Systems involving firewall of virtual machine traffic and methods of processing information associated with same

Systems and methods involve compute nodes configured to define and/or otherwise process information associated with one or more virtual machines. In one exemplary implementation, a compute node may be configured to enable a firewall between the virtual machine and at least a portion of a network. Moreover, the firewall may be configured to detect undesired traffic based on a list of rules or an Ethernet bridge table associated with communication between the virtual machine and the network. Various features may also relate to the compute node being configured to lock the virtual machine in response to the firewall detecting undesired traffic associated with the virtual machine.

FIELD

The present disclosure is directed generally to systems and methods involving firewall of virtual machine traffic.

DETAILED DESCRIPTION OF ILLUSTRATIVE IMPLEMENTATIONS

Reference will now be made in detail to the inventions herein, examples of which are illustrated in the accompanying drawings. The implementations set forth in the following description do not represent all implementations consistent with the claimed inventions. Instead, they are merely some examples consistent with certain aspects related to the present innovations. Wherever possible, the same reference numbers will be used throughout the drawings to refer to the same or like parts.

According to aspects of the present innovations, systems herein may relate to an apparatus including a compute node configured to define and/or perform processing in connection with a virtual machine. The compute node may be configured to enable a firewall between the virtual machine and at least a portion of a network. The firewall may be configured, for example, to detect undesired traffic such as malicious or spoof attacks based on rules such as an in Ethernet bridge table associated with communication between the virtual machine and the at least a portion of the network. As used herein, Ethernet bridge tables (or ebtable) comprise one or more firewall processes, components and/or list of rules which apply a set of configurable rules to inspect, modify, re-route, discard, or otherwise inspect and/or modify the traffic which is being transferred at the data link layer of the networking stack. Such modification and inspection may include changes which affect the higher layers of the networking stack, such as the higher layers routing, source and/or target addresses or any other packet contents as they are exchanged on the network or received or transmitted to or from any network in the system. While the above may be performed via an ‘Ethernet bridge table’ per se, other implementations herein may perform such processing via a more generic ‘list of rules’. After such detection, in some implementations, the compute node may be configured to lock the virtual machine in response to the firewall detecting a spoof attack by the virtual machine.

According to other aspects of the present innovations, methods herein may relate to processing information regarding compute nodes and associated firewalls configured to detect and prevent undesired traffic involving one or more networks.

As set forth below, virtual machine firewall systems and methods herein may be utilized to lock a virtual machine and/or stop or block traffic from a virtual machine to a network.FIG. 1depicts a block diagram of an illustrative virtual machine firewall system100. System100includes a compute node110including a virtual machine120, a virtual machine120′, a firewall132, and an Ethernet bridge table134, a switch130, a compute node110′, a network140, a network administrator component150, and a management component160. According to implementations herein, compute node110may be configured to define virtual machine120and to enable the firewall132.

Compute node110may be any type of device configured to send data within network140and/or out of network140, and/or receive data from within network140and/or out of network140. In some implementations, compute node110may be configured to function as, for example, a virtual machine host, a server device (e.g., a web server device), a network management device, a data repository and/or the like. Compute node110is configured to add, remove, lock, revise and/or edit a virtual machine and/or a firewall based on a command, instruction, and/or other indication received from a another compute node, a network administrator device150, or a firewall and/or switch130. Specifically, compute node110may be configured to define virtual machine120based on a command from, for example a network administrator device150. Compute node110may enable and or define firewall132on switch130, or may instruct switch130to enable, and/or otherwise define firewall132. Compute node110includes a physical port122configured to operatively couple compute node110to switch130. Physical port122may include any number of virtual ports to operatively couple components of compute node110to switch130. In such implementations, firewall132may be operatively coupled to switch130via a virtual port of physical port122.

Consistent with various implementations herein, compute node110may include at least one memory136A, one or more processors/processing elements138A, and/or other components142A. The memory136A may be, for example, a random access memory (RAM), a memory buffer, a hard drive, a database, an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), a read-only memory (ROM) and/or so forth. In some implementations, the memory136A of compute node110includes data used to define virtual machine and or enable firewalls. In some implementations, the memory stores instructions to cause the processor to execute modules, processes and/or functions associated with system100.

The processor(s)138A of compute node110may be any suitable processing device configured to run and/or execute system100. In some implementations, such a processor may be a general purpose processor, a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), and/or the like. Further, the processor may be configured to execute modules, functions and/or processes to operate system100.

In some implementations, compute node110and compute node110′ may operate software and/or hardware elements configured to define a manager-agent relationship. In such implementations, compute node110′ may operate manager software and/or hardware, such as, for example, a program configured to enable a customer, a network administrator150and/or other management component160to request and/or provision virtual machines within network140. In those implementations, compute node110may operate agent software and/or hardware, such as, for example, a program configured to enable a compute node to define virtual machine, firewalls, tables, etc. Such elements may be embodied via other components142A or be distributed in and/or among various other locations in the system. Alternately, entities such as a network administrator150, a management component160and the like located beyond the network may be configured to perform (or process information related to performing) the various management or other innovative features set forth herein, either in the context of such manager-agent relationship or otherwise.

Referring to the illustrative system ofFIG. 1, compute node110is operatively coupled to switch130. Switch130may be configured to couple compute node110to one or more other compute nodes and/or communication devices within network140, and/or to couple compute node110to one or more compute nodes and/or communication devices within another network. In such manner, switch130may be configured to operatively couple virtual machine120to other virtual machines disposed on any number of other compute nodes and/or communication devices within network140or within another network. Switch130may include a physical port136configured to operatively couple compute node110to switch130, and may include a virtual port (not shown) configured to couple components of compute node110, for example virtual machine120, via a firewall132to the switch130.

Compute node110includes one or more Ethernet bridge table(s)134. Here, for example, an Ethernet bridge table134may include forwarding data associated with communication between compute node110, and virtual machine120, and other compute nodes, and virtual machine associate with those compute nodes, operatively coupled to switch130via a physical port and/or virtual port. In some implementations, Ethernet bridge table134may be defined and/or populated by, for example, snooping on flood traffic within network140. In some implementations, compute node110may include a software-based bridge and/or switch that may be configured to include or access Ethernet bridge table134. In such implementations, the bridge and/or switch may be configured to forward, but not route, packets.

Compute node110may also include some or all of the firewall132. Further, here, firewall132may be a combination of hardware and/or software (e.g., stored in memory and/or executing on a processor) configured to (1) monitor traffic through switch130, (2) detect undesired traffic such as malicious traffic, spoof attacks, misconfigured or failing virtual machines, etc. and/or (3) block traffic from a source and/or to a destination in accordance with Ethernet bridge table134. As used herein, undesired traffic refers to traffic that is to be disallowed for one or more reasons such as that the traffic is malicious (e.g., spoof attacks, etc.) and/or is a result of virtual machines that are misconfigure, failing or malfunctioning. Examples of the latter include, among other things, overly chatty logging systems, disallowed protocols such as bit-torrent, and misconfigured virtual machines that are sending invalid packets or flooding the network.

Firewall132may be a stateless firewall, for example a firewall that does not maintain state information during an active session. Firewall132may also be configured to lock virtual machine120automatically in response to a detected undesired traffic from virtual machine120, and/or may be configured to lock virtual machine120in response to a command from compute node110in response to a detected attack from virtual machine120. According to various implementations of the present inventions, firewall132may be configured to detect various specific malicious traffic, for example, media access control (MAC) spoofing, internet protocol (IP) address spoofing, dynamic host configuration protocol (DHCP) spoofing, rogue DHCP servers, address resolution protocol (ARP) spoofing, ARP poisoning, and other related attacks. The process of defining firewall132may include defining Ethernet bridge table134such that only packets sent from the media access control (MAC) address of the virtual machine are allowed, in addition to broadcast packets. Firewall132may be configured to allow, for example, DHCP requests and virtual machine responses, and may be configured to drop and or otherwise block DHCP requests from the virtual machine. Firewall132may be configured to inspect DHCP packet headers to determine whether the address of the DHCP packet is valid. Firewall132may be configured to lock Ethernet bridge table134to only deliver packets to and from IP address associated with a valid DHCP address. In such implementations, firewall132may lock Ethernet bridge table134to only forward ARP packets from that IP address.

In various innovations herein, firewall132may be configured to monitor and/or otherwise filter traffic at the link layer, i.e. layer-2. According to some implementations, for example, firewall132may monitor and/or otherwise filter virtual machine traffic during forwarding, but prior to routing. In this manner, undesired traffic such as malicious attack traffic may be discarded at the virtual hardware level (e.g. the virtual machine level) prior to such traffic reaching switch130, or even another virtual machine within compute node110, such as virtual machine120′. Firewall132may monitor and/or otherwise filter traffic at the link layer, e.g., prior to routing using link layer information, such as MAC address, or using other information, such as IP address, DHCP address, etc. by performing, for example, deep packet inspection. Firewall132may be configured to monitor traffic using a packet capture mechanism, such as, for example, a Linux Kernal pcap.

According to some implementations, switch130may comprise one or more memory136B, processor138B and/or other components142B operable in connection or involved with the features and functionality set forth herein. Here, for example, such processor(s)138B and memory136B of switch130may be substantially similar to the processor and the memory of compute node110, described above. In some implementations, the processor138B of switch130may be configured to forward data, (e.g., data packets, cells, etc.), from the compute node110and/or the virtual machine120via the physical port and/or the virtual port to another compute node, other switch and/or network, and/or virtual machine via another physical port and/or virtual port. In such implementations, the processor138B of switch130may reference Ethernet bridge table134that may be stored in the memory136B of switch130. The processor138B of switch130may be configured to execute modules, functions and/or processes to forward data, define tables, and/or define and/or enable firewalls. The memory of switch130may store instructions to cause the processor to execute modules, processes and/or functions associated with switch130.

FIG. 2depicts a flow chart of one method200of operation consistent with the system100depicted inFIG. 1. Referring to the exemplary implementation ofFIG. 2, an illustrative method200may comprise defining a virtual machine, at202. In some implementations, the compute node110may receive instruction(s) from one or more of a network administrator device150, another compute node (110′ or other), a management component160, or the like, and in response to the instruction, define the virtual machine120. Turning back toFIG. 2, the illustrated method200may then comprise enabling a firewall between the virtual machine and at least a portion of a network, the firewall configured to detect undesired traffic based on an Ethernet bridge table associated with communication between the virtual machine and the at least a portion of the network, at204. In some implementations, compute node110may send an instruction to switch130to define and/or otherwise enable firewall132. In such implementations, firewall132may be disposed logically between virtual machine120and other portions of network140and may detect undesired traffic and/or malicious attacks from virtual machine120based on Ethernet bridge table134. InFIG. 2, the method200then comprises locking the virtual machine in response to the firewall detecting undesired traffic by the virtual machine, at206. In some implementations, compute node110may receive an indication from the switch130and/or the firewall132that undesired traffic was detected from virtual machine120, and may send an instruction to switch130and/or firewall132to lock virtual machine120. In other implementations, switch130and/or firewall132may automatically lock virtual machine120, and/or otherwise block traffic from firewall132when undesired traffic is detected.

FIG. 3is a flow chart depicting another method of operating a virtual machine firewall system, according to a disclosed implementation. InFIG. 3, as with other methods herein, processing related to performance of the method steps may be performed by among one or more of the various entities within the system. For example, the method steps or processing related thereto may be performed by one or more computer nodes110,110′, one or more switches130, one or more network administrator components150, and/or one or more management components160. According to the exemplary implementation shown inFIG. 3, an illustrative method may comprise processing information related to enabling or defining one or more virtual machines302, processing information related to enabling or defining a firewall between one or more virtual machines and a network, the firewall configured to detect undesired traffic based on an Ethernet bridge table304, and processing information related to locking/stopping/blocking a virtual machine in response to detection of the undesired traffic306.

FIG. 4is a flow chart depicting a further method of operating a virtual machine firewall system, according to a disclosed implementation. InFIG. 4, as with other figures and processes herein, processing related to performance of the method steps may be performed by among one or more of the various entities within the system. For example, the method steps or processing related thereto may be performed by one or more computer nodes110,110′, one or more switches130, one or more network administrator components150, and/or one or more management components160. According to the exemplary implementation shown inFIG. 4, another illustrative method may comprise processing information related to enabling or defining one or more virtual machines402, processing information related to enable a firewall between one or more virtual machines and a network, wherein the firewall is configured to detect undesired traffic based on an Ethernet bridge table and monitor/filter traffic at the link layer (layer 2)404, and processing information related to locking/stopping/blocking a virtual machine in response to detection of the undesired traffic406.

With regard to the monitoring/filtering of traffic, the firewall may be configured to monitor and/or otherwise filter traffic at the link layer (layer-2 or the data link layer, as set forth in the OSI model), such that the firewall may monitor and/or otherwise filter virtual machine traffic during forwarding, but prior to routing. Such monitoring and filtering at layer 2 prior to routing allows implementations herein to drop undesired or malicious traffic before it is received by any other network peers, such as compute nodes110′,110′, switches130, or any other device attached, for example, to node122or network140. Other benefits are achieved via such processing at the lowest level of communication above the actual physical links, where data is switched between peers on the same physical network, occurring below the TCP/IP networking layer. For example, layer 2 is inherently stateless, which means that implementations herein do not have to store/process details from packet to packet in order to maintain communications. Accordingly, these implementations do not need to maintain records of previous traffic in the same way as layer 3 communications must include recordation. Further, layer 2 packets may also be inspected to monitor their layer 3 contents, without needing to maintain state information, i.e., checking the headers to see the type of packet or the packet's source or destination. As such, undesired traffic may be advantageously discarded at the virtual hardware/machine level prior to the such traffic reaching a switch or another virtual machine within the compute node.

FIG. 5is a flow chart depicting still another method of operating a virtual machine firewall system, according to a disclosed implementation. According to the exemplary implementation shown inFIG. 5, another illustrative method may first comprise an optional step of processing information regarding enabling or defining one or more virtual machines502. Here, for example, while a compute node110,110′ may perform processing of such information in connection with the innovations herein, this initial processing (like other features and functionality herein) may also be previously performed and/or even by performed various other components such as a network administrator150, a management component160, etc. Turning back toFIG. 5, the method may then comprise processing information to enable a firewall between one or more virtual machines and a network, wherein the firewall is configured to detect undesired traffic based on an Ethernet bridge table504, followed by processing information regarding detection, via the firewall, of undesired traffic, the firewall monitoring/filtering traffic at the link layer (layer 2)506, and then processing information to lock/stop/block a virtual machine in response to detection of undesired traffic508.

FIG. 6shows a representative flow/state diagram depicting illustrative processing associated with operating a virtual machine firewall system according to implementations herein. Process diagram600includes a first compute node (e.g., agent)603receiving an instruction from a second compute node (e.g. manager)601to define or otherwise boot a virtual machine (VM), at602. Here, while shown in the drawing as separate, such manger and agent nodes may be or reside in the same physical node, or even be in the same process/software. The agent may validate the instruction from the manager and define the virtual machine, at604. The virtual machine may then configure its networking, either by sending a request for a network address to a network and receiving a valid DHCP response, or by using predefined or dynamically generated configuration values.

The agent enables or otherwise defines a firewall (FW)609to monitor traffic from virtual machine, at606. In some implementations, the agent may send an instruction or other indication to enable and/or otherwise define the firewall. The agent reports to the manager the definition of the virtual machine via an instruction or signal, at608. In the example ofFIG. 6, the virtual machine attempts a malicious attack, at610. In this example, the malicious attack may be a spoof attack, specifically attempt to spoof the IP address of another compute node within the network. In such implementations, the firewall609may stop traffic associated with the spoof attack, for example data frames or cells that include a MAC address not associated with the virtual machine. In such implementations, the firewall detects the spoof attack and blocks the traffic associated with the spoof attack based on information included in an Ethernet bridge table of the agent. In other examples, the virtual machine may attempt any type of malicious attack. When the firewall detects a spoof attack, the agent sending an instruction to the firewall to lock the virtual machine, at612, such that all traffic from the virtual machine is blocked, at614.

According to additional implementations, the agent may then receive an instruction from the manager to reboot the virtual machine, at616. In some implementations, the instruction from the manager may be based on a request from a customer or other user to reboot the virtual machine. The agent reboots the virtual machine, at618, and sends an instruction to the firewall to unlock the virtual machine, at620. The virtual machine sends a request for a network address to a network, at622, and the virtual machine receives a valid DHCP response, at624. The agent sends an instruction to the firewall to lock the IP address with the virtual machine, at626. The virtual machine sends and receives traffic via the network, at628and630, respectively.

In further processing shown in the example ofFIG. 6, the virtual machine is shown attempting a malicious attack, for example an IP spoof attack, at632. In such implementations, the firewall may stop traffic associated with the spoof attack, for example data frames or cells that include an IP address not associated with the virtual machine. In such implementations, the firewall detects the spoof attack and blocks the traffic associated with the spoof attack based on information included in an Ethernet bridge table of the agent. When the agent detects the spoof attack, the agent sends an instruction to the firewall to lock the virtual machine, at634. In the example ofFIG. 6, the virtual machine also attempts a second malicious attack, for example, a rogue DHCP attack, at636. In such a rouge DHCP attack, the virtual machine may act like a DHCP server, and may attempt to send a DHCP request to the network infrastructure607via the firewall. In such a rogue DHCP attack, the firewall may stop traffic associated with the spoof attack, for example data frames or cells that include a DHCP offer. When the agent detects the malicious attack, the firewall may be configured or instructed to block all traffic from the virtual machine, at638.

As used in this specification, the singular forms “a,” “an” and “the” include plural referents unless the context clearly dictates otherwise. Thus, for example, the term “a firewall” is intended to mean a single firewall, or a combination of firewalls.

Some implementations described herein relate to a computer storage product with a computer-readable medium (also may be referred to as a processor-readable medium) having instructions or computer code thereon for performing various computer-implemented operations. The media and computer code (also may be referred to as code) may be those designed and constructed for the specific purpose or purposes. Examples of computer-readable media include, but are not limited to: magnetic storage media such as hard disks, floppy disks, and magnetic tape; optical storage media such as Compact Disc/Digital Video Discs (CD/DVDs), Compact Disc-Read Only Memories (CD-ROMs), and holographic devices; magneto-optical storage media such as optical disks; carrier wave signal processing modules; and hardware devices that are specially configured to store and execute program code, such as Application-Specific Integrated Circuits (ASICs), Programmable Logic Devices (PLDs), and Read-Only Memory (ROM) and Random-Access Memory (RAM) devices.

Examples of computer code include, but are not limited to, micro-code or micro-instructions, machine instructions, such as produced by a compiler, code used to produce a web service, and files containing higher-level instructions that are executed by a computer using an interpreter. For example, implementations may be implemented using Java, C++, or other programming languages (e.g., object-oriented programming languages) and development tools. Additional examples of computer code include, but are not limited to, control signals, encrypted code, and compressed code.

While various implementations have been described above, it should be understood that they have been presented by way of example only, not limitation, and various changes in form and details may be made. Any portion of the apparatus and/or methods described herein may be combined in any combination, except mutually exclusive combinations. The implementations described herein may include various combinations and/or sub-combinations of the functions, components and/or features of the different implementations described. For example, whileFIG. 1depicts virtual machine120disposed in compute node110, in some implementations, virtual machine120may be logically located within compute node110but physically located in another location. In some implementation, any attack may be substituted for a different attack. For example, while method600may include a DHCP attack at636, in some implementation method600may include an ARP attack at636.

Although certain presently disclosed implementations of the invention have been specifically described herein, it will be apparent to those skilled in the art to which the invention pertains that variations and modifications of the various implementations shown and described herein may be made without departing from the spirit and scope of the invention. Accordingly, it is intended that the claims and inventions herein be limited only to the extent required by the applicable rules of law.