Extended Context Network Authorization in Virtualized Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing and maintaining network policies across expanding networks, particularly in virtualized environments, is complex due to increased security and authorization needs, with existing solutions lacking sufficient information for efficient context-based authorization and being vulnerable to malicious applications impersonating genuine users or applications.
Innovation Solution
A method where security agents on guest virtual machines capture network requests, identify contexts including primary and secondary applications/users, and send this information to a security engine on the host machine for authorization, using extended context information to enforce security policies and restrict network requests at a fine-grained level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If context-based authorization is implemented using only primary application information, then authorization decisions can be made, but malicious applications can impersonate genuine users or applications by generating network events as though they are being performed by a genuine user
Solution Approach 1:
The patent transitions from single-dimensional authorization (primary application only) to multi-dimensional authorization by adding secondary application information as an additional dimension. This is achieved by performing a stack walk through the call stack to identify the secondary application that caused the primary application to make the network request, thereby creating a two-layer identification system that prevents impersonation attacks
2Measurement precision
If packet inspection is performed to analyze network traffic contents, then application or protocol identification is improved, but significant processing resources are consumed and network latency increases
Solution Approach 1:
The patent extracts application identification information from the network request metadata and call stack context rather than performing deep packet inspection on the actual network traffic. By taking out the identification task from the packet inspection process and placing it in the authorization decision process, the system achieves application identification without the performance penalty of deep packet inspection
3Reliability
If security policies are enforced at multiple entry points in virtualized networks, then network security is improved, but management and maintenance complexity increases significantly
Solution Approach 1:
The patent creates a universal authorization mechanism that works across all entry points in virtualized networks through a common architecture. The stack walk-based secondary application identification and context-based authorization approach provides a multi-functional solution that handles authentication, authorization, and impersonation detection uniformly across different network entry points, simplifying management while maintaining security
Data Source
AI summary
Some embodiments provide a novel method for authorizing network requests for a machine in a network. In some embodiments, the method is performed by security agents that execute on virtual machines operating on a host machine. In some embodiments, the method captures a network request (e.g., network control packets, socket connection request, etc.) from a primary application executing on the machine. The method identifies an extended context for the network request and determines whether the network request is authorized based on the extended context. The method then processes the network request according to the determination. The extended context of some embodiments includes identifications for primary and secondary applications associated with the network request. Alternatively, or conjunctively, some embodiments include identifications for primary and secondary users associated with the network request.