Patent ID: 8800025

Claim:
A system to provide virtual desktop and security management service on a local area network (LAN) on which a plurality of virtual machines and a plurality of regular computing devices are interconnected, the system comprising: one or more network interfaces for sending packets to and receiving packets from the plurality of regular computing devices on the LAN; a Media Access Control (MAC) address; a hypervisor over which the plurality of virtual machines are run, the hypervisor comprising a Real Address Resolution Protocol (ARP) Table and a Permitted Flows Database, the Real ARP Table to store mappings between MAC addresses and corresponding Internet Protocol (IP) addresses of the plurality of regular computing devices and the plurality of virtual machines on the LAN, the Permitted Flows Database to store flow entries having packets forwarded according to the Real ARP Table; and a Deep Packet Inspection (DPI) module, the DPI module to inspect packets received from the hypervisor for enforcing security policies, to install the flow entries in the Permitted Flows Database when future packets corresponding to the flow entries, of the packets received from the hypervisor, require no further inspection at the DPI module for enforcing the security policies, and to forward the packets received from the hypervisor that are permitted by the security policies back to the hypervisor; wherein the hypervisor performs functions comprising: intercepting packets sent by the plurality of regular computing devices on the LAN and by the plurality of virtual machines running over the hypervisor; forwarding intercepted packets that do not correspond to any of the flow entries in the Permitted Flows Database to the DPI module; and forwarding intercepted packets that correspond to the flow entries in the Permitted Flows Database to intended ones of the plurality of regular computing devices on the LAN and the plurality of virtual machines running over the hypervisor according to the Real ARP Table; wherein the hypervisor intercepting packets sent by the plurality of regular computing devices on the LAN comprises: sending out gratuitous ARP packets, using the MAC address, to the plurality of regular computing devices to enable the hypervisor to intercept all packets from the plurality of regular computing devices; and storing MAC addresses and corresponding IP addresses of the intercepted packets of the plurality of regular computing devices and the plurality of virtual machines in the Real ARP Table.