Virtual host security profiles

• US 9,531,674 B2
• Filed: 11/11/2009
• Issued: 12/27/2016
• Est. Priority Date: 11/11/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Rangegowda, Dharshan, Goldian, Jeffrey R.
• Primary Examiner(s): Khoshnoodi, Nadia
• Application Number:
  US12/616,163
• Publication Number:
  US 20110113483A1
• Time in Patent Office: 2,603 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Architecture that creates and applies a virtual firewall profile for each network to which a multi-homed device is connected. In one implementation, the virtual profiles can be based on address ranges of the networks. This ensures seamless concurrent connectivity of the multi-homed device to multiple networks.

Claims

1. A computer-implemented security system, comprising:

a set of security profiles that provides communications security for a multi-homed device, each of the security profiles including a set of rules that constrains device connectivity according to that profile, the security profiles being associated with connections from which data packets are being received, the set of security profiles comprising a first security profile being constrained to apply to a first address range for all traffic from a first active connection, and a second security profile being constrained to apply to a second address range for all traffic from a second concurrently active connection, the first security profile being different from the second security profile such that the first security profile does not affect security of the second concurrently active connection and the second security profile does not affect security of the first active connection; and

a security component for determining if the connections are active by examining the data packets received, and responsive to determining that one or more of the connections is active automatically selecting and applying corresponding security profiles to the one or more active connections.

2. The system of claim 1, wherein the connections are network connections.

3. The system of claim 1, wherein the set of security profiles includes firewall profiles that configure secure access to the multi-homed device.

4. The system of claim 1, wherein the set of security profiles includes a security profile associated with a virtual network.

5. The system of claim 1, wherein the set of security profiles includes a security profile associated with a physical network.

6. The system of claim 1, further comprising an administration component for creating the security profiles and downloading the security profiles to the security component of the multi-homed device.

7. The system of claim 3, wherein each firewall profile comprises one or more firewall rules, and each firewall profile is applicable to one or more connections.

8. A computer-implemented security system, comprising:

a set of firewall profiles that provides communications security for a multi-homed device, the set of firewall profiles configuring firewall access to the multi-homed device, and being associated with connections from which data packets are being received, the set of firewall profiles comprising a first firewall profile being constrained to apply to a first address range for all traffic from a first active connection, and a second firewall profile being constrained to apply to a second address range for all traffic from a second concurrently active connection to provide seamless concurrent connectivity of the multi-homed device to the first and second active connections, the first firewall profile being different from the second firewall profile; and

a security component for determining if the connections are active by examining the data packets received, and responsive to determining that one or more of the connections is active automatically selecting and applying specific firewall profiles to the one or more active connections.

9. The system of claim 8, wherein the set of firewall profiles includes a firewall profile associated with a virtual network.

10. The system of claim 8, wherein the set of firewall profiles includes a firewall profile associated with a physical network.

11. The system of claim 8, further comprising an administration component for creating the firewall profiles and downloading the firewall profiles to the security component of the multi-homed device.

12. The system of claim 8, wherein the connections are network connections.

13. The system of claim 8, wherein each firewall profile comprises one or more firewall rules, and each firewall profile is applicable to one or more connections.

14. A computer-implemented security method for a multi-homed device, comprising:

detecting concurrently active connections at the multi-homed device by examining data packets received from multiple connections;

selecting a security profile from a set of security profiles for each active connection, the security profiles being different from one another such that one security profile does not affect security of an active connection associated with another security profile;

applying the security profile for each active connection to provide secure communications over the active connections; and

constraining communications to the active connections based on address ranges associated with the active connections as defined in the security profile corresponding to each of the active connections.

15. The method of claim 14, further comprising creating the security profiles and downloading the security profiles to the multi-homed device.

16. The method of claim 14, further comprising constraining communications to a virtual network as defined in the security profile.

17. The method of claim 14, further comprising constraining communications to a physical network as defined in the security profile.

18. The method of claim 14, further comprising storing the security profiles, which are firewall profiles, on a host firewall for selective imposition according to active connections.

19. The method of claim 18, wherein each firewall profile comprises one or more firewall rules, and each firewall profile is applicable to one or more connections.