Patent ID: 8893274
Filing Date: 2014-11-18
Classification: G06F,H04L

Abstract:
1. A method of filtering data traffic in a virtualization environment, said method comprising: receiving, at a privileged virtual machine executing a privileged domain responsible for managing communication between virtual machines, a data packet from a first virtual machine destined for a second virtual machine, said privileged virtual machine executing upon a virtualization platform on a host computer, wherein data packets of said virtualization environment pass through said privileged virtual machine; intercepting said data packet by said privileged virtual machine; sending said data packet from said privileged virtual machine to a memory location in said host computer shared between said privileged virtual machine and a security virtual machine executing a security domain on said virtualization platform, said sending not utilizing a virtual network of said virtualization environment, said security virtual machine being a different virtual machine than said privileged virtual machine; receiving at said privileged virtual machine a verdict from said security virtual machine regarding said data packet; and passing said data packet to said second virtual machine or dropping said data packet based upon said verdict.