Below-OS security solution for distributed network endpoints

A client system comprising at least one hardware processor configured to:

• receive from a network regulator a hypervisor image in response to sending a boot request to the network regulator over a local network, wherein the network regulator is configured to regulate data transfer between a plurality of client systems and one or more entities, wherein the plurality of client systems are interconnected by the local network, and wherein the one or more entities are outside the local network;
• in response to receiving the hypervisor image, execute the hypervisor image to launch a hypervisor;
• in response to launching the hypervisor,
• expose a client virtual machine (VM) on the client system, the client VM controlled by the hypervisor;
• in response to exposing the client VM,
• load an operating system into the client VM;
• and
• send a hypervisor integrity measurement to the network regulator, the hypervisor integrity measurement characterizing the integrity of the hypervisor,
• and wherein regulating data transfer comprises:
• employing the network regulator to determine whether the hypervisor is in a trusted state according to the hypervisor integrity measurement;
• in response to determining whether the hypervisor is in the trusted state, when the hypervisor is in the trusted state,
• employing the network regulator to allow electronic communications between the client system and the one or more entities outside the local network;
• and
• in response to determining whether the hypervisor is in the trusted state, when the hypervisor is not in the trusted state, employing the network regulator to block electronic communications between the client system and the one or more entities outside the local network.

A non-transitory computer-readable medium storing instructions which, when executed on a processor of a network regulator, cause the network regulator to form a client boot agent and a network filter connected to the boot agent, wherein:

• the network filter is configured to regulate data transfer between a plurality of client systems and one or more entities, wherein the plurality of client systems are interconnected by a local network, and wherein the one or more entities are outside the local network;
• the client boot agent is configured to transmit a hypervisor image to a client system in response to receiving a boot request from the client system over the local network, wherein executing the hypervisor image on a processor of the client system causes the client system to launch a hypervisor configured to:
• expose a client virtual machine (VM) on the client system, the client VM controlled by the hypervisor, and
• load an operating system into the client VM;
• and wherein
• regulating data transfer comprises:
• employing the network filter to determine whether the hypervisor is in a trusted state according to a hypervisor integrity measurement received from the client system, the hypervisor integrity measurement characterizing the integrity of the hypervisor;
• and
• in response to determining whether the hypervisor is in the trusted state, when the hypervisor is in the trusted state,
• employing the network filter to allow electronic communications between the client system and the one or more entities outside the local network, and
• in response to determining whether the hypervisor is in the trusted state, when the hypervisor is not in the trusted state, employing the network filter to block electronic communications between the client system and the one or more entities outside the local network.