Hierarchical firewalls

• US 8,336,094 B2
• Filed: 01/05/2009
• Issued: 12/18/2012
• Est. Priority Date: 03/27/2008
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Litvin, Moshe, Benjamini, Gilad
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US12/348,897
• Publication Number:
  US 20090249472A1
• Time in Patent Office: 1,443 Days
• Field of Search: 726/13, 718/1, 370/230
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A method of implementing a firewall that receives a layer of policies from each of multiple entities with different levels of authority. The method evaluates received packets based on the received layers of policies. A layer of policies of a higher level of authority can accept a received packet, block the received packet, or delegate a decision of whether to accept or block the received packet to a layer of policies of a lower level of authority.

Claims

1. A method of implementing a virtual machine firewall on a host node to protect at least one virtual machine on the host node, the method comprising:

receiving, with the firewall, a layer of firewall policies from each of a plurality of entities with different levels of authority over the at least one virtual machine on the host node;

maintaining, with the firewall, a first layer of policies received from a first entity with a first level of authority and a second layer of policies received from a second entity with a second level of authority for the virtual machine, wherein the first level of authority is higher than the second level of authority;

evaluating, with the firewall, a packet received by the host node for the virtual machine based on the first layer of policies with the first level of authority prior to evaluating the packet based on the second level of authority associated with the second layer of policies; and

in response to the evaluation of the packet based on the first layer of policies for the virtual machine, determining to one of allow the received packet through the firewall to the virtual machine, block the received packet from the virtual machine, or delegate a decision of whether to allow or block the received packet to the second layer of policies for the virtual machine.

2. The method of claim 1, further comprising, upon delegating the decision of whether to allow or block the received packet to the second layer of policies, evaluating the received packet based on the second layer of policies with the second level of authority, and determining whether to allow the received packet through the firewall to the virtual machine, block the packet from the virtual machine, or delegate the decision of whether to allow or block the packet to a next layer of policies received from a third entity with a third level of authority, wherein the second level of authority is higher than the third level of authority.

3. The method of claim 1, further comprising, upon delegating the decision of whether to allow or block the received packet to the second layer of policies, evaluating the received packet based on the second layer of policies with the second level of authority, wherein the second level of authority is the lowest level of authority, and determining whether to allow the packet through the firewall to the virtual machine or block the packet from the virtual machine, wherein the policies of the layer of policies with the lowest level of authority are not used for determining whether to delegate the decision of whether to allow or block the packet to a next layer of policies.

4. The method of claim 1, wherein the firewall is implemented to pass packets from outside the host node to the at least one virtual machine on the host node.

5. The method of claim 1, wherein the at least one virtual machine is associated with multiple layers of policies that apply to that virtual machine.

6. The method of claim 1, wherein the plurality of entities comprises a system administrator and a virtual machine administrator.

7. The method of claim 1, wherein the plurality of entities comprises a user of the virtual machine.

8. A method of controlling passage of data packets to and from a plurality of virtual machines on a plurality of host nodes, the method comprising:

coordinating firewall policies, with a firewall coordinator, for each of the plurality of virtual machines running on the plurality of host nodes, wherein coordinating the firewall policies comprises accepting policies for a particular virtual machine from a plurality of users with different authority levels over the virtual machine, and maintaining a first policy of a first user with a first authority level and a second policy of a second user with a second authority level, wherein the first authority level is higher than the second authority level; and

implementing, with a plurality of firewalls implemented on the plurality of host nodes, the firewall policies of the users, wherein implementing the policies for the particular virtual machine comprises implementing the first policy of the first user with the higher authority level to control passage of a packet sent to the particular virtual machine, wherein the first policy contradicts the second policy of the second user with the lower authority level.

9. A security system for controlling passage of data packets to and from a plurality of virtual machines on a plurality of host nodes, the security system comprising one or more microprocessors configured to operate as:

a firewall coordinator to coordinate firewall policies for each of the plurality of virtual machines running on the plurality of host nodes, wherein the firewall coordinator comprises a policy manager for accepting policies for a particular virtual machine from a plurality of users with different authority levels over the virtual machine, and maintaining a first policy of a first user with a first authority level and a second policy of a second user with a second authority level, wherein the first authority level is higher than the second authority level; and

a plurality of firewalls implemented on the plurality of host nodes, wherein the firewalls implement the firewall policies of the users, wherein, for the particular virtual machine, the firewalls implement the first policy of the first user with the higher authority level to control passage of a packet sent to the particular virtual machine, wherein the first policy contradicts the second policy of the second user with the lower authority level.

10. The security system of claim 9, wherein the firewall coordinator sends updated policies to the firewalls.

11. The security system of claim 9, wherein the plurality of firewalls block the packet sent to the particular virtual machine when the first policy of the first user with the higher authority level comprises a policy to block the packet and the second policy of the second user with the lower authority level comprises a policy to allow the packet.

12. The security system of claim 9, wherein the plurality of firewalls allow the packet sent to the particular virtual machine when the first policy of the first user with the higher authority level comprises a policy to allow the packet and the second policy of the second user with the lower authority level comprises a policy to block the packet.

13. The security system of claim 9, wherein the plurality of firewalls allow the packet sent to the particular virtual machine when the first policy of the first user with the higher authority level comprises a policy to delegate a decision of whether to allow or block the packet to the second policy of the second user with the lower authority level and the second policy of the second user with the lower authority level comprises a policy to allow the packet.

14. The security system of claim 9, wherein the plurality of firewalls block the packet sent to the particular virtual machine when the first policy of the first user with the higher authority level comprises a policy to delegate a decision of whether to allow the packet to the second policy of the second user with the lower authority level and the second policy of the second user with the lower authority level comprises a policy to block the packet.

15. The security system of claim 14, wherein the packet has a particular source IP address, the first policy comprises a policy that delegates decisions of whether to allow or block packets from the particular source IP address to the second policy with the lower authority level, and the second policy comprises a policy to allow or block packets from the particular source IP address.

16. The security system of claim 14, wherein the packet has a particular destination port address, the first policy comprises a policy that delegates decisions of whether to allow or block packets to the particular destination port address to the second policy with the lower authority level, and the second policy comprises a policy to allow or block packets to the particular destination port address.

17. A non-transitory computer readable storage medium storing a computer program which when executed by at least one processor implements a virtual machine firewall on a host node to protect at least one virtual machine on the host node, the computer program comprising a set of instructions that cause the processor to:

receive a layer of firewall policies from each of a plurality of entities with different levels of authority over the at least one virtual machine on the host node;

maintain a first layer of policies received from a first entity with a first level of authority and a second layer of policies received from a second entity with a second level of authority for the virtual machine, wherein the first level of authority is higher than the second level of authority;

evaluate a packet received by the host node for the virtual machine based on the first layer of policies with the first level of authority prior to evaluating the packet based on the second level of authority associated with the second layer of policies; and

based on the evaluation based on the first layer of policies for the virtual machine, determine to one of allow the received packet through the firewall to the virtual machine, block the received packet from the virtual machine, or delegate a decision of whether to allow or block the received packet to the second layer of policies for the virtual machine.

18. The non-transitory computer readable storage medium of claim 17, further comprising, upon delegating the decision of whether to allow or block the received packet to the second layer of policies, instructions that cause the processor to evaluate the received packet based on the second layer of policies with the second level of authority, and determine whether to allow the packet through the firewall to the virtual machine, block the packet from the virtual machine, or delegate the decision of whether to allow or block the packet to a next layer of policies received from a third entity with a third level of authority, wherein the second level of authority is higher than the third level of authority.

19. The non-transitory computer readable storage medium of claim 17, further comprising, upon delegating the decision of whether to allow or block the received packet to the second layer of policies, instructions that cause the processor to evaluate the received packet based on the second layer of policies with the second level of authority, wherein the second level of authority is the lowest level of authority, and determining whether to allow the packet through the firewall to the virtual machine or block the packet from the virtual machine, wherein the policies of the layer of policies with the lowest level of authority are not used for determining whether to delegate the decision of whether to allow or block the packet to a next layer of policies.

20. A method of applying a set of firewall policies with a virtual machine firewall on a host node to protect at least one virtual machine on the host node, the method comprising:

receiving, with the firewall, a first packet and determining based on a first level of authority associated with the set of firewall policies to allow the first packet to pass the firewall to the virtual machine;

receiving, with the firewall, a second packet and determining based on the first level of authority associated with the set of firewall policies to block the second packet from the virtual machine;

receiving, with the firewall, a third packet, and determining based on the first level of authority associated with the set of firewall policies to delegate the determination of whether to allow the third packet to pass the firewall to a second level of authority associated with the set of firewall policies, wherein the first level of authority is higher than the second level of authority; and

determining, with the firewall, based on the second level of authority associated with the set of firewall policies whether to allow the third packet to pass the firewall to the virtual machine.