Restricting network access to untrusted virtual machines
View Patent ↗Approaches for providing operating environments selective access to network resources. A guest operating system, executing on a device, may issue a request to a network device for access to a set of network resources. Once the guest operating system authenticates itself to the network device, the network device provides, to the guest operating system, access to the set of network resources. Note that the host operating system, executing on the device, does not have access to the set of network resources. A guest operating system may be provided access to an untrusted network in a manner that denies the host operating system access to the untrusted network. In this way, any malicious code inadvertently introduced into the host operating system cannot access the untrusted network for unscrupulous purposes.
1. A non-transitory computer-readable storage medium storing one or more sequences of instructions for providing operating environments selective access to network resources, which when executed by one or more processors, causes:
a guest operating system, executing on a device, issuing a request to a network device for access to a set of network resources, wherein a host operating system executes on said device; and
upon the guest operating system authenticating itself to the network device using authentication data, the network device providing, to the guest operating system, access to the set of network resources,
wherein said host operating system executing on the device does not have access to said set of network resources for lack of a sufficient privilege based on data contained in Extended Page Tables (EPT) of said host operating system, and wherein said host operating system executing on the device does not have sufficient privilege to access said authentication data based on the data contained in the Extended Page Tables (EPT) of said host operating system.
2. The non-transitory computer-readable storage medium of claim 1 , wherein the authentication data is stored in the guest operating system.
3. The non-transitory computer-readable storage medium of claim 1 , wherein the authentication data is stored by the hypervisor or in a different virtual machine than in which the guest operating system executes.
4. The non-transitory computer-readable storage medium of claim 1 , wherein execution of the one or more sequences of instructions further cause:
upon a hypervisor determining that the guest operating system requires access to the set of network resources, the hypervisor or a special virtual machine computing authentication credentials and inserting the authentication credentials into the request sent to the network device.
5. The non-transitory computer-readable storage medium of claim 4 , wherein the authentication data, used to compute the authentication credentials, is stored in the special virtual machine.
6. The non-transitory computer-readable storage medium of claim 1 , wherein execution of the one or more sequences of instructions further cause:
upon the guest operating system notifying a hypervisor or a special virtual machine that the guest operating system requires access to the set of network resources, the hypervisor or the special virtual machine computing authentication credentials that are provided to the guest operating system for transmittal to the network device.
7. The non-transitory computer-readable storage medium of claim 1 , wherein the host operating system cannot read the authentication data stored by the guest operating system because a virtual machine in which the guest operating system runs is protected from the host operating system due to the host operating system being deprivileged.
8. The non-transitory computer-readable storage medium of claim 1 , wherein the host operating system has access to an Intranet but not the Internet.
9. The non-transitory computer-readable storage medium of claim 1 , wherein the guest operating system communicates with the network device over a secure session.
10. The non-transitory computer-readable storage medium of claim 1 , wherein the host operating system cannot read the authentication data stored by the guest operating system.
11. An apparatus for providing operating environments selective access to network resources, comprising:
one or more processors; and
one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause:
a guest operating system, executing on a device, issuing a request to a network device for access to a set of network resources, wherein a host operating system executes on said device; and
upon the guest operating system authenticating itself to the network device using authentication data, the network device providing, to the guest operating system, access to the set of network resources,
wherein said host operating system executing on the device does not have access to said set of network resources for lack of a sufficient privilege based on data contained in Extended Page Tables (EPT) of said host operating system, and wherein said host operating system executing on the device does not have sufficient privilege to access to said authentication data based on the data contained in the Extended Page Tables (EPT) of said host operating system.
12. The apparatus of claim 11 , wherein the authentication data is stored in the guest operating system.
13. The apparatus of claim 11 , wherein the authentication data is stored by the hypervisor or in a different virtual machine than in which the guest operating system executes.
14. The apparatus of claim 11 , wherein execution of the one or more sequences of instructions further cause:
upon a hypervisor determining that the guest operating system requires access to the set of network resources, the hypervisor or a special virtual machine computing authentication credentials and inserting the authentication credentials into the request sent to the network device.
15. The apparatus of claim 14 , wherein the authentication data, used to compute the authentication credentials, is stored in the special virtual machine.
16. The apparatus of claim 11 , wherein execution of the one or more sequences of instructions further cause:
upon the guest operating system notifying a hypervisor or a special virtual machine that the guest operating system requires access to the set of network resources, the hypervisor or the special virtual machine computing authentication credentials that are provided to the guest operating system for transmittal to the network device.
17. The apparatus of claim 11 , wherein the host operating system cannot read the authentication data stored by the guest operating system because a virtual machine in which the guest operating system runs is protected from the host operating system due to the host operating system being deprivileged.
18. The apparatus of claim 11 , wherein the host operating system has access to an Intranet but not the Internet.
19. The apparatus of claim 11 , wherein the guest operating system communicates with the network device over a secure session.
20. A method for providing operating environments selective access to network resources, comprising:
a guest operating system, executing on a device, issuing a request to a network device for access to a set of network resources, wherein a host operating system executes on said device; and
upon the guest operating system authenticating itself to the network device using authentication data, the network device providing, to the guest operating system, access to the set of network resources,
wherein said host operating system executing on the device does not have access to said set of network resources for lack of a sufficient privilege based on data contained in Extended Page Tables (EPT) of said host operating system, and wherein said host operating system executing on the device does not have sufficient privilege to access to said authentication data based on the data contained in the Extended Page Tables (EPT) of said host operating system.