System and method for intelligent coordination of host and guest intrusion prevention in virtualized environment
View Patent ↗A distributed and coordinated security system providing intrusion-detection and intrusion-prevention for the virtual machines (VMs) in a virtual server is described. The virtualization platform of the virtual server is enhanced with networking drivers that provide a “fast path” firewall function for pre-configured guest VMs that already have dedicated deep packet inspection security agents installed. A separate security VM is deployed to provide virtual security agents providing deep packet inspection for non pre-configured guest VMs. The network drivers are then configured to intercept the data traffic of these guest VMs and route it through their corresponding virtual security agents, thus providing a “slow-path” for intrusion detection and prevention.
1. A method for computer security inspection in a secure virtual server system, the method comprising:
in a computer having a processor, and a non-transitory computer readable storage medium having computer readable instructions stored thereon for execution by the processor:
providing a virtualization platform including a hypervisor;
forming a plurality of guest virtual machines deployed on top of the virtualization platform;
forming a security virtual machine deployed on top of the virtualization platform, the security virtual machine being configured to determine which of the guest virtual machines have a respective security agent installed and running;
providing one or more networking drivers for intercepting packet stream of respective guest virtual machines;
causing each networking driver to:
provide a fast path driver for passing the packet stream through, provided a respective guest virtual machine has a security agent installed and running on the guest virtual machine; and
route the packet stream of the respective guest virtual machine through the security virtual machine for packet inspection, provided the respective guest virtual machine does not have a security agent installed and running.
2. The method of claim 1 , further comprising inspecting the intercepted packet stream in the virtual security agent.
3. The method of claim 2 , wherein the inspecting further comprises verifying validity of a packet of the intercepted packet stream based on a checksum.
4. The method of claim 3 , further comprising reassembling the packet from packet fragments in the intercepted packet stream after the verifying the validity.
5. The method of claim 2 , wherein the inspecting further comprises verifying the packet based on layer 3 or 4 header information.
6. The method of claim 2 , wherein the inspecting further comprises performing a deep inspection of the packet, including inspecting payload.
7. The method of claim 6 , wherein the deep inspection further comprises:
buffering and re-ordering Transmission Control Protocol (TCP) segments;
verifying a stateful connection sequence of the packet; and
verifying TCP, User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP) protocol dependent header fields.
8. The method of claim 7 , further comprising:
decrypting an encrypted payload of the packet; and
analyzing the decrypted payload to verify that it does not contain unwanted data.
9. The method of claim 8 , further comprising discarding the packet, provided it fails any of the steps of verifying the stateful connection, verifying TCP or analyzing the decrypted payload.
10. The method of claim 6 , further comprising fragmenting the packet into the packet fragments after the performing the deep inspection of the packet.
11. The method of claim 6 , wherein the inspecting further comprises returning the packet to the associated networking driver.
12. The method of claim 1 , further comprising pre-configuring the guest virtual machine with the security agent, provided the guest virtual machine has the security agent installed.
13. The method of claim 1 , comprising running the virtual security agent in the security virtual machine.
14. The method of claim 1 , further comprising discarding packets whose headers contain information that matches with predetermined criteria.
15. The method of claim 1 , comprising running the virtual security agent in the virtualization platform.
16. The method of claim 1 , further comprising providing the networking driver having a firewall.
17. The method of claim 1 , further comprising providing a plurality of security agents for the security virtual machine, for performing intrusion-detection or intrusion-prevention inspection of the intercepted packet stream, each security agent corresponding to a respective guest virtual machine.
18. The method of claim 17 , further comprising linking the respective guest virtual machine to a network and intercepting packet stream of the respective guest virtual machine.
19. The method of claim 1 , further comprising routing the intercepted packet stream through a respective virtual security agent in the security virtual machine outside of the respective guest virtual machine.
20. The method of claim 1 , further comprising performing intrusion-detection or intrusion-prevention inspection of the intercepted packet stream by the virtual security agents.