System and method for logical separation of a server by using client virtualization

• US 8,713,640 B2
• Filed: 03/04/2011
• Issued: 04/29/2014
• Est. Priority Date: 03/05/2010
• Status: Active Grant

• Current Assignee: Ahnlab Incorporated
• Original Assignee: Ahnlab Incorporated
• Inventors: Park, Heean, Kang, Kyung Wan, Kim, Kwang Tae
• Primary Examiner(s): WILLIAMS, JEFFERY L
• Application Number:
  US13/582,609
• Publication Number:
  US 20120331522A1
• Time in Patent Office: 1,152 Days
• Field of Search: None
• US Class Current: 726/3
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

A system for logically separating a server using client virtualization includes a client terminal including a virtual environment generation unit for generating a virtual environment, and a virtualized server including a local storage unit, an authentication server for performing authentication on the client terminal when a request for access to the local storage unit is received from a process executed in the virtual environment, and a virtualization filter drier for allowing or blocking the access request to the local storage unit based on the authentication result of the client terminal. The client terminal further includes a virtualization filter driver for transmitting the access request from the process executed in the virtual environment to the local storage unit, and blocking the access request from the process without being made through the virtual environment to the local storage unit.

Claims

1. A system for logically separating a server using client virtualization, the system comprising:

a client terminal including a virtual environment generation unit program configured to generate a virtual environment; and

a virtualized server including;

a local storage unit;

an authentication server configured to perform authentication on the client terminal when a request for access to the local storage unit is received from a process executed in the virtual environment; and

a server side virtualization filter driver software configured to allow or block an access to the local storage unit based on the authentication result of the client terminal.

2. The system of claim 1, wherein the client terminal further includes a client side virtualization filter driver software configured to transmit the request for access to the local storage unit from the process executed in the virtual environment of the client terminal to the virtualized server, and block a request for access to the local storage unit from a process which has not passed through the virtual environment.

3. The system of claim 2, wherein when the client side virtualization filter driver software is configured to receive the request for access to the local storage unit from the process executed in the virtual environment, the client side virtualization filter driver software is configured to request the authentication server to authenticate the client terminal, and when the client terminal has been normally authenticated based on the authentication result transmitted from the authentication server, the client side virtualization filter driver software is configured to transmit the request for access to the local storage unit to the server side virtualization filter driver software, while when the client terminal has not been normally authenticated, the client side virtualization filter driver software is configured to block the request for access to the local storage unit.

4. The system of claim 2, wherein the client side virtualization filter driver software is driven in a kernel mode of the client terminal.

5. The system of claim 2, wherein when the authentication server authenticates the client terminal, the authentication server is configured to provide the authentication result to the client side virtualization filter driver software and the server side virtualization filter driver software.

6. The system of claim 2, wherein when the server side virtualization filter driver software receives a request for access to the server from a client terminal without having the client side virtualization filter driver software installed therein, the server side virtualization filter driver software is configured to check the presence or absence of authentication result with respect to the client terminal to block the request for access to the server from the client terminal.

7. A method in a computer network system comprising a client terminal and a server for logically separating the server using client virtualization, the client terminal including a client side virtualization filter driver and the server including a server side virtualization filter driver, the method comprising:

receiving, by the client side virtualization filter driver, a request for access to a virtualized server on a network from a process executed in the client terminal;

when the access request is received through a virtual environment, performing authentication on the client terminal and transmitting the access request to the server side virtualization filter driver;

checking, by the server side virtualization filter driver, an authentication result with respect to the client terminal; and

when the authentication result is checked, allowing the process to access the virtualized server.

8. The method of claim 7, wherein said transmitting the access request to the server side virtualization filter driver comprises:

checking, by the client side virtualization filter driver, whether the process has been executed in the virtual environment;

when the process has been executed in the virtual environment, performing authentication on the client terminal; and

when the client terminal has been authenticated, transmitting the access request to the server side virtualization filter driver.

9. The method of claim 8, wherein said checking whether the process has been executed in the virtual environment comprises blocking, by the client side virtualization filter driver, the access request from the process when the process has not been executed in the virtual environment.

10. The method of claim 7, wherein said checking an authentication result with respect to the client terminal comprises blocking, by the server side virtualization filter driver, access to the server from the process when the client terminal has not been authenticated.