VIRTUAL HOST SECURITY PROFILES

• US 20110113483A1
• Filed: 11/11/2009
• Published: 05/12/2011
• Est. Priority Date: 11/11/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Goldian, Jeffrey R., Rangegowda, Dharshan
• Granted Patent: US 9,531,674 B2
• Time in Patent Office: Days
• US Class Current: 726/15
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Architecture that creates and applies a virtual firewall profile for each network to which a multi-homed device is connected. In one implementation, the virtual profiles can be based on address ranges of the networks. This ensures seamless concurrent connectivity of the multi-homed device to multiple networks.

Claims

1. A computer-implemented security system, comprising:

a set of security profiles that provides communications security for a multi-homed device, the security profiles associated with connections from which data packets can be received; and

a security component for automatically selecting and applying security profiles in response to receiving data packets from multiple connections.

2. The system of claim 1, wherein the connections are network connections.

3. The system of claim 1, wherein the set of security profiles includes firewall profiles that configure secure access to the multi-homed device.

4. The system of claim 1, wherein the set of security profiles includes a security profile associated with a virtual network.

5. The system of claim 1, wherein the set of security profiles includes a security profile associated with a physical network.

6. The system of claim 1, wherein the set of security profiles includes security profiles that constrain communications to different network addresses associated with correspondingly different connections.

7. The system of claim 1, further comprising an administration component for creating the security profiles and downloading the security profiles to the security component of the multi-homed device.

8. A computer-implemented security system, comprising:

a set of firewall profiles that provide communications security for a multi-homed device, the firewall profiles associated with connections from which data packets can be received; and

a security component for automatically selecting and applying specific firewall profiles to active connections.

9. The system of claim 8, wherein the set of firewall profiles configures firewall access to the multi-homed device.

10. The system of claim 8, wherein the set of firewall profiles includes a firewall profile associated with a virtual network.

11. The system of claim 8, wherein the set of firewall profiles includes a firewall profile associated with a physical network.

12. The system of claim 8, wherein the set of firewall profiles includes firewall profiles that constrain communications to different network addresses associated with correspondingly different network connections.

13. The system of claim 8, further comprising an administration component for creating the firewall profiles and downloading the firewall profiles to the security component of the multi-homed device.

14. The system of claim 8, wherein the connections are network connections.

15. A computer-implemented security method for a multi-homed device, comprising:

detecting active connections at the multi-homed device;

selecting a security profile for each active connection; and

applying the security profile for each active connection to provide secure communications over the active connections.

16. The method of claim 15, further comprising creating the security profiles and downloading the security profiles to the multi-homed device.

17. The method of claim 15, further comprising constraining communications to an active connection based on an address range associated with the active connection as defined in the corresponding security profile.

18. The method of claim 15, further comprising constraining communications to a virtual network as defined in the security profile.

19. The method of claim 15, further comprising constraining communications to a physical network as defined in the security profile.

20. The method of claim 15, further comprising storing the security profiles, which are firewall profiles, on a host firewall for selective imposition according to active connections.