Agentless security of virtual machines using a network interface controller
An agentless intrusion detection and prevention digital processing system and environment, or virtual firewall is disclosed. The agentless, virtual firewall monitors and controls digital data communications between a digital communications network and one or more virtual digital processing machines. The virtual digital processing machines, or virtual machines (VMs), are operative on a host digital processor under the supervision of a hypervisor software module. The agentless, virtual firewall is implemented as part of a virtual switch filtering extension to an extensible virtual switch running in a kernel mode as part of the hypervisor software module.
1. A method of providing agentless security of virtual machines, comprising:
intercepting, by a virtual switch filtering extension of an extensible virtual switch operating on a Hyper-V hypervisor software module, a data packet being transmitted from a source device, wherein the Hyper-V hypervisor software module is on a host processor and wherein the virtual switch filtering extension is also configured to intercept data packets in outbound transmissions to the source device;
comparing, by the virtual switch filtering extension, both a destination virtual port identifier and a destination network interface controller (NIC) index number indicated in the data packet with entries of a firewall location table that maps virtual port identifiers and NIC index numbers to global unique identifiers (GUIDs) of virtual machines on the host processor, wherein each virtual machine on the host processor is associated with a respective GUID that is linked to a respective set of predefined rules;
in response to determining, based on the comparing, that the destination virtual port identifier and the destination NIC index number correspond to a corresponding global unique identifier (GUID) of a first virtual machine on the host processor:
retrieving a set of predefined rules linked to the corresponding GUID of the first virtual machine; and
comparing, by the virtual switch filtering extension, parameters of the data packet with protocol-specific parameters listed in the retrieved set of predefined rules; and
in response to determining that the data packet is not in compliance with the set of predefined rules associated with the first virtual machine, preventing, by the virtual switch filtering extension, transmission of the data packet from the source device to the first virtual machine.
2. The method of claim 1 , wherein the source device is a second virtual machine on the host processor.
3. The method of claim 1 , further comprising:
intercepting another data packet being transmitted from the source device to a third virtual machine on the host processor;
determining a respective GUID of the third virtual machine based on an another destination virtual port number and another NIC index number comprised in the another data packet;
retrieving another set of predefined rules linked to the respective GUID of the third virtual machine; and
in response to determining that the another data packet is in compliance with the another set of predefined rules associated with the third virtual machine, allowing, by the virtual switch filtering extension, transmission of the another data packet from the source device to the third virtual machine.
4. The method of claim 1 , wherein the virtual switch filtering extension further comprises a stateful packet inspection table, and wherein the set of predefined rules comprise one or more stateful rules.
5. The method of claim 1 , further comprising:
comparing incoming traffic statistics of the first virtual machine with an incoming allocation of maximum bandwidth for the first virtual machine; and
in response to determining that (1) the incoming traffic statistics exceeds the incoming allocation and (2) an allowable incoming data packet is pending, deferring the data packet by returning the data packet to a back of an incoming traffic queue.
6. The method of claim 5 , further comprising:
monitoring a currently available data quota of the first virtual machine, wherein the currently available data quota comprises a difference between the maximum bandwidth and the incoming traffic statistics for the first virtual machine; and
injecting the deferred data packet to a front of the incoming traffic queue.
7. The method of claim 1 , further comprising:
creating a filtering log comprising a list of events filtered by the virtual switch filtering extension;
determining whether access is available to a management service database; and
in response to determining that the access is available, transmitting the filtering log to the management service database; and
in response to determining that the access is unavailable, caching the filtering log by a host management module for later transmission.
8. The method of claim 1 , wherein the data packet is identified as being an Internet Protocol packet, and wherein the set of predefined rules comprise one or more Internet Protocol rules for the first virtual machine.
9. The method of claim 1 , wherein the intercepting further comprises:
monitoring digital data communication between the source device and the first virtual machine using a kernel mode driver with the virtual switch filtering extension, wherein the digital data communication comprises the data packet.
10. A system of providing agentless security of virtual machines, the system comprising:
a host processor comprising a Hyper-V hypervisor software module, the Hyper-V hypervisor software module comprising an extensible virtual switch with a virtual switch filtering extension configured to:
intercept a data packet being transmitted inbound from a source device, wherein the virtual switch filtering extension is also configured to intercept data packets in outbound transmission to the source device;
compare both a destination virtual port identifier and a destination network interface controller (NIC) index number indicated in the data packet with entries of a firewall location table that maps virtual port identifiers and NIC index numbers to global unique identifiers (GUIDs) of virtual machines on the host processor, wherein each virtual machine on the host processor is associated with a respective GUID that is linked to a respective set of predefined rules;
in response to determining, based on the comparing, that the destination virtual port identifier and the destination NIC index number correspond to a corresponding global unique identifier (GUID) of a first virtual machine on the host processor:
retrieve a set of predefined rules linked to the corresponding GUID of the first virtual machine; and
compare parameters of the data packet with protocol-specific parameters listed in the retrieved set of predefined rules; and
in response to determining that the data packet is not in compliance with the set of predefined rules associated with the first virtual machine, prevent transmission of the data packet from the source device to the first virtual machine.
11. The system of claim 10 , wherein the source device is a second virtual machine on the host processor.
12. The system of claim 10 , wherein the virtual switch filtering extension is further configured to:
intercept another data packet being transmitted from the source device to a third virtual machine on the host processor;
determine a respective GUID of the third virtual machine based on an another destination virtual port number and another NIC index number comprised in the another data packet;
retrieve another set of predefined rules linked to the respective GUID of the third virtual machine; and
in response to determining that the another data packet is in compliance with the another set of predefined rules associated with the third virtual machine, allow transmission of the another data packet from the source device to the third virtual machine.
13. The system of claim 10 , wherein the virtual switch filtering extension further comprises a stateful packet inspection table, and wherein the set of predefined rules comprise one or more stateful rules.
14. The system of claim 10 , wherein the virtual switch filtering extension is further configured to:
compare incoming traffic statistics of the first virtual machine with an incoming allocation of maximum bandwidth for the first virtual machine; and
in response to determining that (1) the incoming traffic statistics exceeds the incoming allocation and (2) an allowable incoming data packet is pending, defer the data packet by returning the data packet to a back of an incoming traffic queue.
15. The system of claim 14 , wherein the virtual switch filtering extension is further configured to:
monitor a currently available data quota of the first virtual machine, wherein the currently available data quota comprises a difference between the maximum bandwidth and the incoming traffic statistics for the first virtual machine; and
inject the deferred data packet to a front of the incoming traffic queue.
16. The system of claim 10 , wherein the virtual switch filtering extension is further configured to:
create a filtering log comprising a list of events filtered by the virtual switch filtering extension;
determine whether access is available to a management service database; and
in response to determining that the access is available, transmit the filtering log to the management service database; and
in response to determining that the access is unavailable, cache the filtering log by a host management module for later transmission.
17. The system of claim 10 , wherein the data packet is identified as being an Internet Protocol packet, and wherein the set of predefined rules comprise one or more Internet Protocol rules for the first virtual machine.
18. The system of claim 10 , wherein the virtual switch filtering extension is further configured to intercept by:
monitoring digital data communication between the source device and the first virtual machine using a kernel mode driver with the virtual switch filtering extension, wherein the digital data communication comprises the data packet.