Secure access to multiple isolated networks

Disclosed herein are devices, systems and methods for securely accessing data transferred via multiple isolated networks network, comprising adjusting one or more mapping records comprising network mapping and routing settings for a plurality of isolated networks connecting a plurality of clients to a server to expose one of the plurality of isolated networks to one or more processing engines executed by the server while concealing all other isolated networks from the respective processing engine, activating a lock configured to enable each processing engines to execute a single thread, executing the processing engine(s) to fetch data from the exposed isolated network(s), and releasing the lock. Wherein each processing engine is able to access the isolated network exposed to the respective processing engine while unable to access any of the isolated networks concealed from respective processing engine.

FIELD AND BACKGROUND OF THE INVENTION

The present invention, in some embodiments thereof, relates to securely accessing multiple isolated networks, and, more specifically, but not exclusively, to securely accessing multiple isolated networks without exposing them to each other by adjusting network mapping and routing settings to expose a single network at a time while concealing all other networks.

Networked services are constantly evolving for a plurality of applications, services and platforms ranging over practically every aspect of modern life. These networked services hence present multiple and ever increasing challenges for the underlying networks which become ever more complex.

However, since data may be transferred over open networks which are susceptible to interception, monitoring and/or eavesdropping, many of the networked services may suffer major privacy, security and/or integrity issues.

Various methods, technologies and protocols were devolved to address these vulnerabilities in the networked services. One such solution commonly applied to many client server applications, services and/or platforms comprises allocating isolated networks to connect different clients to the server.

Such isolated networks may include physical networks which are physically isolated from each other and/or virtual isolated networks, for example, Virtual Private Network (VPN) and/or the like established over the open network using one or more tunneling protocols.

SUMMARY OF THE INVENTION

An objective of the embodiments of the disclosure is to provide a solution which mitigates or solves the drawbacks and problems of conventional solutions. The above and further objectives are solved by the subject matter of the independent claims. Further advantageous embodiments can be found in the dependent claims. The disclosure aims at providing a solution for controlling and managing isolated networks to provide secure access and data retrieval from multiple isolated networks without exposing them to each other.

According to a first aspect of the present invention there is provided a computer implemented method of securely accessing data transferred via multiple isolated networks network, comprising using one or more processors of a server connected to a plurality of clients via a plurality of isolated networks for:Adjusting one or more mapping records comprising network mapping and routing settings for the plurality of isolated networks to expose one of the plurality of isolated networks to one or more processing engines executed by the one or more processors while concealing all other isolated networks from the respective processing engine.Activating a lock configured to enable each of the one or more processing engines to execute a single thread.Executing the one or more processing engines to fetch data from the exposed isolated network(s). Wherein each of the one or more processing engines is unable to access any of the isolated networks concealed to the respective processing engine.Releasing the lock.

According to a second aspect of the present invention there is provided a system for securely accessing data transferred via multiple isolated networks network, comprising one or more processors of a server connected to a plurality of clients via a plurality of isolated networks. The one or more processors is configured to execute a code. The code comprising:Code instructions to adjust one or more mapping record comprising network mapping and routing settings for the plurality of isolated networks to expose one of the plurality of isolated networks to one or more processing engine executed by the one or more processor while concealing all other isolated networks.Code instructions to activate a lock configured to enable the one or more processing engine to execute a single thread.Code instructions to execute the one or more processing engine to fetch data from the exposed isolated network. Wherein each of the one or more processing engines is unable to access any of the isolated networks concealed to the respective processing engine.Code instructions to release the lock.

In a further implementation form of the first and second aspects, one or more additional iterations are initiated to enable one or more of the processing engines to iterate over one or more additional isolated networks of the plurality of isolated networks. In each iteration a respective additional isolated network is exposed to one or more of the processing engines while all other isolated networks are concealed. Each iteration comprising:Adjusting the one or more mapping records to expose the respective additional isolated network to the one or more processing engines while concealing all other isolated networks from the respective processing engine.Activating the lock.Executing the one or more processing engines to fetch data from the respective additional isolated network(s).Releasing the lock.

In a further implementation form of the first and second aspects, the plurality of isolated networks are virtual private networks (VPNs).

In a further implementation form of the first and second aspects, each of the plurality of isolated networks is established according to one or more Layer 2 (L2) tunneling protocols.

In a further implementation form of the first and second aspects, adjusting the one or more mapping records is transparent to the one or more processing engine configured to access one or more of the isolated networks based on the one or more mapping records.

In a further implementation form of the first and second aspects, adjusting the one or more mapping records comprises adjusting U mapping and routing settings.

In a further implementation form of the first and second aspects, the one or more mapping records comprises namespace.

In a further implementation form of the first and second aspects, the one or more processing engines execute within respective containers.

In a further implementation form of the first and second aspects, one or more of the containers are Dockers.

In a further implementation form of the first and second aspects, the lock is controlled by one or more locking services of an operating system (OS) executed by the one or more processors.

DESCRIPTION OF SPECIFIC EMBODIMENTS OF THE INVENTION

The present invention, in some embodiments thereof, relates to securely accessing multiple isolated networks, and, more specifically, but not exclusively, to securely accessing multiple isolated networks without exposing them to each other by adjusting network mapping and routing settings to expose a single network at a time while concealing all other networks.

The present invention presents devices, systems and methods for controlling secure access of data processing engines executed by a server to a plurality of isolated networks connecting a plurality of client devices to the server without exposing any isolated network to any of the other isolated networks.

The plurality of client devices, for example, a computer, a server, a mobile device (e.g. Smartphone, tablet, etc.), a computing node and/or the like may be connected to the server via a plurality of respective isolated networks, either physically isolated networks and/or virtual isolated networks such as, for example, Virtual Private Networks (VPNs) such that no isolated channel and/or the data transmitted over it is accessible from any of the other isolated channels.

In particular, the isolated networks may be connected and controlled by one or more network controllers (network equipment), for example, a switch, a gateway, a router and/or the like of the server. The network controller(s) may include physical network equipment and/or virtual network controller, for example, a virtual switch such as, for example, OpenVPN, Open vSwitch (OVS) and/or the like.

The server which may comprise, for example, a server, a computing node, a cluster of computing nodes, a cloud computing service, system, platform and/or infrastructure and/or the like may execute one or more data processing engines, for example, an application, a service, an agent, a tool and/or the like which may need to access and fetch data from multiple isolated networks.

Each of the data processing engines may be typically executed in a respective container, for example, a Docker executed by the server in a virtualized execution environment such that the processing engines are separated and isolated from each other. As such, transfer of data between different processing engines may be strictly supervised, controlled, and optionally filtered and even completely prevented.

In order to prevent exposure of one isolated network to any of the other isolated networks, the network settings of the isolated networks may be dynamically adjusted in runtime to ensure that each data processing engine may be granted access to only a single isolated network at a time thus preventing a scenario in which two isolated networks are simultaneously accessible by a single data processing engine.

To this end, before a certain data processing engine is granted access to a certain isolated network, one or more mapping records, for example, a namespace, a Domain Name System (DNS) record, a routing table and/or the like may be adjusted in runtime to adjust their mapping and routing settings in order to expose the certain isolated network to the certain data processing engine thus enabling the certain data processing engine to access the certain isolated network and fetch data from it while concealing all of the other isolated networks and preventing access of the certain data processing engine to them. As result there can be no situation in which two isolated networks are simultaneously exposed to a single data processing engine and thus to each other.

While adjusting of the mapping record(s) may be done to adjust mapping and routing settings of one or more of the network layers, for example, Layer 2, Layer 3 and/or the like, the adjustment may be primarily directed to the L2 mapping and routing settings.

Moreover, adjusting the network mapping and routing settings may be done transparently to the processing engines and possibly transparently even to the network controllers which may be therefore unaware of any such adjustments and may simply use the network mapping and routing settings as they normally do oblivious to the adjustments.

Optionally, in the default and/or normal operation configuration, the mapping record(s) is configured to conceal all of the isolated networks to the data processing engine(s) such that the processing engine(s) are unable to access any of the isolated networks.

Moreover, in order to further ensure that each data processing engine may not be able to simultaneously access more than just one isolated network, prior to granting each data processing engine access to a certain isolated network, a lock may be initiated for the respective data processing engine. The lock which may be implemented using one or more lock mechanisms, services, tools and/or provisions configured to disable multi-thread processing for one or more processes and enable the respective process to execute only a single thread at a time.

Each locked processing engine may be therefore able to execute only a single thread at a time, specifically access the certain exposed isolated network and fetch data from it. Since it is unable to initiate additional threads, the locked processing engine may be unable to access and fetch data from any other isolated network thus further ensuring the isolation between the isolated networks.

Exposing only one isolated network at a time to each processing engine may present significant advantages and benefits compared to currently existing methods and systems configured to provide access to multiple isolated networks.

First, adjusting the mapping record(s) to expose only a single isolated network to each processing engine executed by the server may ensure that, since the processing engine is physically unable to access more than one isolated network at a time, there can be no situation in which the processing engine is able to access two different isolated networks and thus expose them to each other. This may significantly reduce complexity, cost, computing resources utilization and/or computing time of the processing engines and/or the execution environment of the server since there is no need for complex and resource consuming task level (i.e. processing engine level) security and/or protection measures as may be used by the existing methods.

Moreover, common deployments exist in which the processing engines may not be tolerable to adjustment of their network settings, i.e., their mapping and routing settings. For example, in case the processing engines are executed in containers, the containers may be unable to switch their mapping record(s), for example, namespace in runtime. Some of the existing methods may initiate complex applications to overcome this, for example, initiate multiple processing engine containers each capable of accessing a limited number of isolated networks which may communicate with each other, typically using complex source consuming security and/or protection measures, to share between them data collected from the different isolated networks. In contrast, adjusting the network settings, typically the L2 mapping and routing settings, in runtime, transparently to processing engine containers as done in the present invention may enable any single processing engine container to access multiple isolated networks without exposing the isolated networks to each other and thus not compromising privacy, security and/or safety of the isolated networks and/or the data transmitted over them.

Furthermore, simply adjusting the network settings as may be done by the existing methods may require re-initialization of the network controller(s) of the server, whether physical network controller(s) and/or virtual network controller(s). On the other hand, dynamically adjusting the network settings, typically the L2 mapping and routing settings, in runtime, as done in the present invention may be transparent to the network controller(s) (e.g. switch, gateway. Etc.) which may therefore uninterruptedly continue to control, manage and route packets between the isolated networks according to the adjusted network settings.

In addition, locking each processing engine accessing an isolated network to execute only a single thread may limit the processing engine to access only one isolated network at a time by preventing it from initiating additional threads which may be potentially executed to access additional isolated networks.

Referring now to the figures,FIG.1is a flow chart of an exemplary process of securely accessing isolated networks by adjusting network mapping and routing settings to expose a single network at a time while concealing all other networks, according to some embodiments of the present invention.

An exemplary process100may be executed by server serving a plurality of client devices each connected to the server via a respective isolated network (links), either physical networks and/or virtual networks, to preserve security, safety and/or privacy of the data transferred between each client device and the server.

One or more data processing engines, for example, an application, a service, an agent, a tool and/or the like may need to fetch data from multiple networks of the plurality of isolated networks and may therefore need to access multiple isolated networks.

However, while several isolated networks need to be accessed, the isolation of each isolated network must be ensured to prevent potential data leak and/or exposure to cyberattack vectors from one isolated network to another.

Each processing engine may be therefore configured, adapted and/or operated to access only a single isolated network at a time. Moreover, at any given time only one of the plurality of isolated networks may be exposed to each processing engine while all other isolated networks are concealed and thus inaccessible to the respective processing engine.

Moreover, one or more mechanism may be applied to execute each processing engine in a locked mode which enables the processing engine to execute a single thread thus limiting the processing engine to access a single isolated network.

As such, while a plurality of processing engines may be executed by the server optionally simultaneously, each processing engine may be capable of “seeing” and accessing only a single isolated network at a time.

Reference is also made toFIG.2A,FIG.2BandFIG.2C, which are schematic illustrations of exemplary networked systems for securely accessing isolated networks by adjusting network mapping and routing settings to expose a single network at a time while concealing all other networks, according to some embodiments of the present invention.

The first networked environment200A may comprise a plurality of client devices202, for example, a computer, a server, a mobile device (e.g. Smartphone, tablet, etc.), a computing node and/or the like configured and/or operated to access a server204providing one or more services to a plurality of client devices202.

The server204may include, for example, a server, a computing node, a cluster of computing nodes and/or the like. However, the server204may further include one or more cloud computing services, systems, platforms and/or infrastructures, for example, an Infrastructure as a Service (IaaS), a Platform as a Service (PaaS), a Software as a Service (SaaS) and/or the like such as, for example, Amazon Web Service (AWS), Google Cloud, Microsoft Azure and/or the like.

Each of the plurality of client devices202may communicate with the server204via a dedicated isolated network208A, for example, a Local Area Network (LAN), a Wide Area Network (WAN) and/or the like connected to a network controller206A (network equipment) of the server204, for example, gateway, a router, a switch, and/or the like. For example, a first client device202may connect to the network controller206A via a first isolated network208A, a second client device202may connect to the network controller206A via a second isolated network208A and so on to a Nthclient device202which may connect to the network controller206A via a Nthisolated network208A.

The network controller206A may be deployed and/or implemented as a separate module or it may be integrated with the server204. Moreover, for brevity only a single network controller206A is described herein after. This, however, should not be construed as limiting since a plurality of network controller206A may be deployed in one or more structures, architectures, hierarchies and/or arrangements as known in the art to support the plurality of networks208connecting to the plurality of client devices202and to the server204.

However, while one or more of the client devices202may connect and communicate with the server204via the isolated physical networks208A, one or more of the client devices202may typically establish a virtual isolated network (link)208B with the server204as seen in the second exemplary networked environment200B.

Specifically, one or more of the client devices202may establish respective isolated virtual networks208B with one or more virtual network controllers206B connecting to the server204over a shared physical network210comprising one or more wired and/or wireless networks, for example, a LAN, a Wireless LAN (WLAN, e.g. Wi-Fi), a WAN, a Metropolitan Area Network (MAN), a cellular network, the internet and/or the like.

For example, a first client device202may connect to the virtual network controller206B via a first virtual isolated network208B, a second client device202may connect to the virtual network controller206B via a second virtual isolated network208B and so on to a Nthclient device202which may connect to the virtual network controller206B via a Nthvirtual isolated network208B.

The virtual network controller206B comprising one or more virtual switches, for example, an OpenVPN, an Open vSwitch (OVS) and/or the like may be configured to establish one or more virtual isolated networks208B, for example, Virtual Private Network (VPN) and/or the like with receptive client devices202. The virtual network controller206B which may be implemented as a separate module or integrated with the server204may be configured to create, establish, control and/or manage a respective virtual isolated network208B, for example, a VPN link with each of one or more of the client devices202.

For example, the virtual network controller206B may create, establish, control and/or manage the virtual isolated networks208B according to one or more tunneling protocols as known in the art. The tunneling protocols may include one or more Layer 2 (L2) tunneling protocols (L2TP). However, the tunneling protocols may further include one or more Layer 3 (L3) tunneling protocols as known in the art, for example, Generic Routing Encapsulation (GRE), Virtual Extensible Local Area Network (VXLAN), Secure Socket Tunneling Protocol (SSTP), Internet Protocol Security (IPSec), IP in IP (IP in IPv4/IPv6), SIT/IPv6 (IPv6 in IPv4/IPv6), OpenVPN and/or the like.

As described for the network controller206A, the virtual network controller206B may be deployed and/or implemented as a separate module executed by a separate hardware and/or software system or it may be integrated with the server204. Moreover, similarly to the network controller206A, while only a single virtual network controller206B is described herein after, it should not be construed as limiting since a plurality of virtual network controllers206A may be deployed in a plurality of deployments as may become apparent to a person skilled in the art to support connection to the plurality of networks208connecting the plurality of client devices202and the server204.

Furthermore, the plurality of client devices202may optionally connect to the server204via a combination of one or more physical network controllers such as the network controller206A and one or more virtual network controllers such as the virtual network controller206B.

As known in the art, the physical network controller206A and the virtual network controller206B may employ similar mechanisms, algorithms, protocols and/or the like for mapping and routing the network nodes connected to them, namely the plurality of client devices202and the server204regardless of whether they are connected via isolated physical networks208or via virtual isolated networks. Therefore, for brevity, the physical network controller206A and the virtual network controller206B are commonly designated the network controller206. Complementary, the term isolated networks208is used herein after to include both physical isolated networks208A and/or virtual isolated networks208B.

The network controller206may employ one or more mapping and routing mechanisms, protocols, structures and/or the like for mapping the plurality of client devices202and routing (data) packets between the isolated networks208. Specifically, the network controller206map the client devices202and route packets between them and the server204and optionally among themselves using one or more mapping and/or routing records, collectively designated mapping records herein after, comprising mapping and/or routing settings expressing network mapping information relating to the client devices202and/or routing rules for routing packets between the isolated networks208and the server204.

The mapping records may include, for example, namespace and/or the like which may uniquely map each networked resource in the network environment200, for example, the client devices202, the isolated networks208, the server204and/or the like with a unique identifier. In another example, the mapping records may include one or more Domain Name system (DNS) records comprising identification and/or mapping information relating to the networked resource in the network environment200, for example, the client devices202, the isolated networks208, the server204and/or the like. In another example, the mapping records may include one or more routing tables as known in the art which comprise routing information and/or routing rules for routing the packets between the isolated networks208and the server204and optionally between one or more of the isolated networks208.

While the mapping record(s) may relate to L3 mapping of the networked resource (e.g. client devices202, isolated networks208, etc.) and/or L3 routing of the data packet, the mapping record(s) may primarily relate to L2 mapping of the networked resource in the network environment200, for example, the client devices202, the isolated networks208, the server204and/or the like and L2 routing of the packets between the isolated networks208.

The server204may execute one or more data processing engines220configured to access one or more of the isolated networks established with the client devices202and fetch data from these networks.

The server204may further execute a network access manager222to manage access of the processing engine(s) to the isolated networks in order to ensure isolation of the networks and thus ensure privacy, security and/or safety of the isolated networks and the data exchanged in them.

As seen inFIG.2C, each client device202may comprise a processor(s)230, a storage232for storing data and/or code (program store), and a network interface234for connecting to the network208.

One or more of the client devices202may further include an Input/Output (I/O) interface for connecting to one or more external and/or attachable devices. Optionally, one or more of the client devices202may also include a user interface comprising one or more Human Machine Interfaces (HMI) for interacting with respective users.

The network interface234may include one or more wired and/or wireless network interfaces for connecting to the network208, for example, a LAN interface, a WLAN interface, a WAN interface, a MAN interface, a cellular interface and/or the like.

The processor(s)230, homogenous or heterogeneous, may include one or more processing nodes and/or cores arranged for parallel processing, as clusters and/or as one or more multi core processor(s). The storage232may include one or more non-transitory persistent storage devices, for example, a Read Only Memory (ROM), a Flash array, a Solid State Drive (SSD), a hard drive (HDD) and/or the like. The storage232may also include one or more volatile devices, for example, a Random Access Memory (RAM) component, a cache and/or the like.

The processor(s)230may execute one or more software modules such as, for example, a process, a script, an application, an agent, a utility, a tool, an Operating System (OS) and/or the like each comprising a plurality of program instructions stored in a non-transitory medium (program store) such as the storage232and executed by one or more processors such as the processor(s)230.

The processor(s)230may further, integrate, utilize and/or facilitate one or more hardware elements (modules) integrated and/or utilized in the client device202, for example, a circuit, a component, an Integrated Circuit (IC), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), a Digital Signals Processor (DSP), a Graphic Processing Unit (GPU) and/or the like.

The processor(s)230may therefore execute one or more functional modules implemented using one or more software modules, one or more of the hardware modules and/or combination thereof, for example, a web browser, a local agent, an access application and/or the like for connecting and communicating with the server204to access one or more of the services provided by the server204.

Moreover, in case of the client device202establishes a virtual network (link) with the server204, specifically with the virtual network controller206B of the sever204, the client device202may further execute one or more functional modules for establishing the virtual network via the network interface234over the network208.

The server204may comprise a processor(s)240such as the processor(s)230for executing the process100, a storage242for storing data and/or code (program store), and a network interface244such as the network interface234for connecting to the network208, in particular to the network controller206A and/or to the virtual network controller206B.

The processor(s)240, homogenous or heterogeneous, may include one or more processing nodes and/or cores arranged for parallel processing, as clusters and/or as one or more multi core processor(s). As described for the storage232, the storage242may include one or more non-transitory persistent storage devices as well as one or more volatile devices. The storage242may further comprise one or more network storage devices, for example, a storage server, a Network Accessible Storage (NAS), a network drive, a database server and/or the like accessible through the network interface244.

The processor(s)240may further, integrate, utilize and/or facilitate one or more hardware elements (modules) integrated and/or utilized in server204, for example, a circuit, a component, an IC, an ASIC, an FPGA, a DSP, a GPU, an Artificial Intelligence (AI) accelerator and/or the like.

The processor(s)240may therefore execute one or more functional modules implemented using one or more software modules, one or more of the hardware modules and/or combination thereof, for example, the one or more (data) processing engines220and the network access manager222.

Optionally, the processor(s)230are configured and/or operated to apply virtualization such that each of the processing engines220is isolated from the other processing engines220. For example, one or more of the processing engines220may be executed in the context of respective isolated containers, for example, a Docker and/or the like comprising all required functional and/or software modules thus eliminating their need for external services and maintaining their isolation.

For brevity, the process100is described for a single data processing engine220accessing and fetching data from multiple isolated networks208. This however, should not be construed as limiting, since the process100may be expanded to a plurality of data processing engine220each accessing and fetching data from at least some of the isolated networks208. However, while multiple data processing engine220may access multiple isolated networks208, at any given time only one isolated network208may be exposed and accessible to each processing engine220.

As shown at102, the network access manager222may receive a request from the processing engine220to access a certain one of the isolated networks208, for example, a first isolated network208and fetch data from it.

As shown in104, in response to the request, the network access manager222may adjust one or more of the mapping records used to map the networked resource at the server204, for example, the client devices202, the isolated networks208and/or the like.

Specifically, the network access manager222may adjust the mapping record(s) to expose the first isolated network208to the processing engine220while concealing all other isolated networks208from the processing engine220such that the processing engine220is able to access the first isolated network208while unable to access to all other isolated networks208.

Typically, the network access manager222may adjust L2 mapping record(s) comprising mapping and routing settings defining L2 mapping of the isolated networks208and/or the client devices202and L2 routing rules. Adjusting the L2 mapping and routing settings may be highly efficient, effective and/or robust compared to the mapping and routing settings in other layers, for example, L3, since address resolution including packet source/destination address resolution and routing may be done beneath the network controller206thus avoiding manipulation of the network controller206. Rather, the network controller206may use the adjusted mapping record(s) normally oblivious to the adjustment(s).

Moreover, the network access manager222may adjust the mapping record(s) transparently to the processing engine220such that the processing engine220may be unaware of the adjustment of its network mapping and routing settings. This may be of particular benefit in case the processing engine220is executed as a Docker since Dockers are unable to switch their mapping record(s) in runtime. Therefore, adjusting, in runtime and transparently to the processing engine220Docker, the single mapping record(s) used by the processing engine220Docker, may enable manipulation of the mapping and routing settings of the processing engine220Docker without affecting its normal operation.

The network access manager222may use and/or apply one or more methods, tools, and/or services to adjust the mapping record(s).

For example, assuming the processing engine220is executed as a Docker and further assuming the isolated networks208are virtual isolated networks208B, for example, VPN links controlled by the network controller206implemented by a virtual network controller206B, for example, OpenVPN executed at the server204. In such case, the network access manager222may adjust the mapping record(s), for example, the namespace using one or more services and/or tools available in the execution environment of the server204, for example, net_admin in Linux or equivalent services and/or tools in other execution environments or operating systems. As result, the virtual network controller206B, specifically the OpenVPN using the namespace may expose the first isolated network208to the processing engine220Docker while concealing all other isolated networks208.

In another example, assuming the isolated networks208are physical isolated networks208A controlled by the network controller206implemented by a physical network controller206A. In such case, the network access manager222may adjust one or more of the mapping record(s), for example, the routing table used by physical network controller206B to map the isolated networks208A and route packets to and/or from the isolated networks208A to and/or from the server204. As result, the first isolated network may be exposed and accessible to the processing engine220while all other isolated networks208A are concealed and inaccessible to the processing engine220.

In another example, the network access manager222may adjust the mapping record(s), for example, the routing table to enable passing of all non-internal program and/or IaaS traffic through the destination isolated network208. Moreover, the network access manager222may further adjust the mapping record(s), for example, the default iptables rules to only allow established connections in the INPUT table thus preventing the isolated networks208from initiating requests back to the SaaS infrastructure. Furthermore, the network access manager222may adjust one or more default network routing rules to allow forwarding of packets through the server204serving as a forwarder while masquerading the packet required by the processing engine220from the accessed isolated network208.

As shown at106, a lock may be activated, optionally by the network access manager222to enable the processing engine220to execute a single thread, for example, access and fetch data from a single isolated network208.

The lock may be implemented using one or more lock mechanisms, services and/or provisions provided by the execution environment, for example, the operating system which are configured to disable multi-thread processing for one or more processes and enable each process to execute only a single thread at a time. For example, a reentrant lock such as, for example, RLock( ) may be applied to the processing engine220to enable simultaneous access of the current thread (of the processing engine220) to one or more specific areas of code. In another example, one or more resource access restriction locks, for example, a mutex, a semaphore and/or the like may be used to prevent the current thread (of the processing engine220) from accessing one or more specific areas of code.

Optionally, the lock mechanism(s) may be applied to selectively prevent access of the thread of the processing engine220to certain code areas. For example, the lock may be applied to prevent the processing engine220from accessing (and executing) one or more code areas comprising code relating to communications with the isolated networks208while one or more other parts of the code which do not relate to the isolated networks208may remain unlocked and thus executable by the processing engine220.

The lock may be therefore applied to disable multi-thread processing for the processing engine220and enable the processing engine220to execute only a single thread, for example, access and fetch data from the first isolated network208.

As shown at108, the processing engine220may access the exposed isolated network208, namely the first isolated network208to fetch data from it.

Since only the first isolated network208is exposed to the processing engine220, the processing engine220may access and fetch data only from the exposed first isolated network208while unable to access any of the other isolated networks208which are concealed from the processing engine220.

Moreover, since the lock is activated for the processing engine220, the processing engine220may execute a single thread, specifically, access and fetch data from the first isolated network208while unable to execute additional thread(s) for accessing one or more other isolated networks208.

As shown at110, the lock may be released for the processing engine220to enable it to resume normal multi-thread execution.

As shown at112, the processing engine220may issue another request to the network access manager222to access and fetch data from another one of the isolated networks208, for example, a second isolated network208.

As shown at114, in response to the request, the network access manager222may adjust the mapping record(s) as described at104to expose the second isolated network208to the processing engine220while concealing all other isolated networks208from the processing engine220such that access to the second isolated network208is enabled for the processing engine220while its access to all other isolated networks208is disabled.

As shown at116, the lock may be activated again, optionally by the network access manager222to once again enable the processing engine220to execute only a single thread, for example, access and fetch data from a single isolated network208.

As shown at118, the processing engine220may access the other exposed isolated network208, namely the second isolated network208to fetch data from it.

Since only the second isolated network208is exposed to the processing engine220, the processing engine220may access and fetch data only from the exposed second isolated network208while unable to access any of the other isolated networks208which are concealed from the processing engine220.

Moreover, since the lock is activated for the processing engine220, the processing engine220may execute a single thread, specifically, access and fetch data from the second isolated network208while unable to execute additional thread(s) for accessing one or more other isolated networks208.

As shown at120, the lock may be released for the processing engine220to enable it to resume normal multi-thread execution.

As seen, one or more additional iterations of the process100may be initiated, specifically steps112-120, typically in response to request(s) from the processing engine220to iterate over one or more additional isolated networks208in order to access them and fetch data from them.

In each such iteration initiated to enable the processing engine220to access and fetch data from a respective isolated networks208, the network access manager222may adjust the mapping record(s) to expose the respective isolated network208to the processing engine220while concealing all other isolated networks208from the processing engine220thus preventing the processing engine220from accessing the other isolated networks208. The lock may be then activated to enable the processing engine220to execute only a single thread for accessing only the respective isolated data208and fetch data from it. Finally, after the processing engine220fetches the data from the respective isolated data208, the lock may be released for the processing engine220to enable it to resume normal multi-thread execution.

Optionally, in its default configuration, the mapping record(s) is configured to conceal all of the isolated networks208to the data processing engine220such that the processing engine220is unable to access any of the isolated networks208. As such, the processing engine220may access one of the isolated networks220only after the network access manager222, in response to a request, adjusts the mapping record(s) to expose the requested isolated network208to the processing engine220specifically while concealing all other isolated networks208.

It is expected that during the life of a patent maturing from this application many relevant systems, methods and computer programs will be developed and the scope of the terms virtual networking, VPN, tunneling protocols, virtual node and virtual switch are intended to include all such new technologies a priori.

As used herein the term “about” refers to ±10%.

The word “exemplary” is used herein to mean “serving as an example, an instance or an illustration”. Any embodiment described as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments and/or to exclude the incorporation of features from other embodiments.

The word “exemplary” is used herein to mean “serving as an example, an instance or an illustration”. Any embodiment described as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments and/or to exclude the incorporation of features from other embodiments.