System and Method for Securing Information in a Virtual Computing Environment

• US 20070266433A1
• Filed: 03/01/2007
• Published: 11/15/2007
• Est. Priority Date: 03/03/2006
• Status: Abandoned Application

• Current Assignee: StrataCloud, Inc. (Exitlag LLC)
• Original Assignee: StrataCloud, Inc. (Exitlag LLC)
• Inventors: Moore, Hezi
• Application Number:
  US11/680,858
• Publication Number:
  US 20070266433A1
• Time in Patent Office: Days
• US Class Current: 726/15
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A virtual security appliance is provided for disposition in a virtual network having at least one other virtual network device, the virtual network residing on a host data processing machine. The virtual security appliance comprises an interface configured for receiving a data communication directed to the at least one other virtual network device and a security function module adapted for initiating a security function responsive to said data communication meeting predetermined criteria.

Claims

1. A virtual security appliance for disposition in a first virtual network having at least one other virtual network device, the first virtual network residing on a host data processing machine, the virtual security appliance comprising:

an interface configured for receiving a data communication directed to the at least one other virtual network device; and

a security function module adapted for initiating a security function responsive to said data communication meeting predetermined criteria.

2. A virtual security appliance according to claim 1 wherein the security function comprises an action selected from the set consisting of preventing the data communication from reaching the at least one other virtual network device, activating a security application, creating an electronic record of the data communication and transmitting an alert.

3. A virtual security appliance according to claim 2 wherein the security application is one of the set consisting of a network security application and an application for securing another application running on the first virtual network.

4. A virtual security appliance according to claim 2 wherein the security application is one of the set consisting of an anti-virus application, an anti-spyware application, and a process for mitigating service denial.

5. A virtual security appliance according to claim 1 wherein the predetermined criteria includes a set of security rules for use in conjunction with the security function, at least a portion of the security rules being stored in a data storage module in the virtual security appliance.

6. A virtual security appliance according to claim 1 wherein the data communication is originated by a first virtual network device within the first virtual network and is directed to a second virtual network device within the first virtual network.

7. A virtual security appliance according to claim 1 wherein the data communication is originated by a source external to the first virtual network.

8. A virtual security appliance according to claim 7 wherein the data communication is originated by a second virtual network on the host data processing machine.

9. A virtual security appliance according to claim 7 wherein the data communication is originated by a source external to the host data processing machine.

10. A virtual security appliance according to claim 1 wherein the interface is configured for out-of-band monitoring of the data communication.

11. A virtual security appliance according to claim 10 wherein the security function includes an action selected from the set consisting of collecting data communication data and transmitting an alert.

12. A virtual security appliance according to claim 1 wherein the virtual security appliance is configured to instruct a processing resource other than a core CPU of the host data processing machine to carry out at least a portion of the security function.

13. A virtual security appliance according to claim 1 wherein the virtual network resides in a virtual environment established by a virtual software platform running on the host data processing machine and the virtual security appliance is tailored for compatibility with the virtual environment.

14. A virtual security appliance according to claim 1 further comprising:

a network detection module configured for detecting constituent devices of the first virtual network.

15. A method of securing a first virtual network, the method comprising:

identifying at least one virtual device in the first virtual network; and

incorporating a virtual security appliance into the first virtual network, the virtual security appliance being configured for receiving a data communication directed to the at least one virtual network device and initiating a security function responsive to said data communication meeting predetermined criteria.

16. A method according to claim 15 wherein the security function comprises an action selected from the set consisting of preventing the data communication from reaching the at least one other virtual network device, activating a security application, creating an electronic record of the data communication and transmitting an alert.

17. A method according to claim 16 wherein the security application is one of the set consisting of a network security application and an application for securing another application running on the first virtual network.

18. A method according to claim 16 wherein the security application is one of the set consisting of an anti-virus application, an anti-spyware application, and a process for mitigating service denial.

19. A method according to claim 15 further comprising:

determining a set of security rules for use in conjunction with the security function; and

storing at least a portion of the security rules in a data storage module of the virtual security appliance.

20. A method according to claim 15 wherein the data communication is originated by a first virtual network device within the first virtual network and is directed to a second virtual network device within the first virtual network.

21. A method according to claim 15 wherein the data communication is originated by a source external to the first virtual network.

22. A method according to claim 15 wherein the data communication is originated by one of the set consisting of a second virtual network on the host data processing machine and a source external to the host data processing machine.

23. A method according to claim 15 wherein the virtual network resides in a virtual environment established by a virtual software platform running on the host data processing machine, the method further comprising:

tailoring the virtual security appliance for compatibility with the virtual environment.

24. A computer program embodied in a computer-readable medium, the computer program comprising instructions for performing a set of actions comprising:

incorporating a virtual security appliance into a first virtual network residing on a host data processing machine, the first virtual network including at least one other virtual network device, the virtual security appliance being configured for receiving a data communication directed to the at least one other virtual network device and initiating a security function responsive to said data communication meeting predetermined criteria.

25. A computer program according to claim 24 wherein the set of actions further comprises:

identifying the at least one virtual device in the first virtual network.

26. A computer program according to claim 24 wherein the security function comprises an action selected from the set consisting of preventing the data communication from reaching the at least one other virtual network device, activating a security application, creating an electronic record of the data communication and transmitting an alert.

27. A computer program according to claim 26 wherein the security application is one of the set consisting of a network security application and an application for securing another application running on the first virtual network.

28. A computer program according to claim 26 wherein the security application is one of the set consisting of an anti-virus application, an anti-spyware application, and a process for mitigating service denial.

29. A computer program according to claim 24 wherein the data communication is originated by a first virtual network device within the first virtual network and is directed to a second virtual network device within the first virtual network.

30. A computer program according to claim 24 wherein the data communication is originated by a source external to the first virtual network.

31. A computer program according to claim 24 wherein the data communication is originated by one of the set consisting of a second virtual network on the host data processing machine and a source external to the host data processing machine.

32. A computer program according to claim 24 wherein the virtual network resides in a virtual environment established by a virtual software platform running on the host data processing machine and the virtual security appliance is capable of being tailored for compatibility with the virtual environment.

33. A virtual security system for protecting a virtual network device in a virtual network on a host data processor from threats carried by data communications from at least one data communication source external to the virtual network, the virtual security system comprising:

at least one virtual security appliance in communication with the virtual network device, each of the at least one virtual security appliance being configured for receiving, via a network interface, data communications from the at least one data communication source and for initiating a security function responsive to one of said data communications meeting predetermined criteria.

34. A virtual security system according to claim 33 wherein the security function comprises an action selected from the set consisting of preventing the data communication from reaching the at least one other virtual network device, activating a security application, creating an electronic record of the data communication and transmitting an alert.

35. A virtual security system according to claim 34 wherein the security application is one of the set consisting of a network security application and an application for securing another application running on the first virtual network.

36. A virtual security system according to claim 34 wherein the security application is one of the set consisting of an anti-virus application, an anti-spyware application, and a process for mitigating service denial.

37. A virtual security system according to claim 33 wherein the predetermined criteria includes a set of security rules for use in conjunction with the security function, at least a portion of the security rules being stored in a data storage module in the virtual security appliance.

38. A virtual security system according to claim 33 wherein the at least one data communication source comprises one of the set consisting of a virtual network device and a physical data communication source.

39. A virtual security system according to claim 33 further comprising:

a virtual load balancer disposed intermediate the network interface and the at least one security appliance, the virtual load balancer being configured for receiving the data communications and, for each data communication, selecting one of the at least one virtual security appliance and directing the data communication to the selected virtual security appliance.

40. A virtual security system according to claim 39 wherein the virtual load balancer is configured to select the virtual security appliance based on predetermined criteria relating to at least one of the set consisting of communications traffic level and virtual security appliance capacity.

41. A virtual security system according to claim 33 wherein the network interface comprises a plurality of virtual network devices each having a corresponding one of the at least one virtual security appliance disposed in-line intermediate the network interface and the virtual network device.