System and method for an endpoint hardware assisted network firewall in a security environment
View Patent ↗A method is provided in one example embodiment and includes receiving a traffic flow at a tamper resistant environment from an application, where the tamper resistant environment is separated from a host operating system. The method also includes applying a security token to the traffic flow and sending the traffic flow to a server. In specific embodiments, a security module may add information about the application to traffic flow. A trapping module may monitor for a memory condition and identify the memory condition. The trapping module may also, responsive to identifying the memory condition, initiate a virtual environment for the application, and check the integrity of the traffic flow.
1. A method comprising:
receiving, at a tamper resistant environment on a host from a virtualization environment of the host, information associated with an application executing on the host;
receiving a traffic flow at the tamper resistant environment from the application, wherein the tamper resistant environment is separated from an operating system of the host;
creating a modified traffic flow by applying a security token to the received traffic flow and by adding the information to the received traffic flow; and
sending the modified traffic flow to a server.
2. The method of claim 1 , where the security token is derived from an enhanced privacy identification to attest that the tamper resistant environment is trusted.
3. The method of claim 1 , wherein the security token is derived by the tamper resistant environment, wherein the information added to the received traffic flow includes metadata and wherein applying the security token to the received traffic flow comprises:
digitally signing the metadata using public key cryptography.
4. The method of claim 1 , further comprising:
monitoring a memory of the host for a memory condition;
identifying the memory condition;
assigning the application to a virtual machine in the virtualization environment based, at least in part, on identifying the memory condition;
trapping, in the virtualization environment, process events associated with the traffic flow; and
checking the integrity of the traffic flow before the traffic flow is delivered to the tamper resistant environment.
5. The method of claim 1 , further comprising:
monitoring a memory of the host for a memory condition;
identifying the memory condition; and
scanning the memory for integrity based, at least in part, on identifying the memory condition.
6. The method of claim 4 , wherein monitoring for the memory condition comprises:
monitoring regions of the memory associated with buffers used to send data for the memory condition.
7. The method of claim 4 , wherein initiating the virtual environment for the application comprises:
assigning the application to the virtual machine randomly based, at least in part, on identifying the memory condition.
8. The method of claim 4 , wherein the checking the integrity of the traffic flow before the traffic flow is delivered to the tamper resistant environment comprises:
checking the integrity of the traffic flow randomly.
9. At least one non-transitory computer-readable medium that includes code for execution and when executed by a processor is operable to perform operations comprising:
receiving, at a tamper resistant environment on a host from a virtualization environment on the host, information associated with an application executing on the host;
receiving a traffic flow at the tamper resistant environment from the application, wherein the tamper resistant environment is separated from an operating system of the host;
creating a modified traffic flow by applying a security token to the received traffic flow and by adding the information to the received traffic flow; and
sending the modified traffic flow to a server.
10. The computer-readable medium of claim 9 , wherein the security token is derived from an enhanced privacy identification to attest that the tamper resistant environment is trusted.
11. The computer-readable medium of claim 9 , wherein the security token is derived by the tamper resistant environment, wherein the information added to the received traffic flow includes metadata and wherein the code applying the security token to the received traffic flow comprises code for:
digitally signing the metadata using public key cryptography.
12. The computer-readable medium of claim 9 , wherein the code, when executed by the processor, is operable to perform further operations comprising:
monitoring a memory of the host for a memory condition;
identifying the memory condition;
assigning the application to a virtual machine in the virtualization environment based, at least in part, on identifying the memory condition;
trapping, in the virtualization environment, process events associated with the traffic flow; and
checking the integrity of the traffic flow before the traffic flow is delivered to the tamper resistant environment.
13. The computer-readable medium of claim 9 , wherein the code, when executed by the processor, is operable to perform further operations comprising:
monitoring a memory of the host for a memory condition;
identifying the memory condition; and
scanning the memory for integrity based, at least in part, on identifying the memory condition.
14. The computer-readable medium of claim 12 , wherein the code for monitoring for the memory condition, when executed by the processor, is operable to perform further operations comprising:
monitoring regions of the memory associated with buffers used to send data for the memory condition.
15. An apparatus, comprising:
a memory element configured to store data;
a processor operable to execute instructions associated with the data; and
a security engine configured to interface with the memory element and the processor to:
receive, from a virtualization environment of a host, information associated with an application executing on the host;
receive a traffic flow at the tamper resistant environment from the application, wherein the tamper resistant environment is separated from an operating system of the host;
create a modified traffic flow by applying a security token to the received traffic flow and by adding the information to the received traffic flow; and
send the modified traffic flow to a server.
16. The apparatus of claim 15 , further comprising:
a trapping module configured to:
monitor a memory of the host for a memory condition;
identify the memory condition;
assign the application to a virtual machine in the virtualization environment based, at least in part, on identifying the memory condition;
trap, in the virtual environment, process events associated with the traffic flow; and
check the integrity of the traffic flow before the traffic flow is delivered to the tamper resistant environment.
17. The apparatus of claim 15 , wherein the security engine is further configured to:
monitor a memory of the host for a memory condition;
identify the memory condition; and
scan the memory for integrity based, at least in part, on identifying the memory condition.
18. The computer-readable medium of claim 12 , wherein the code, when executed by the processor, is operable to perform further operations comprising:
initiating the virtual environment for the application by assigning the application to the virtual machine randomly based, at least in part, on identifying the memory condition.
19. The computer-readable medium of claim 12 , wherein the code, when executed by the processor, is operable to perform further operations comprising:
firing a virtualization trap only when a condition is asserted based on a configured probabilistic configuration.
20. The computer-readable medium of claim 12 , wherein the checking the integrity of the traffic flow before the traffic flow is delivered to the tamper resistant environment comprises:
checking the integrity of the traffic flow randomly.