Integrated intrusion deflection, detection and introspection
View Patent ↗Methods and apparatus are provided for integrated deflection, detection and intrusion. Within a single computer system configured for operating system virtualization (e.g., Solaris™, OpenSolaris™), multiple security functions execute in logically independent zones or containers, under the control and administration of a global zone. Such functions may illustratively include a demilitarized zone (DMZ) and a honeypot. Management is facilitated because all functions work within a single operating system, which promotes the ability to configure, monitor and control each function. Any given zone can be configured with limited resources, a virtual network interface circuit and/or other features.
1. A computer system for providing integrated computer security functions, the computer system comprising:
a set of processors;
a set of network interface devices coupling the computer system to one or more networks; and
a single operating system instance comprising:
a first demilitarized zone operating within a first non-global zone of the single operating system instance having a first network address;
a first honeypot operating within a second non-global zone of the single operating system instance having a second network address; and
a second demilitarized zone within a third non-global zone of the single operating system instance having a third network address;
wherein each of the first non-global zone and the third non-global zone comprise virtual network interface devices bound to different network interface devices within the set of network interface devices; and
wherein each of the first demilitarized zone and the second demilitarized zone operate within separate logical subnets of a network coupled to the computer system.
2. The computer system of claim 1 , wherein each non-global zone of the single operating system instance comprises one or more virtual network interface devices.
3. The computer system of claim 1 , wherein:
a subset of resources of the computer system, including the set of processors, is allocated to the second non-global zone; and
the subset of resources is configured to limit an effectiveness of a potential intruder that has initiated a communication connection with the computer system.
4. The computer system of claim 1 , wherein:
the single operating system instance further comprises a global zone for managing the single operating system instance; and
one or more of the first non-global zone and the second non-global zone are granted only a subset of privileges granted to the global zone.
5. The computer system of claim 1 , wherein the first non-global zone comprises a set of rules configured to restrict access to a network coupled to the computer system.
6. The computer system of claim 5 , wherein a third non-global zone is automatically created within the single operating system based on application of the set of rules.
7. The computer system of claim 1 , wherein the single operating system instance further comprises:
one or more services operating within one or more additional non-global zones of the single operating system.
8. The computer system of claim 7 , wherein:
the one or more additional non-global zones each comprise one or more virtual network interface devices for facilitating communication between the one or more additional non-global zones.
9. The computer system of claim 1 , wherein the single operating system instance further comprises:
a second honeypot within a third zone of the single operating system instance having a third network address.
10. A method of providing integrated computer security functions within a single computer system, the method comprising:
within a single operating system instance executing within the single computer system:
instantiating a first non-global zone configured to operate a first demilitarized zone;
binding a first virtual network interface device with a first network address to the first non-global zone;
instantiating a second non-global zone configured to operate a honeypot;
binding a second virtual network interface device with a second network address to the second non-global zone;
instantiating a third non-global zone configured to operate a second demilitarized zone; and
binding a third virtual network interface device with a third network address to the third non-global zone;
wherein the first virtual network interface device and the third virtual network interface device are bound to different network interfaces within the single computer system;
executing a set of communication rules within the first non-global zone; and
executing logic within the second non-global zone to perform introspection of communication connections deflected to the second non-global zone from the first non-global zone.
11. The method of claim 10 , further comprising:
dynamically altering said communication rules during operation of the single computer system.
12. The method of claim 10 , further comprising:
instantiating a fourth non-global zone configured to analyze a communication connection comprising a packet that triggers one of the communication rules.
13. The method of claim 10 , further comprising:
replicating one of the first non-global zone and the second non-global zone to facilitate instantiation of a fourth non-global zone within the single operating system instance.
14. The method of claim 10 , further comprising:
limiting an amount of resources of the computer system allocated to the second non-global zone;
receiving at the single computer system a suspicious communication connection; and
redirecting the suspicious communication connection to the second non-global zone.
15. The method of claim 14 , wherein the resources comprise processor resources and memory resources.
16. The method of claim 10 , further comprising:
receiving a communication connection within the demilitarized zone;
dynamically instantiating a fourth non-global zone configured to operate another honeypot;
binding a fourth virtual network interface device with a fourth network address to the fourth non-global zone; and
redirecting the communication connection to the fourth non-global zone.
17. A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method of providing integrated computer security functions, the method comprising:
within a single operating system instance executing within the single computer system:
instantiating a first non-global zone configured to operate a first demilitarized zone;
binding a first virtual network interface device with a first network address to the first non-global zone;
instantiating a second non-global zone configured to operate a honeypot;
binding a second virtual network interface device with a second network address to the second non-global zone;
instantiating a third non-global zone configured to operate a second demilitarized zone; and
binding a third virtual network interface device with a third network address to the third non-global zone;
wherein the first virtual network interface device and the third virtual network interface device are bound to different network interfaces within the single computer system;
executing a set of communication rules within the first non-global zone; and
executing logic within the second non-global zone to perform introspection of communication connections deflected to the second non-global zone from the first non-global zone.