Method and system for vpn isolation using network namespaces
AssigneeVMware, Inc.
InventorsAlexander Fainkichen, Craig Newell
Life of this patent
Estimating the term…
Abstract
One embodiment of the present invention provides a system for providing exclusive access to a virtual private network (VPN) connection to an authorized application. During operation, the system creates a unique network namespace that is different from a default network namespace of a host system. The system then places a pseudo network interface associated with the VPN connection into the unique network namespace. Furthermore, the system places at least one socket for an authorized application into the unique network namespace. The system also precludes unauthorized applications on the host from accessing the unique network namespace, thereby facilitating exclusive access to the VPN connection by the authorized application.
Claims20
A computer executable method for providing exclusive access to a virtual private network (VPN) connection to an authorized application, comprising:
- creating a unique network namespace of a host system;
- placing a virtual device associated with the VPN connection into the unique network namespace;
- placing at least one socket for the authorized application into the unique network namespace;
- and
- precluding unauthorized applications on the host system from accessing the unique network namespace, thereby facilitating exclusive access to the VPN connection by the authorized application.
A computer readable non-transitory storage medium storing instructions which when executed by a computer cause the computer to perform a method, the method comprising:
- creating a unique network namespace of a host system on the computer;
- placing a virtual device associated with the VPN connection into the unique network namespace;
- placing at least one socket for the authorized application into the unique network namespace;
- and
- precluding unauthorized applications on the host system from accessing the unique network namespace, thereby facilitating exclusive access to the VPN connection by the authorized application.
A computing system for providing exclusive access to a virtual private network (VPN) connection to an authorized application, comprising:
- a network namespace creation mechanism configured to create a unique network namespace of a host system;
- a connectivity service configured to place a virtual device associated with the VPN connection into the unique network namespace;
- and
- a socket management mechanism configured to place at least one socket for the authorized application into the unique network namespace;
- wherein unauthorized applications on the host system are precluded from accessing the unique network namespace, thereby facilitating exclusive access to the VPN connection by the authorized application.
Dependencies are inferred from the claim text.