Methods to restrict network file access in guest virtual machines using in-guest agents

A computer system comprising:

• a memory;
• and
• at least one processor coupled to the memory, the at least one processor configured to execute a method for preventing access to files by a virtual machine executing on a host machine, the method comprising:
• receiving, at the virtual machine, network information associated with a network connection opened by a process at the virtual machine, wherein the network connection is used for connecting the virtual machine to another machine outside the host machine and for accessing one or more files;
• identifying the process that opened the network connection;
• determining that the process that opened the network connection initiated a file access event to access the one or more files;
• transmitting, from the virtual machine, information indicative of the file access event and the network connection to a security virtual machine;
• receiving an enforcement decision for the file access event from the security virtual machine, wherein the enforcement decision is generated based on the information indicative of the file access event and the network connection;
• and
• applying the enforcement decision to either allow or prevent the access to the one or more files by the process executing on the virtual machine.

A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method for preventing access to files by a virtual machine executing on a host machine, the method comprising:

• receiving, at the virtual machine, network information associated with a network connection opened by a process at the virtual machine, wherein the network connection is used for connecting the virtual machine to another machine outside the host machine and for accessing one or more files;
• identifying the process that opened the network connection;
• determining that the process that opened the network connection initiated a file access event to access the one or more files;
• transmitting, from the virtual machine, information indicative of the file access event and the network connection to a security virtual machine;
• receiving an enforcement decision for the file access event from the security virtual machine, wherein the enforcement decision is generated based on the information indicative of the file access event and the network connection;
• and
• applying the enforcement decision to either allow or prevent the access to the one or more files by the process executing on the virtual machine.