Patent ID: 8458785
Filing Date: 2013-06-04
Classification: G06F,H04L

Abstract:
1. An information security protection host, comprising: a network interface, connecting to a computer network and being configured to receive a first packet and a second packet; and a virtual machine monitor (VMM) device, connecting to the network interface and being configured to run a first operating system, a second operating system and a security system, wherein the first operating system provides a first network service, the second operating system provides a second network service, the security system is configured to provide a plurality of verification rules and the VMM device is further configured to provide in real time a piece of first operating system information of the first operating system, a piece of first network service information of the first network service, a piece of second operating system information of the second operating system and a piece of second network service information of the second network service; wherein the first network service information comprises a first service port number, and when the first packet is received by the network interface via a port, the VMM device further, according to the first operating system information or the first network service information, determines that the first packet is associated with the first operating system and a port number of the port is unequal to the first service port number so as to filter out the first packet; wherein the second network service information comprises a second service port number, and when the second packet is received by the network interface via another port, the VMM device further, according to the second operating system information or the second network service information, determines that the second packet is associated with the second operating system and a port number of the another port is unequal to the second service port number so as to filter out the second packet; wherein the VMM device further provides the first operating system information and the first network service information to the security system in real time so that the security system chooses a first set of verification rules from the verification rules according to the first operating system information or the first network service information, and when the VMM device, according to the first operating system information or the first network service information, determines that the first packet is associated with the first operating system and the port number of the port is equal to the first service port number, the first set of verification rules is applied to verify the first packet; and wherein the VMM device further provides the second operating system information and the second network service information to the security system in real time so that the security system chooses a second set of verification rules from the verification rules according to the second operating system information or the second network service information, and when the VMM device, according to the second operating system information or the second network service information, determines that the second packet is associated with the second operating system and the sort number of the another port is equal to the second service sort number the second set of verification rules is applied to verify the second packet.