IP Library › Granted Patent US 12684009

Granted Patent B2

US 12684009 · App. 18/453,199 · Granted Jul 14, 2026

Out of band threat prevention

Inventors: Rami Ailabouni (Eilabun, IL); Meni Orenbach (Giv'atayim, IL); Ahmad Atamli (Oxford, GB)

Assignee: Mellanox Technologies, Ltd.

H04L63/1441 G06F9/45558 H04L63/1416 G06F2009/45587 G06F2009/45595

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12684009
App. No.: 18/453,199
Granted: Jul 14, 2026
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A system includes a data processing unit (DPU). The DPU is to receive a notification associated with a virtualized computing environment on a host system coupled to the DPU. The DPU is associated with a security characteristic. A threat type associated with the threat is identified. Based on at least one of the threat type associated with the threat or the security characteristic of the virtualized computing environment, a threat prevention operation to address the threat is determined. The threat prevention operation is caused to be performed on the host system.

Claims (53)

1 . A system comprising:

a memory; and

a processor of a first data processing unit (DPU) communicably coupled to the memory, wherein the first DPU is configured to:

receive a notification of a threat associated with a virtualized computing environment on a host system coupled to the first DPU, wherein the first DPU is associated with a security characteristic;

identify a threat type associated with the threat;

determine, based on at least one of the threat type associated with the threat or the security characteristic of the virtualized computing environment, a threat prevention operation to address the threat; and

cause, by the first DPU, the threat prevention operation to be performed on the host system to address the threat associated with the virtualized computing environment, wherein the first DPU is isolated from the virtualized computing environment, and wherein the threat prevention operation comprises: modifying one or more memory permissions of the host system to prevent execution of malicious code associated with the threat by causing an exception, deleting malicious content from a file system associated with the virtualized computing environment, disarming malicious content and reconstructing a process affected by the malicious content, isolating the virtualized computing environment from external access, and/or terminating the virtualized computing environment.

2 . The system of claim 1 , wherein the first DPU has write access to memory of the host system.

3 . The system of claim 1 , wherein the threat type comprises at least one of: a process operating on the host system, malicious software, a malicious driver, a malicious linked library, the malicious content of the file system, a vulnerability, a misconfiguration, a privilege escalation, or an exploit.

4 . The system of claim 1 , wherein responsive to determining that the threat type corresponds to a process operating on the host system, the threat prevention operation comprises:

identifying, based on the notification, a page table entry associated with the process executing the threat; and

terminating the process by performing at least one of: setting the page table entry associated with the process to read-only, setting the page table entry to kernel access mode, setting a stack content associated with the page table entry to a null value, or marking a page associated with the page table entry as non-executable.

5 . The system of claim 1 , wherein responsive to determining that the threat type corresponds to malicious software executing on the virtualized computing environment, the threat prevention operation comprises:

identifying, based on the notification, the malicious software, wherein the malicious software comprises at least one of a driver, a library, or a process; and

overwriting the malicious software with a predefined software.

6 . The system of claim 5 , wherein the predefined software comprises one of: a backup software stored on a second DPU, or a benign software generated by the first DPU.

7 . The system of claim 1 , wherein responsive to determining that the threat type corresponds to the malicious content of the file system, the threat prevention operation comprises:

identifying, based on the notification, one or more malicious files in the file system associated with the virtualized computing environment; and

deleting the one or more malicious files.

8 . The system of claim 1 , further comprising:

responsive to determining that the threat prevention operation failed to address the threat, causing a second threat prevention operation to be performed on the host system.

9 . The system of claim 1 , further comprising:

preserving a state of a memory of the host system prior to causing the threat prevention operation to be performed on the host system.

10 . A method comprising:

receiving, by a first data processing unit (DPU), a notification of a threat associated with a virtualized computing environment on a host system coupled to the first DPU, wherein the first DPU is associated with a security characteristic;

identifying a threat type associated with the threat;

determining, based on at least one of the threat type associated with the threat or the security characteristic of the virtualized computing environment, a threat prevention operation to address the threat; and

causing, by the first DPU, the threat prevention operation to be performed on the host system to address the threat associated with the virtualized computing environment, wherein the first DPU is isolated from the virtualized computing environment, and wherein the threat prevention operation comprises: modifying one or more memory permissions of the host system to prevent execution of malicious code associated with the threat by causing an exception, deleting malicious content from a file system associated with the virtualized computing environment, disarming malicious content and reconstructing a process affected by the malicious content, isolating the virtualized computing environment from external access, and/or terminating the virtualized computing environment.

11 . The method of claim 10 , wherein the DPU has write access to memory of the host system.

12 . The method of claim 10 , wherein the threat type comprises at least one of: a process operating on the host system, a malicious driver, a malicious linked library, the malicious content of the file system, a vulnerability, a misconfiguration, a privilege escalation, or an exploit.

13 . The method of claim 10 , wherein responsive to determining that the threat type corresponds to a process operating on the host system, the threat prevention operation comprises:

identifying, based on the notification, a page table entry associated with the process executing the threat; and

14 . The method of claim 10 , wherein responsive to determining that the threat type corresponds to malicious software executing on the virtualized computing environment, the threat prevention operation comprises:

identifying, based on the notification, the malicious software, wherein the malicious software comprises at least one of a driver, a library, or a process; and

overwriting the malicious software with a predefined software.

15 . The method of claim 14 , wherein the predefined software comprises one of: a backup software stored on a second DPU, or a benign software generated by the first DPU.

16 . The method of claim 10 , wherein responsive to determining that the threat type corresponds to the malicious content of the file system, the threat prevention operation comprises:

identifying, based on the notification, one or more malicious files in the file system associated with the virtualized computing environment; and

deleting the one or more malicious files.

17 . The method of claim 10 , further comprising:

preserving a state of a memory of the host system prior to causing the threat prevention operation to be performed on the host system.

18 . A non-transitory computer-readable medium storing instructions thereon, wherein the instructions, when executed by a processing device of a computing system that hosts one or more guests, cause the processing device to perform operations comprising:

receiving, by a data processing unit (DPU), a notification of a threat associated with a virtualized computing environment on a host system coupled to the DPU, wherein the DPU is associated with a security characteristic;

identifying a threat type associated with the threat;

causing, by the DPU, the threat prevention operation to be performed on the host system to address the threat associated with the virtualized computing environment, wherein the DPU is isolated from the virtualized computing environment, and wherein the threat prevention operation comprises: modifying one or more memory permissions of the host system to prevent execution of malicious code associated with the threat by causing an exception, deleting malicious content from a file system associated with the virtualized computing environment, disarming malicious content and reconstructing a process affected by the malicious content, isolating the virtualized computing environment from external access, and/or terminating the virtualized computing environment.

19 . The non-transitory computer-readable medium of claim 18 , wherein responsive to determining that the threat type corresponds to a process operating on the host system, the threat prevention operation comprises:

identifying, based on the notification, a page table entry associated with the process executing the threat; and

20 . The non-transitory computer-readable medium of claim 18 , wherein responsive to determining that the threat type corresponds to malicious software executing on the virtualized computing environment, the threat prevention operation comprises:

identifying, based on the notification, the malicious software, wherein the malicious software comprises at least one of a driver, a library, or a process; and

overwriting the malicious software with a predefined software.