Patent ID: 8250641

Claim:
A system for securing network traffic to a platform, comprising: a host processor on the platform having virtualization technology capability; a virtual machine manager (VMM) to execute on the host processor, the VMM to control a plurality of virtual machines running on the host processor; a security virtual appliance to investigate suspicious network traffic, the security virtual appliance to run on a first virtual machine of the plurality of virtual machines; a second processor on the platform coupled to the host processor, the second processor to (i) control network communication and (ii) send and receive network traffic to/from the plurality of virtual machines running on the host processor, the second processor to use at least one filter to first identify whether network traffic is suspicious or non-suspicious, wherein the second processor to identify the network traffic as suspicious when the network traffic meets criteria of the network filter; wherein the second processor to: (i) route, in response to first identifying that the network traffic is suspicious with the at least one filter, the suspicious network traffic to the security virtual appliance for additional investigation, and (ii) route, in response to first identifying that the network traffic is non-suspicious with the at least one filter, the non-suspicious traffic to an originally intended recipient running on the host processor, the originally intended recipient being another virtual machine of the plurality of virtual machines; and wherein the security virtual appliance to subsequently perform a deep packet analysis on the suspicious network traffic to determine whether the suspicious network traffic identified by the second processor is harmless or non-harmless, the security virtual appliance to: (i) enable, in response to subsequently determining that the suspicious network traffic is harmless, the harmless traffic to be routed to the originally intended recipient running on the host processor, and (ii) enable, in response to subsequently determining that the suspicious network traffic is non-harmless, the non-harmless traffic to be dropped.