Controlling access to external networks by an air-gapped endpoint
AssigneePerception Point Ltd.
InventorsBoris Figovsky, Tal Zamir, Oleg Zlotnik, Nir Adler
Life of this patent
Estimating the term…
Abstract
A method and system for controlling access to external networks by an air-gapped endpoint is provided. The method includes providing, on the air-gapped endpoint, a plurality of isolated security zones by instantiating a plurality of corresponding virtual machines using a hypervisor; selecting one security zone of the plurality of isolated security zones; and tunneling a traffic from the selected security zone to a designated network location, wherein the tunneling is through a virtual private network (VPN).
Claims16
A method for controlling access to external networks by a virtually air-gapped endpoint that has a plurality of isolated security zones, each of the plurality of isolated security zones is realized as a respective corresponding one of a plurality of instantiated, already executing, virtual machines that were instantiated using a hypervisor, comprising:
- selecting one security zone of the plurality of isolated security zones;
- and
- tunneling a traffic from the selected security zone to a designated network location, wherein the tunneling is through a virtual private network (VPN);
- and
- allowing the selected one security zone to connect to an external network based on at least one access rule, wherein allowing the connection between the security zone and the external network further comprises:
- exposing a virtual network interface card (NIC) corresponding to a physical NIC, wherein the connection to the external network is through the physical NIC, wherein a MAC address of the virtual NIC is the same as the MAC address of the physical NIC.
A method for controlling access to external networks by a virtually air-gapped endpoint that has a plurality of isolated security zones, each of the plurality of isolated security zones is realized as a respective corresponding one of a plurality of instantiated, already executing, virtual machines that were instantiated using a hypervisor, comprising:
- selecting one security zone of the plurality of isolated security zones;
- and
- tunneling a traffic from the selected security zone to a designated network location, wherein the tunneling is through a virtual private network (VPN);
- and
- wherein the selecting and tunneling is performed by a hidden networking virtual machine (VM) responsible for managing all network activities of the virtually air-gapped endpoint.
A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for controlling access to external networks by a virtually air-gapped endpoint that has a plurality of isolated security zones, each of the plurality of isolated security zones is realized as a respective corresponding one of a plurality of instantiated, already executing, virtual machines that were instantiated using a hypervisor, the process comprising:
- selecting one security zone of the plurality of isolated security zones;
- and tunneling a traffic from the selected security zone to a designated network location, wherein the tunneling is through a virtual private network (VPN);
- and
- allowing the selected one security zone to connect to an external network based on at least one access rule, wherein allowing the connection between the security zone and the external network further comprises:
- exposing a virtual network interface card (NIC) corresponding to a physical NIC, wherein the connection to the external network is through the physical NIC, wherein a MAC address of the virtual NIC is the same as the MAC address of the physical NIC.
A virtually gapped computing system that has a plurality of isolated security zones, each of the plurality of isolated security zones is realized as a respective corresponding one of a plurality of instantiated, already executing, virtual machines that were instantiated using a hypervisor, comprising:
- a network card interface;
- a processing circuitry;
- and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
- select one security zone of the plurality of isolated security zones;
- and
- tunnel a traffic from the selected security zone to a designated network location, wherein the tunneling is through a virtual private network (VPN);
- and
- allowing the selected one security zone to connect to an external network based on at least one access rule, wherein allowing the connection between the security zone and the external network further comprises:
- exposing a virtual network interface card (NIC) corresponding to a physical NIC, wherein the connection to the external network is through the physical NIC, wherein a MAC address of the virtual NIC is the same as the MAC address of the physical NIC.
Dependencies are inferred from the claim text.