Patent ID: 8694636
Filing Date: 2014-04-08
Classification: G06F,H04L

Abstract:
1. A computing device for protecting an operating system from malicious attacks over a communications network, the computing device comprising: a memory; a network interface controller to receive a network packet from a communications network; a first virtual machine to execute a first operating system, the first operating system comprising (i) a native device driver to process the network packet received by the network interface controller and (ii) a protected filter driver loaded in the memory by the first virtual machine to intercept the network packet processed by the native device driver; and a second virtual machine to execute a second operating system, the second operating system comprising (i) a first security filter driver to receive the intercepted network packet from the protected filter driver, (ii) a network security module loaded in the memory by the second virtual machine, and (iii) a second security filter driver loaded in the memory by the second virtual machine, wherein the network security module to (i) receive, from the first security filter driver, the intercepted network packet first received by the first security filter driver, (ii) determine whether the intercepted network packet first received by the first security filter driver is malicious, and (iii) notify the first security filter driver that the intercepted network packet should be dropped in response to determining that the intercepted network packet is malicious, and wherein the second security filter driver to (i) receive the intercepted network packet first received by the first security filter driver in response to the network security module determining that the intercepted network packet is not malicious, (ii) determine whether the intercepted network packet is destined for the first operating system or the second operating system, (iii) notify the protected filter driver that the intercepted network packet should be forwarded up a network stack of the first operating system in response to determining that the intercepted network packet is destined for the first operating system, and (iv) forward the intercepted network packet up a network stack of the second operating system and notify the protected filter driver that the intercepted network packet should be dropped in response to determining that the intercepted network packet is destined for the second operating system.