Patent ID: 8190778

Claim:
An apparatus comprising: a memory; a non-virtualized network interface controller; a first virtual machine to host a user operating system, the user operating system comprising: a protected filter driver loaded in the memory by the first virtual machine; and a native device driver for handling network traffic to be transmitted and received over a communications network between the non-virtualized network interface controller and the protected filter driver, the non-virtualized network interface controller assigned to the first virtual machine by a Virtual Machine Monitor; and a second virtual machine to host a security operating system, the security operating system comprising: a security filter driver loaded in the memory by the second virtual machine, wherein the protected filter driver is to move network traffic received from the first native device driver to the security filter driver for inspection and filtering; and a network security module loaded in the memory by the second virtual machine to receive, from the security filter driver, the network traffic first received by the security filter driver, the network security module further to determine whether the network traffic first received by the security filter driver is malicious, wherein the network security module further to (i) cause the network traffic to be dropped in response to determining that the network traffic is malicious or (ii) cause the network traffic to be returned to the protected filter driver loaded in the first virtual machine in response to determining that the network traffic is not malicious.