Virtual firewall load balancer

• US 9,497,165 B2
• Filed: 03/26/2015
• Issued: 11/15/2016
• Est. Priority Date: 03/26/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Keohane, Susann M., McBrearty, Gerald F., Mullen, Shawn P., Murillo, Jessica C., Shieh, Johnny M.
• Primary Examiner(s): Shepperd, Eric W
• Application Number:
  US14/669,277
• Publication Number:
  US 20160285828A1
• Time in Patent Office: 600 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45579 I/O management, e.g. providing access to device drivers or storage
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 49/70 Virtual switches
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

According to one exemplary embodiment, a method for load balancing between a virtual component within a virtual environment and a Host Intrusion Prevention System (HIPS) is provided. The method may include receiving a trusted connection table from the HIPS, wherein the trusted connection table contains a plurality of trusted connection information. The method may also include receiving a network packet from a virtual switch, wherein the network packet has a plurality of connection information. The method may then include determining if the plurality of connection information matches the plurality of trusted connection information. The method may further include sending the network packet to a destination based on determining that the plurality of connection information matches the plurality of trusted connection information. The method may include sending the network packet to the HIPS based on determining that the plurality of connection information does not match the plurality of trusted connection information.

Claims

1. A computer system for load balancing between a virtual component within a virtual environment and a Host Intrusion Prevention System (HIPS), comprising:

one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage medium, and program instructions stored on at least one of the one or more tangible storage medium for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising;

receiving a trusted connection table from the HIPS, wherein the trusted connection table contains a plurality of trusted connection information;

receiving a network packet from a virtual switch, wherein the network packet has a plurality of connection information;

determining if the plurality of connection information matches the plurality of trusted connection information;

sending the network packet to a destination based on determining that the plurality of connection information matches the plurality of trusted connection information; and

sending the network packet to the HIPS based on determining that the plurality of connection information does not match the plurality of trusted connection information.

2. The computer system of claim 1, wherein the virtual environment comprises a virtual input output server (VIOS), a hypervisor and a plurality of virtual Ethernet adapters.

3. The computer system of claim 2, wherein the virtual component is a trusted firewall running within the VIOS or the trusted firewall running within the hypervisor.

4. The computer system of claim 1, wherein receiving the trusted connection table from the HIPS comprises the virtual component within the virtual environment receiving a trusted message containing the trusted connection table from the HIPS.

5. The computer system of claim 4, wherein the trusted message comprises sending a plurality of data according to at least one of a Simple Network Management Protocol version 3 (SNMPv3) and a Network Configuration Protocol (NETCONF).

6. The computer system of claim 1, wherein the HIPS comprises a physical firewall connected to the virtual environment by a communication network.

7. The computer system of claim 1, wherein the plurality of connection information comprises a source Internet Protocol (IP) address, a destination IP address, a source port, a destination port, and a protocol.

8. The computer system of claim 7, wherein the plurality of trusted connection information comprises a trusted source IP address, a trusted destination IP address, a trusted source port, a trusted destination port, and a trusted protocol.

9. The computer system of claim 8, wherein determining if the plurality of connection information matches the plurality of trusted connection information comprises matching the source IP with the trusted source IP address, matching the destination IP address to the trusted destination IP address, matching the source port to the trusted destination port, matching the destination port to the trusted destination port, and matching the protocol with the trusted protocol.

10. A computer program product for load balancing between a virtual component within a virtual environment and a Host Intrusion Prevention System (HIPS), comprising:

one or more non-transitory computer-readable storage medium and program instructions stored on at least one of the one or more non-transitory computer-readable storage medium, the program instructions executable by a processor, the program instructions comprising;

program instructions to receive a trusted connection table from the HIPS, wherein the trusted connection table contains a plurality of trusted connection information;

program instructions to receive a network packet from a virtual switch, wherein the network packet has a plurality of connection information;

program instructions to determine if the plurality of connection information matches the plurality of trusted connection information;

program instructions to send the network packet to a destination based on determining that the plurality of connection information matches the plurality of trusted connection information; and

program instructions to send the network packet to the HIPS based on determining that the plurality of connection information does not match the plurality of trusted connection information.

11. The computer program product of claim 10, wherein the virtual environment comprises a virtual input output server (VIOS), a hypervisor and a plurality of virtual Ethernet adapters.