Proxy Agent for Virtual Machine Network Access Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Virtualization technologies pose challenges to security mechanisms, as they are not designed to effectively control virtual machines, leading to potential network security breaches when virtual machines bypass network access control restrictions.

Innovation Solution

Implementing a proxy agent on a host computing device that communicates with a network-access-control module to enforce network access policies by assigning virtual identifiers to virtual machines and creating temporary interfaces for compliance verification, ensuring that virtual machines adhere to network policies before accessing the network.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If the host proxies the virtual machine's network access and the host has been authenticated, then network access is allowed for simplicity, but non-compliant virtual machines can bypass network access control restrictions

Engineering Contradiction:

Improvenetwork access simplicityVSAvoidnetwork security control

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent segments the network access control process by creating a separate authentication and compliance verification path for virtual machines. Instead of relying solely on host-level authentication, the system implements virtual machine-specific compliance checks through policy enforcement agents, breaking the monolithic host-proxy model into granular, controllable units.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces policy enforcement agents as intermediary components between virtual machines and the network. These agents act as mediators that verify compliance with network policies before allowing traffic flow, preventing direct bypass of security controls while maintaining streamlined access for compliant systems.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If network access control is applied to the host and virtual machine independently in bridged configuration, then each can be controlled separately, but the complexity of managing multiple endpoints increases

Engineering Contradiction:

Improveindependent control flexibilityVSAvoidmanagement complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements a universal policy enforcement framework that can operate across multiple virtualization configurations (bridged, routed, NAT). The policy enforcement agents provide multi-functional capabilities, handling authentication, compliance verification, and access control in a unified manner that adapts to different network topologies without requiring separate management approaches.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Difficulty of detecting and measuring

If a virtual machine appears compliant from an external perspective but is not compliant internally, then external authentication succeeds, but internal security policies are violated

Engineering Contradiction:

Improvecompliance detection difficultyVSAvoidnetwork security risk

Core Design Contradiction:

Difficulty of detecting and measuringVSObject-affected harmful factors

Solution Approach 1:

The patent implements preliminary compliance verification through policy enforcement agents that check virtual machine configurations and security states before granting network access. This preliminary action prevents non-compliant virtual machines from connecting to the network in the first place, eliminating the risk of internal policy violations before they can occur.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent establishes a feedback mechanism where policy enforcement agents continuously monitor virtual machine compliance status and report to the network access control system. This real-time feedback enables dynamic adjustment of access permissions, immediately revoking network access when compliance violations are detected, thereby preventing security risks from propagating.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS8281363B1Methods and systems for enforcing network access control in a virtual environment

Publication Date: 2012.10.02 CA TECH INC

AI summary

A computer-implemented method may include receiving a request to access a network. The request may be sent from a virtual machine. The method may also include proxying the request to a network-access-control module, receiving a response from the network-access-control module, and transmitting the response to the virtual machine. Proxying the request to the network-access-control module may include assigning the virtual machine a virtual identifier. Proxying the request may also include creating a temporary interface. The temporary interface may be programmed to receive the response from the network-access-control module and transmit the response to the virtual machine. Various other methods, systems, and computer-readable media are also disclosed herein.