1, wherein the virtual machine comprises a management virtual machine.

5. The method of claim 1, further comprising:

providing a platform that is part of the first enclave; and

executing software on the platform to provide the virtual machine.

6. The method of claim 1, wherein the virtual machine comprises a first virtual machine, the method further comprising:

providing a platform that is part of the first enclave;

executing software on the platform to provide a second virtual machine; and

using the first virtual machine as a proxy for the second virtual machine for connection to the second enclave.

24. The method of claim 1, wherein the first enclave comprises a set of resources protected as a group.

7. An apparatus comprising:

a first virtual machine of a first enclave to be a proxy between a second virtual machine of the first enclave and a second enclave different from the first enclave.

8. The apparatus of claim 7, wherein the first virtual machine is part of the first enclave and the second enclave.

9. The apparatus of claim 7, wherein the first virtual machine comprises:

a control channel proxy to establish a first authentication session between the first virtual machine and the second virtual machine and a second authentication session between the first virtual machine and a policy decision point of the second enclave.

10. The apparatus of claim 7, wherein the first virtual machine comprises:

a virtual private network proxy to establish a first connection between the first virtual network and the second virtual machine and a second connection between the first virtual machine and a virtual private network of the second enclave.

11. The apparatus of claim 7, wherein the first virtual machine comprises:

a firewall proxy to filter data provided by the second virtual machine for communication to the second enclave.

12. The apparatus of claim 7, wherein the first virtual machine is a client for the second enclave and a server for the second virtual machine.

22. The apparatus of claim 7, further comprising:

trusted hardware to be used by the second virtual machine to establish trust of the first virtual machine to act as a proxy for the second virtual machine.

23. The apparatus of claim 7, further comprising:

trusted hardware to be used by a policy decision point to establish trust of the first virtual machine.

25. The apparatus of claim 7, wherein the first enclave comprises a set of resources protected as a group.

13. An article comprising a computer accessible storage medium storing instructions that, when executed by a computer, cause the computer to:

provide a virtual machine within a first enclave and a second enclave; and

use the virtual machine as a proxy to negotiate a connection between the first enclave and the second enclave.

14. The article of claim 13, the storage medium storing instructions to cause the computer to cause the proxy to function as a server with respect to the first enclave and a client with respect to the second enclave.

15. The article of claim 13, the storage medium storing instructions to cause the computer to establish a virtual network connection for the first enclave.

16. The article of claim 13, the storage medium storing instructions to cause the computer to establish another virtual machine of the first enclave and not of the second enclave to use the proxy to negotiate a connection with the second enclave machine.

17-21. -21. (canceled)