Packet Tagging for Guest System Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing and maintaining network policies across expanding networks, particularly in virtualized environments, is complex due to increased security and authorization needs, with compromised end machines and modified network request packets posing challenges for efficient and secure context-based authorization.
Innovation Solution
A method that captures network requests at various protocol stack layers, tags packets with a tag value, maps it to tuples, and sends data to a security engine for verification and policy enforcement, using security agents and engines to enforce security policies and detect packet modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security policies are enforced at end machines in virtualized networks, then network security is improved, but device complexity and difficulty of managing security policies increases
Solution Approach 1:
The patent introduces a security gateway as an intermediary component that centralizes security policy enforcement. Instead of distributing complex security logic across multiple end machines, the gateway acts as a mediator that receives network requests, applies security policies centrally, and returns decisions to the end machines. This reduces the complexity at end machines while maintaining strong security enforcement through the gateway's centralized policy management capabilities.
2Measurement precision
If context-based authorization is implemented for network requests, then authorization accuracy is improved, but processing time and system complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-establishing security policies and authorization rules in the security gateway before network requests arrive. Context information requirements are predetermined and prepared in advance, allowing the system to quickly match incoming requests against pre-configured policies rather than analyzing all possible context factors in real-time. This reduces processing time while maintaining accurate context-based authorization.
3Reliability
If network requests are monitored and verified through multiple protocol layers, then packet modification detection is improved, but processing overhead increases
Solution Approach 1:
The patent extracts the packet verification and modification detection functions from the general network processing path and consolidates them into a dedicated security gateway component. By separating these security-critical functions into a specialized module, the system can apply rigorous multi-layer verification only when necessary (when security policies require it) rather than applying the same overhead to all network traffic. This maintains high packet integrity verification for security-sensitive operations while preserving network processing efficiency for routine traffic.
Data Source
AI summary
Some embodiments provide a novel method for monitoring network requests from a machine. The method captures the network request at various layers of a protocol stack. At a first layer of a protocol stack, the method tags a packet related to the network request with a tag value, maps the tag value to a set of tuples associated with the packet, and sends a first set of data related to the packet to a security engine. At a second layer of the protocol stack, the method determines whether the packet has been modified through the protocol stack, and sends an updated second set of data to the security engine when the packet has been modified.