Network Adapter Based Zoning Enforcement
Embodiments of the present invention are directed to enforcing zoning at a network adapter of an end point device. Thus, a network adapter can monitor the communications that are sent and/or received by the adapter and discard communications that are prohibited based on the zoning rules applicable to the adapter. In some embodiments, zoning configuration information can be defined and stored at a central entity and sent to the various network adapters. Alternatively, or in addition, each network adapter can also check outgoing communications to ensure that they include a proper source address. More specifically, outgoing communications may be checked to ensure that their source address is the address (or one of the addresses) that are associated with the network adapter. This can be used to detect and/or prevent malfunctions and/or intentional tampering or hacking.
1 . A method for enforcing network zoning, the method comprising:
receiving, by an attachable network adapter card, a set of addresses to which a virtual end point device has access;
monitoring, by an attachable network adapter card, communications sent and received by the virtual end point device; and
discarding, by the attachable network adapter card, communications destined for the virtual end point device that do not include an address in the set of addresses to which the virtual end point device has access.
2 . The method of claim 1 , wherein the method comprises assigning the virtual end point device to one or more zones, wherein each address in the set of addresses corresponds to a network device that is a member of the one or more zones.
3 . The method of claim 2 , wherein the network device one or is associated with a plurality of addresses.
4 - 33 . (canceled)
34 . The method of claim 1 , wherein the set of addresses is generated by a zoning database module that is connected to the virtual end point device through a network.
35 . The method of claim 1 , wherein the attachable network adapter card comprises one or more elements of the virtual end point device.
36 . The method of claim 1 , wherein the virtual end point device comprises two or more virtual devices.
37 . The method of claim 36 , wherein a first virtual device is assigned to a first zone and a second virtual device is assigned to a second zone.
38 . The method of claim 1 , wherein the first zone and the second zone are independent.
39 . An attachable network adapter card comprising:
a memory operable to store a first set of one or more addresses and a second set of one or more addresses, each address in the first set of one or more addresses corresponding to a virtual device in a first zone, each address in the second set of one or more addresses corresponding to a virtual device in a second zone, wherein a virtual end point comprises the first virtual device and the second virtual device; and
one or more processors operable to enforce virtual network zoning, wherein the enforcement of virtual network zoning comprises:
discarding communications destined for in the first virtual device that do not include an address from the first set of one or more addresses; and
discarding communications destined for the second virtual device that do not include an address from the second set of one or more addresses.
40 . The attachable network adapter card of claim 39 , wherein the first set of one or more addresses and the second set of one or more addresses are received by the attachable network adapter card over a network.
41 . The network adapter card of claim 39 , wherein the first set of addresses and the second set of addresses are generated by a zoning database module that is connected to the virtual end point device through a network.
44 . The network adapter card of claim 39 , wherein the network adapter card comprises one or more elements of the first virtual device and the second virtual device.
45 . The network adapter card of claim 39 , wherein the first zone and the second zone are independent.
46 . An attachable network adapter card comprising:
a virtual end point operably connected to a first virtual device and a second virtual device, the first virtual device being assigned to a first zone and the second virtual device being assigned to a second zone; and
one or more processors operable to enforce virtual network zoning, wherein the enforcement of virtual network zoning comprises:
discarding communications destined for in the first virtual device that do not comprise an address associated with the first zone; and
discarding communications destined for the second virtual device that do not comprise an address associated with the second zone.
47 . The attachable network adapter card of claim 46 , wherein a first set of one or more addresses associated with the first zone and a second set of one or more addresses associated with the second zone are received by the attachable network adapter card over a network.
48 . The network adapter card of claim 47 , wherein the first set of addresses and the second set of addresses are generated by a zoning database module that is connected to the virtual end point device through the network.
49 . The network adapter card of claim 39 , wherein the network adapter card comprises one or more elements of the first virtual device and the second virtual device.
50 . The network adapter card of claim 39 , wherein the first zone and the second zone are independent.