# US 12,771,716 B2 · Malicious packet filtering in a virtualization system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,771,716 B2
- Document ID: US12771716B2
- Status: Granted
- Kind: B2
- Application number: 17/592,622
- Filed: 2022-02-04
- Published: 2022-05-19
- Granted: 2026-10-20
- Earliest claimed: 2017-08-25
- Assignees: Red Hat, Inc.
- Applicants: Red Hat, Inc.
- Inventors: Michael Tsirkin; Jiri Benc; Aaron Conole
- Web page: https://patentgrep.com/patent/US12771716B2

## CPC

- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- H04L 63/0245: {Filtering by information in the payload}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method includes receiving, by a processing device, a first packet addressed to a first virtualized execution environment, determining, by the processing device, whether the first packet has similar characteristics with a second packet by applying a first filtering rule to the first packet, wherein the first filtering rule is generated in view of characteristics of the second packet, and wherein the second packet is stored in a first filtering queue of a second virtualized execution environment, and responsive to determining that the first packet is similar to the second packet, discarding, by the processing device, the first packet.

## Claims

### Claim 1

A method, comprising:
receiving, by a hypervisor that manages a first virtualized execution environment and a second virtualized execution environment and that is executed by a processing device, a first packet addressed to the first virtualized execution environment;
determining, by the hypervisor executed by the processing device, whether the first packet has similar characteristics with a second packet by applying a first filtering rule to the first packet, wherein the first filtering rule is generated by the hypervisor in view of characteristics of the second packet by accessing a second filtering queue within a second virtual network interface card (NIC) of the second virtualized execution environment that stores the second packet, and wherein the second virtualized execution environment stores the second packet in the second filtering queue based on a determination by a second application of the second virtualized execution environment that the second packet is malicious;
responsive to determining that the first packet is similar to the second packet, discarding, by the hypervisor executed by the processing device, the first packet;
accessing, by the hypervisor, a first filtering queue within a first virtual NIC of the first virtualized execution environment to obtain a fourth packet, the fourth packet stored in the first filtering queue based on a determination by a first application of the first virtualized execution environment that the fourth packet is malicious;
generating, by the hypervisor in view of characteristics of the fourth packet, a third filtering rule based on the fourth packet;
determining a threshold number of similar filtering rules is exceeded based on a determination the third filtering rule is similar to the first filtering rule and a second filtering rule;
adding at least one of the first filtering rule, the second filtering rule, or the third filtering rule to a physical NIC of a host associated with the hypervisor based on determining the threshold number of similar filtering rules is exceeded; and
configuring the physical NIC to apply the at least one of the first filtering rule, the second filtering rule, or the third filtering rule added to the physical NIC.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
determining, by the processing device, whether the first virtualized execution environment satisfies a trust condition pertaining to the second virtualized execution environment, wherein determining whether the first virtualized execution environment satisfies the trust condition comprises determining whether the first virtualized execution environment and the second virtualized execution environment are associated with a same user; and
responsive to determining that the first virtualized execution environment satisfies the trust condition, determining, by the processing device, whether the first packet has the similar characteristics with the second packet.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
accessing, by the processing device, the second filtering queue of the second virtualized execution environment, the second filtering queue storing at least a third packet;
generating, by the processing device, the second filtering rule in view of characteristics of the third packet; and
in response to determining that the first filtering rule and the second filtering rule match, performing, by the processing device, at least one of: installing the first filtering rule, or storing the first filtering rule in a data store to apply to subsequent packets addressed to the first virtualized execution environment and the second virtualized execution environment.

### Claim 4 (depends on 1)

The method of claim 1, further comprising, prior to receiving the first packet:
generating, by the processing device, the first filtering rule in view of the characteristics of the second packet; and
storing, by the processing device, the first filtering rule in a data store.

### Claim 5 (depends on 1)

The method of claim 1, further comprising performing, by the processing device, at least one of:
removing the first filtering rule after a first set period of time; or
temporarily suspending the first filtering rule for a second set period of time.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
adding, by the processing device, metadata included with the first packet to the first filtering rule when the first filtering rule is generated, the metadata comprising a type of malicious packet.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
storing, by the processing device, the first packet in the first filtering queue of the first virtual NIC of the first virtualized execution environment;
receiving, by the processing device, a third packet addressed to a third virtualized execution environment, the third packet having similar characteristics with the first packet and the second packet; and
responsive to receiving the third packet, discarding, by the processing device, the third packet.

### Claim 8

A system comprising:
a memory; and
a processing device coupled to the memory, the processing device to:
receive, by a hypervisor that manages a first virtualized execution environment and a second virtualized execution environment and that is executed by the processing device, a first packet addressed to the first virtualized execution environment;
determine, by the hypervisor, whether the first packet has similar characteristics with a second packet by applying a first filtering rule to the first packet, wherein the first filtering rule is generated by the hypervisor in view of characteristics of the second packet by accessing a second filtering queue within a second virtual network interface card (NIC) of the second virtualized execution environment that stores the second packet, wherein the second virtualized execution environment stores the second packet in the second filtering queue based on a determination by a second application of the second virtualized execution environment that the second packet is malicious, and wherein the second filtering queue is designated for malicious packets and provides an interface between a virtualization section of a host and the second virtualized execution environment;
responsive to a determination that the first packet is similar to the second packet, discard, by the hypervisor, the first packet;
access, by the hypervisor, a first filtering queue within a first virtual NIC of the first virtualized execution environment to obtain a fourth packet, the fourth packet stored in the first filtering queue based on a determination by a first application of the first virtualized execution environment that the fourth packet is malicious;
generate, by the hypervisor in view of characteristics of the fourth packet, a third filtering rule based on the fourth packet;
determine a threshold number of similar filtering rules is exceeded based on a determination the third filtering rule is similar to the first filtering rule and a second filtering rule;
add at least one of the first filtering rule, the second filtering rule, or the third filtering rule to a physical NIC of a host associated with the hypervisor based on determining the threshold number of similar filtering rules is exceeded; and
configure the physical NIC to apply the at least one of the first filtering rule, the second filtering rule, or the third filtering rule added to the physical NIC.

### Claim 9 (depends on 8)

The system of claim 8, wherein the processing device is further to:
determine whether the first virtualized execution environment satisfies a trust condition pertaining to the second virtualized execution environment, wherein to determine whether the first virtualized execution environment satisfies the trust condition, the processing device is to determine whether the first virtualized execution environment and the second virtualized execution environment are associated with a same user; and
responsive to a determination that the first virtualized execution environment satisfies the trust condition, determine whether the first packet has the similar characteristics with the second packet.

### Claim 10 (depends on 8)

The system of claim 8, wherein the processing device is further to:
access the second filtering queue of the second virtualized execution environment, the second filtering queue storing at least a third packet;
generate the second filtering rule in view of characteristics of the third packet; and
in response to a determination that the first filtering rule and the second filtering rule match, perform at least one of: install the first filtering rule, or store the first filtering rule in a data store to apply to subsequent packets addressed to the first virtualized execution environment and the second virtualized execution environment.

### Claim 11 (depends on 8)

The system of claim 8, wherein prior to the reception of the first packet, the processing device is further to:
generate the first filtering rule in view of the characteristics of the second packet; and
store the first filtering rule in a data store.

### Claim 12 (depends on 8)

The system of claim 8, wherein the processing device is further to perform at least one of:
remove the first filtering rule after a first set period of time; or
temporarily suspend the first filtering rule for a second set period of time.

### Claim 13 (depends on 8)

The system of claim 8, wherein the processing device is further to:
add metadata included with the first packet to the first filtering rule when the first filtering rule is generated, the metadata comprising a type of malicious packet.

### Claim 14 (depends on 8)

The system of claim 8, wherein the processing device is further to:
store the first packet in the first filtering queue of the first virtual NIC of the first virtualized execution environment;
receive a third packet addressed to a third virtualized execution environment, the third packet having similar characteristics with the first packet and the second packet; and
responsive to the reception of the third packet, discard the third packet.

### Claim 15

A non-transitory computer-readable medium storing instructions that, when executed by a processing device, cause the processing device to:
receive, by a supervisor that manages a first virtualized execution environment and a second virtualized execution environment and that is executed by the processing device, a first packet addressed to the first virtualized execution environment;
determine, by the supervisor, whether the first packet has similar characteristics with a second packet by applying a first filtering rule to the first packet, wherein the first filtering rule is generated by the supervisor in view of characteristics of the second packet by accessing a second filtering queue within a second software network interface card (NIC) of the second virtualized execution environment that stores the second packet, wherein the second virtualized execution environment stores the second packet in the second filtering queue based on a determination by a second application of the second virtualized execution environment that the second packet is malicious, and wherein the second filtering queue is designated for malicious packets and provides an interface between a virtualization section of a host and the second virtualized execution environment;
responsive to a determination that the first packet is similar to the second packet, discard, by the supervisor, the first packet;
access, by the supervisor, a first filtering queue within a first virtual NIC of the first virtualized execution environment to obtain a fourth packet, the fourth packet stored in the first filtering queue based on a determination by a first application of the first virtualized execution environment that the fourth packet is malicious;
generate, by the supervisor in view of characteristics of the fourth packet, a third filtering rule based on the fourth packet;
determine a threshold number of similar filtering rules is exceeded based on a determination the third filtering rule is similar to the first filtering rule and a second filtering rule; and
add at least one of the first filtering rule, the second filtering rule, or the third filtering rule to a physical NIC of a host associated with the supervisor based on determining the threshold number of similar filtering rules is exceeded; and
configure the physical NIC to apply the at least one of the first filtering rule, the second filtering rule, or the third filtering rule added to the physical NIC.

### Claim 16 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the instructions, when executed by the processing device, cause the processing device further to:
determine whether the first virtualized execution environment satisfies a trust condition pertaining to the second virtualized execution environment, wherein to determine whether the first virtualized execution environment satisfies the trust condition, the instructions, when executed by the processing device, cause the processing device to determine whether the first virtualized execution environment and the second virtualized execution environment are associated with a same user; and
responsive to a determination that the first virtualized execution environment satisfies the trust condition, determine whether the first packet has the similar characteristics with the second packet.

### Claim 17 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the instructions, when executed by the processing device, cause the processing device further to:
access the second filtering queue of the second virtualized execution environment, the second filtering queue storing at least a third packet;
generate the second filtering rule in view of characteristics of the third packet; and
in response to a determination that the first filtering rule and the second filtering rule match, perform at least one of: install the first filtering rule, or store the first filtering rule in a data store to apply to subsequent packets addressed to the first virtualized execution environment and the second virtualized execution environment.

### Claim 18 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein prior to the reception of the first packet, the instructions, when executed by the processing device, cause the processing device further to:
generate the first filtering rule in view of the characteristics of the second packet; and
store the first filtering rule in a data store.

### Claim 19 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the instructions, when executed by the processing device, cause the processing device to further perform at least one of:
remove the first filtering rule after a first set period of time; or
temporarily suspend the first filtering rule for a second set period of time.

### Claim 20 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the instructions, when executed by the processing device, cause the processing device further to:
store the first packet in the first filtering queue of the first virtual NIC of the first virtualized execution environment;
receive a third packet addressed to a third virtualized execution environment, the third packet having similar characteristics with the first packet and the second packet; and
responsive to the reception of the third packet, discard the third packet.