Integrated intrusion deflection, detection and introspection
AssigneeOracle America, Inc.
InventorsJohn E. Weeks, Christoph L. Schuba
Life of this patent
Estimating the term…
Abstract
Methods and apparatus are provided for integrated deflection, detection and intrusion. Within a single computer system configured for operating system virtualization (e.g., Solaris™, OpenSolaris™), multiple security functions execute in logically independent zones or containers, under the control and administration of a global zone. Such functions may illustratively include a demilitarized zone (DMZ) and a honeypot. Management is facilitated because all functions work within a single operating system, which promotes the ability to configure, monitor and control each function. Any given zone can be configured with limited resources, a virtual network interface circuit and/or other features.
Claims17
A computer system for providing integrated computer security functions, the computer system comprising:
- a set of processors;
- a set of network interface devices coupling the computer system to one or more networks;
- and
- a single operating system instance comprising:
- a first demilitarized zone operating within a first non-global zone of the single operating system instance having a first network address;
- a first honeypot operating within a second non-global zone of the single operating system instance having a second network address;
- and
- a second demilitarized zone within a third non-global zone of the single operating system instance having a third network address;
- wherein each of the first non-global zone and the third non-global zone comprise virtual network interface devices bound to different network interface devices within the set of network interface devices;
- and
- wherein each of the first demilitarized zone and the second demilitarized zone operate within separate logical subnets of a network coupled to the computer system.
A method of providing integrated computer security functions within a single computer system, the method comprising:
- within a single operating system instance executing within the single computer system:
- instantiating a first non-global zone configured to operate a first demilitarized zone;
- binding a first virtual network interface device with a first network address to the first non-global zone;
- instantiating a second non-global zone configured to operate a honeypot;
- binding a second virtual network interface device with a second network address to the second non-global zone;
- instantiating a third non-global zone configured to operate a second demilitarized zone;
- and
- binding a third virtual network interface device with a third network address to the third non-global zone;
- wherein the first virtual network interface device and the third virtual network interface device are bound to different network interfaces within the single computer system;
- executing a set of communication rules within the first non-global zone;
- and
- executing logic within the second non-global zone to perform introspection of communication connections deflected to the second non-global zone from the first non-global zone.
A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method of providing integrated computer security functions, the method comprising:
- within a single operating system instance executing within the single computer system:
- instantiating a first non-global zone configured to operate a first demilitarized zone;
- binding a first virtual network interface device with a first network address to the first non-global zone;
- instantiating a second non-global zone configured to operate a honeypot;
- binding a second virtual network interface device with a second network address to the second non-global zone;
- instantiating a third non-global zone configured to operate a second demilitarized zone;
- and
- binding a third virtual network interface device with a third network address to the third non-global zone;
- wherein the first virtual network interface device and the third virtual network interface device are bound to different network interfaces within the single computer system;
- executing a set of communication rules within the first non-global zone;
- and
- executing logic within the second non-global zone to perform introspection of communication connections deflected to the second non-global zone from the first non-global zone.
Dependencies are inferred from the claim text.