# US 2021/0344692 A1 · Providing a virtual security appliance architecture to a virtual cloud infrastructure

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0344692 A1
- Document ID: US20210344692A1
- Status: Published application
- Kind: A1
- Application number: 17/320,129
- Filed: 2021-05-13
- Published: 2021-11-04
- Earliest claimed: 2012-10-21
- Assignees: McAfee, Inc.
- Applicants: McAfee, LLC
- Inventors: Geoffrey Howard Cooper; Manuel Nedbal; Hemang Satish Nadkarni
- Web page: https://patentgrep.com/patent/US20210344692A1

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 21/606: {by securing the transmission between two devices or processes}
- H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)}
- G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L 63/105: {Multiple levels of security}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method in an embodiment includes detecting a change for a virtual machine in a virtual server of a virtual network infrastructure, determining whether a virtual security appliance is configured in the virtual server, and sending a request to create the virtual security appliance in the virtual server. The method further includes allowing the virtual machine to initiate when the virtual security appliance is created in the virtual machine. The virtual security appliance performs security inspections on network packets sent from the virtual machine. In more specific embodiments, the method further includes creating an intercept mechanism in the virtual server to intercept the network packets from the virtual machine. In further embodiments, one or more security policies identify one or more virtual security appliances to process the network packets from the virtual machine.

## Claims

### Claim at position 1

-30. (canceled)

### Claim 31

A method implemented by a virtual server, comprising:
detecting a change for a virtual machine in the virtual server;
determining whether a virtual security appliance is configured in the virtual server;
sending a request to create the virtual security appliance in the virtual server;
allowing the virtual machine to initiate when the virtual security appliance is created in the virtual machine, wherein the virtual security appliance performs security inspections on network packets sent from the virtual machine; and
virtually wiring a virtual network interface card (vNIC) to a physical network interface card.

### Claim 32 (depends on 31)

The method of claim 31, further comprising:
creating an intercept mechanism in the virtual server to intercept the network packets from the virtual machine.

### Claim 33 (depends on 32)

The method of claim 32, further comprising:
reconfiguring logic of a virtual switch connected to the virtual machine to force the network packets from the virtual machine to the physical network interface card.

### Claim 34 (depends on 32)

The method of claim 32, further comprising:
reconfiguring logic of the vNIC to prevent the network packets from passing through the vNIC.

### Claim 35 (depends on 32)

The method of claim 32, wherein the intercept mechanism includes a hardware interception of network packets based on the Single Root Input/Output Virtualization (SR-IOV) specification.

### Claim 36 (depends on 31)

The method of claim 31, wherein one or more security policies identify one or more virtual security appliances to process the network packets from the virtual machine.

### Claim 37 (depends on 31)

The method of claim 31, further comprising:
sending, with a distribution manager virtual machine, a request to create the virtual security appliance in the virtual server.

### Claim 38

An apparatus, comprising:
a processor configured to detect a change for a virtual machine in a virtual server, to determine whether a virtual security appliance is configured in the virtual server, to send a request to create the virtual security appliance in the virtual server, and to allow the virtual machine to initiate when the virtual security appliance is created in the virtual machine, wherein the virtual security appliance performs security inspections on network packets sent from the virtual machine; and
a physical network interface card, wherein the processor further is configured to virtually wire a virtual network interface card (vNIC) to the physical network interface card.

### Claim 39 (depends on 38)

The apparatus of claim 38, wherein the processor further is configured to create an intercept mechanism in the virtual server to intercept the network packets from the virtual machine.

### Claim 40 (depends on 39)

The apparatus of claim 39, wherein the processor further is configured to reconfigure logic of a virtual switch connected to the virtual machine to force the network packets from the virtual machine to the physical network interface card.

### Claim 41 (depends on 39)

The apparatus of claim 39, wherein the processor further is configured to reconfigure logic of the vNIC to prevent the network packets from passing through the vNIC.

### Claim 42 (depends on 39)

The apparatus of claim 39, wherein the intercept mechanism includes a hardware interception of network packets based on the Single Root Input/Output Virtualization (SR-IOV) specification.

### Claim 43 (depends on 38)

The apparatus of claim 38, wherein one or more security policies identify one or more virtual security appliances to process the network packets from the virtual machine.

### Claim 44 (depends on 38)

The apparatus of claim 38, further comprising:
a distribution manager virtual machine configured to send a request to create the virtual security appliance in the virtual server.

### Claim 45

At least one non-transitory, machine-accessible storage medium having instructions stored thereon, the instructions, when executed on a machine, cause the machine to perform operations comprising:
detecting a change for a virtual machine in a virtual server;
determining whether a virtual security appliance is configured in the virtual server;
sending a request to create the virtual security appliance in the virtual server;
allowing the virtual machine to initiate when the virtual security appliance is created in the virtual machine, wherein the virtual security appliance performs security inspections on network packets sent from the virtual machine; and
virtually wiring a virtual network interface card (vNIC) to a physical network interface card.

### Claim 46 (depends on 45)

The medium of claim 45, the operations further comprising:
creating an intercept mechanism in the virtual server to intercept the network packets from the virtual machine.

### Claim 47 (depends on 46)

The medium of claim 46, the operations further comprising:
reconfiguring logic of a virtual switch connected to the virtual machine to force the network packets from the virtual machine to the physical network interface card.

### Claim 48 (depends on 46)

The medium of claim 46, the operations further comprising:
reconfiguring logic of the vNIC to prevent the network packets from passing through the vNIC.

### Claim 49 (depends on 46)

The medium of claim 46, wherein the intercept mechanism includes a hardware interception of network packets based on the Single Root Input/Output Virtualization (SR-IOV) specification.

### Claim 50 (depends on 45)

The medium of claim 45, the operations further comprising:
sending, with a distribution manager virtual machine, a request to create the virtual security appliance in the virtual server.