Context Engine for Host-Based Firewall Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing middlebox solutions do not effectively utilize rich contextual data from host machines, as they lack an efficient distributed scheme for filtering captured contextual attributes to process service rules defined by smaller attribute sets.
Innovation Solution
A novel architecture that executes a guest-introspection agent, context engine, and attribute-based service engines on host computers to capture and consume contextual attributes from network and process events, using hooks with the operating system to collect and process attributes for service rule enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If existing middlebox solutions capture contextual attributes on host machines, then rich contextual data is available for service processing, but the system lacks an efficient distributed scheme for filtering thousands of contextual attributes to process service rules defined by smaller attribute sets
Solution Approach 1:
The system segments the attribute filtering task by separating the collection of contextual attributes (performed by GI agents at individual hosts) from the processing of service rules (performed by service engines). The context engine acts as an intermediary that collects attributes and makes them available to multiple service engines, enabling efficient filtering without requiring complex distributed coordination.
Solution Approach 2:
The context engine serves as an intermediary component between the GI agents and service engines. It collects contextual attributes from multiple sources, filters and organizes them, and provides them to service engines that need specific attributes for rule processing. This intermediary approach eliminates the need for direct complex interactions between GI agents and service engines.
2Adaptability or versatility
If multiple service engines process different service rules on the same host, then service diversity and flexibility are improved, but the complexity of managing and coordinating attribute collection and processing increases
Solution Approach 1:
The context engine is designed as a universal component that serves multiple service engines simultaneously. It collects contextual attributes from GI agents and makes them available to any service engine that needs them, regardless of the specific service rules being processed. This universal approach enables service diversity without requiring separate attribute collection mechanisms for each service type.
Solution Approach 2:
The system collects more contextual attributes than strictly necessary for any single service rule (excessive action), storing them in a centralized context engine. Service engines then selectively retrieve only the attributes they need for their specific rules (partial action). This approach simplifies coordination by centralizing attribute management while enabling flexible service processing.
Data Source
AI summary
Some embodiments of the invention provide a novel architecture for capturing contextual attributes on host computers that execute one or more machines, and for consuming the captured contextual attributes to perform services on the host computers. The machines are virtual machines (VMs) in some embodiments, containers in other embodiments, or a mix of VMs and containers in still other embodiments. Some embodiments execute a guest-introspection (GI) agent on each machine from which contextual attributes need to be captured. In addition to executing one or more machines on each host computer, these embodiments also execute a context engine and one or more attribute-based service engines on each host computer. One of these service engines is a firewall engine. Through the GI agents of the machines on a host, the context engine of that host in some embodiments collects contextual attributes associated with network events and/or process events on the machines. The context engine then provides the contextual attributes to the firewall engine, which, in turn, use these contextual attributes to identify firewall rules to enforce.