Patent SG-11201810295U-A (SG)
Title: Hardware-based virtualized security isolation
Inventor: PAI NAVIN NARAYAN
IPC: G06F21/53
Filed: 2017-05-25
Abstract: WebProxy () INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property Organization International Bureau (43) International Publication Date 07 December 2017 (07.12.2017) WIP0 I PCT omit VIII Holm o III OH oloimionm oimIE (10) International Publication Number WO 2017/210065 Al (51) International Patent Classification: GOOF 21/53 (2013.01) (21) International Application Number: PCT/US2017/034354 (22) International Filing Date: 25 May 2017 (25.05.2017) (25) Filing Language: English (26) Publication Language: English (30) Priority Data: 15/171,917 02 June 2016 (02.06.2016) US (71) Applicant: MICROSOFT TECHNOLOGY LI- CENSING, LLC [US/US]; One Microsoft Way, Redmond, Washington 98052-6399 (US). (72) Inventors: PAI, Navin Narayan; Microsoft Technology Licensing, LLC, One Microsoft Way, Redmond, Washing- ton 98052-6399 (US). JEFFRIES, Charles G.; Microsoft Technology Licensing, LLC, One Microsoft Way, Red- mond, Washington 98052-6399 (US). VISWANATHAN, Giridhar; Microsoft Technology Licensing, LLC, One Mi- crosoft Way, Redmond, Washington 98052-6399 (US). SCHULTZ, Benjamin M.; Microsoft Technology Licens- ing, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). SMITH, Frederick J.; Microsoft Tech- nology Licensing, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). REUTHER, Lars; Mi- crosoft Technology Licensing, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). EBERSOL, Michael B.; Microsoft Technology Licensing, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). DIAZ CUELLAR, Gerardo; Microsoft Technology Li- censing, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). PASHOV, Ivan Dimitrov; Microsoft Technology Licensing, LLC, One Microsoft Way, Red- mond, Washington 98052-6399 (US). GADDEHOSUR, Poornananda R.; Microsoft Technology Licensing, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). PULAPAKA, Hari R.; Microsoft Technology Li- censing, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). RAO, Vikram Mangalore; Microsoft Technology Licensing, LLC, One Microsoft Way, Red- mond, Washington 98052-6399 (US). (74) Agent: MINHAS, Sandip et al.; Microsoft Technology Li- censing, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). (81) Designated States (unless otherwise indicated, for every kind of national protection available): AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, — (54) Title: HARDWARE-BASED VIRTUALIZED SECURITY ISOLATION (57) : A host operating system miming on a computing device monitors network communications for the computing device to identify network resources that are requested by the computing device. The host operating system compares requested network resources against security policies to determine if the request- 104 - ed network resources are trusted. When an untrusted network resource is identi- fied, the host operating system accesses the untrusted network resource within a container that is isolated from the host operating system kernel using techniques 106 discussed herein. By restricting access to untrusted network resources to isolated containers, the host operating system is protected from even kernel-level attacks or infections that may result from an untrusted network resource. 102 Host Operating System HVSI Subsystem 110 Network Filter 116 Policy Manager 112 Container Manager 118 Application 114 J Security Subsystem 120 130(1) 130(n) Container ( ) Container (n 132(n) 132(1) Virtual Virtual Application Application Fig. 1 [Continued on next page] 122(1)— 122(n) Network Resource = 1 1 Network Resource Management And Monitoring Service 108 W O 20 17 / 210065 Al WO 2017/210065 Al OII CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IR, IS, JP, KE, KG, KH, KN, KP, KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. (84) Designated States (unless otherwise indicated, for every kind of regional protection available): ARIPO (BW, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). Declarations under Rule 4.17: as to applicant's entitlement to apply for and be granted a patent (Rule 4.17(H)) as to the applicant's entitlement to claim the priority of the earlier application (Rule 4.17(iii)) Published: — with international search report (Art. 21(3))