Integrated virtual desktop and security management system
OwnerHei Tao Fung, Hsingyi Leeinventors
Life of this patent
Estimating the term…
Abstract
An integrated virtual desktop and security management system provides the virtual desktop server functionality and, more importantly, security management for computing devices and servers in the corporate data network. The computing devices include computers running virtual desktop client software and computers running a complete operating system and applications. The system in this invention can intercept data packets exchanged among the computing devices and servers and also can scrutinize virtual machine computing and networking activities, and therefore, possess the capability of analyzing, logging, reporting, and permitting or denying computing and networking activities of devices in the corporate data network.
Claims7
A system to provide virtual desktop and security management service on a local area network (LAN) on which a plurality of virtual machines and a plurality of regular computing devices are interconnected, the system comprising:
- one or more network interfaces for sending packets to and receiving packets from the plurality of regular computing devices on the LAN;
- a Media Access Control (MAC) address;
- a hypervisor over which the plurality of virtual machines are run, the hypervisor comprising a Real Address Resolution Protocol (ARP) Table and a Permitted Flows Database, the Real ARP Table to store mappings between MAC addresses and corresponding Internet Protocol (IP) addresses of the plurality of regular computing devices and the plurality of virtual machines on the LAN, the Permitted Flows Database to store flow entries having packets forwarded according to the Real ARP Table;
- and
- a Deep Packet Inspection (DPI) module, the DPI module to inspect packets received from the hypervisor for enforcing security policies, to install the flow entries in the Permitted Flows Database when future packets corresponding to the flow entries, of the packets received from the hypervisor, require no further inspection at the DPI module for enforcing the security policies, and to forward the packets received from the hypervisor that are permitted by the security policies back to the hypervisor;
- wherein the hypervisor performs functions comprising:
- intercepting packets sent by the plurality of regular computing devices on the LAN and by the plurality of virtual machines running over the hypervisor;
- forwarding intercepted packets that do not correspond to any of the flow entries in the Permitted Flows Database to the DPI module;
- and
- forwarding intercepted packets that correspond to the flow entries in the Permitted Flows Database to intended ones of the plurality of regular computing devices on the LAN and the plurality of virtual machines running over the hypervisor according to the Real ARP Table;
- wherein the hypervisor intercepting packets sent by the plurality of regular computing devices on the LAN comprises:
- sending out gratuitous ARP packets, using the MAC address, to the plurality of regular computing devices to enable the hypervisor to intercept all packets from the plurality of regular computing devices;
- and
- storing MAC addresses and corresponding IP addresses of the intercepted packets of the plurality of regular computing devices and the plurality of virtual machines in the Real ARP Table.
A method for providing integrated virtual desktop and security management service at a virtual desktop server on a local area network (LAN) on which a plurality of virtual machines, hosted on the virtual desktop server, and a plurality of regular computing devices are interconnected, the virtual desktop server comprising a hypervisor, a Deep Packet Inspection (DPI) module, a Real Address Resolution Protocol (ARP) Table, a Permitted Flows Database, and a Media Access Protocol (MAC) address, the method comprising:
- sending out, by the hypervisor, gratuitous ARP packets, using the MAC address, to the plurality of regular computing devices to enable the hypervisor to intercept all packets from the plurality of regular computing devices;
- storing, by the hypervisor, mappings between MAC addresses and corresponding Internet Protocol (IP) addresses of intercepted packets of the plurality of regular computing devices and the plurality of virtual machines in the Real ARP Table, wherein the plurality of regular computing devices and the plurality of virtual machines are interconnected on the LAN;
- inspecting, by the DPI module, packets received from the hypervisor for enforcing security policies;
- installing, by the DPI module, flow entries in the Permitted Flows Database, wherein the Permitted Flows Database stores the flow entries having packets forward according to the Real ARP Table, when the DPI module determines that there is no further need to forward intercepted packets corresponding to the flow entries to the DPI module for enforcing security policies at the DPI module;
- forwarding, by the DPI module, the packets received from the hypervisor that are permitted by the security policies back to the hypervisor;
- intercepting, by the hypervisor, packets sent by the plurality of regular computing devices on the LAN and by the plurality of virtual machines running over the hypervisor;
- forwarding, by the hypervisor, intercepted packets that do not correspond to any of the flow entries in the Permitted Flows Database to the DPI module for enforcing security policies at the DPI module;
- and
- forwarding, by the hypervisor, intercepted packets that correspond to the flow entries in the Permitted Flows Database to intended ones of the plurality of regular computing devices and the plurality of virtual machines according to the Real ARP Table.
Dependencies are inferred from the claim text.