Patent ID: 8166474
Filing Date: 2012-04-24
Classification: G06F

Abstract:
1. A computer system implementing a virtualization framework that supports execution of multiple virtual machines secured with respect to network communications between the virtual machines and as between the virtual machines and a physical network coupled to said computer system, said computer system comprising: a memory that provides a program execution space; a processor coupled to said memory to execute a program within said program execution space; a network interface controller coupled to said processor and coupleable to a communications network; and a virtualization framework provided within said program execution space for execution by said processor, wherein said virtualization framework includes a network interface controller driver that provides an interface to said network interface controller and wherein said virtualization framework includes a plurality of virtual machines, wherein each of said virtual machines include a virtual network interface controller and wherein each of said virtual network interface controllers includes a network packet filter, wherein each of said network packet filters, when executed by said processor, selectively filters network packets with respect to a corresponding one of said virtual machines such that a network packet that includes destination information associated with a particular destination is blocked by at least one of said network packet filters from arriving at the particular destination; wherein each of said network packet filters is initialized with predetermined configuration data through the execution of said virtualization framework prior to an initial execution of said plurality of virtual machines; a data store providing for a persistent storage of a packet filter configuration data file, wherein execution of said virtualization framework provides for a secure storage and retrieval of said packet filter configuration data file, and wherein said packet filter configuration data file contains said predetermined configuration data.