US20200285734A1 - Operating a security zone on an air-gapped endpoint - Google Patents
Operating a security zone on an air-gapped endpoint Download PDFInfo
- Publication number
- US20200285734A1 US20200285734A1 US16/879,387 US202016879387A US2020285734A1 US 20200285734 A1 US20200285734 A1 US 20200285734A1 US 202016879387 A US202016879387 A US 202016879387A US 2020285734 A1 US2020285734 A1 US 2020285734A1
- Authority
- US
- United States
- Prior art keywords
- security zone
- policy
- security
- endpoint
- hypervisor
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
- G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/606—Protecting data by securing the transmission between two devices or processes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45537—Provision of facilities of other operating environments, e.g. WINE
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45545—Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
-
- H04L61/2015—
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/50—Address allocation
- H04L61/5007—Internet protocol [IP] addresses
- H04L61/5014—Internet protocol [IP] addresses using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0272—Virtual private networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1491—Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- H04W12/0806—
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/08—Access security
- H04W12/086—Access security using security domains
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45562—Creating, deleting, cloning virtual machine instances
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/4557—Distribution of virtual machine instances; Migration and load balancing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45587—Isolation or security of virtual machine instances
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45591—Monitoring or debugging support
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45595—Network integration; Enabling network access in virtual machine instances
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0263—Rule management
Definitions
- the present disclosure relates generally to security systems, and more specifically to allowing air gapping security using virtual computing.
- Air gapping is a security measure that involves isolating a computer from an external connection.
- an air gapped computer is one that is physically segregated and incapable of connecting wirelessly or physically with other computers or network devices.
- Air gapped systems and networks are used to protect many types of critical systems, such as those utilized in industries including financial, military, government, utility facilities, and the like.
- Preventing a computer or a network from accessing an external network significantly limits the productivity of users using such a computer or network. For example, an application executed on an “air gapped” computer cannot access any resource over the Internet. To do so, the user would need to use a different computer having access to the Internet.
- VMs are containers in which applications and guest operating systems can be executed.
- VMs are containers in which applications and guest operating systems can be executed.
- all VMs are isolated from one another. This isolation enables multiple virtual machines to run securely while sharing hardware.
- a guest operating system running on an individual virtual machine cannot detect any device other than the virtual devices made available to the guest operating system.
- a hypervisor acts as an interface between the guest operating system and the host operating system for some or all of the functions of the guests.
- a host operating system directly interacts with the hardware.
- a host operating system may be Windows®, Linux®, and the like.
- Endpoints e.g., desktop or laptop computer
- VM isolation does not provide a complete defense against malicious code.
- One vulnerability point in such virtualization environments is the host operating system. That is, hackers can exploit security vulnerabilities integrated in such operating systems to propagate malicious code to the hypervisors and then to the guest operating systems.
- a user can install malicious software directly on the host operating systems (i.e., outside of the virtualization environment). To prevent users from installing software directly on the host operating system, such an operating system should be restricted. However, such an approach limits the user experience as the user cannot install applications, plug-ins, change settings, and so on.
- isolation solutions are based on sandboxing of critical applications executed in an endpoint.
- the sandboxing is achieved by running each application in a separate VM. This isolation can also be penetrated by hackers, as the sandboxed applications are executed over a vulnerable host operating system which is controlled by the user and has a wide attack surface.
- Another isolation solution is based on separating any browsing activity from the endpoint to eliminate malware and phishing from websites and emails.
- the browser is executed in a VM in a cloud computing platform, where all webpages are rendered in the cloud and sent to the endpoint for display therein.
- This solution does not defend from other applications executed in a typical endpoint. Further, such solution does not prevent a user from installing malicious software on the endpoint.
- Certain embodiments disclosed herein include a method for operating an air-gapped endpoint is provided.
- the method includes initializing, on the endpoint, a hypervisor for execution over a primitive operating system (OS) of the endpoint; creating an isolated security zone by instantiating a virtual machine using the hypervisor, wherein the security zone includes a plurality of applications executed over a guest OS; and auditing, by the hypervisor, any action performed by any application executed in the security zone.
- OS operating system
- Certain embodiments disclosed herein also include am air-gapped computing system, comprising: a network card interface; a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: initialize, on the endpoint, a hypervisor for execution over a primitive operating system (OS) of the endpoint; create an isolated security zone by instantiating a virtual machine using the hypervisor, wherein the security zone includes a plurality of applications executed over a guest OS; and audit, by the hypervisor, any action performed by any application executed in the security zone.
- OS primitive operating system
- FIG. 1 is a schematic diagram of an endpoint arranged with a virtualized environment according to an embodiment.
- FIG. 2 is a block diagram illustrating the arrangement of a hypervisor according to an embodiment.
- FIG. 3 is a policy diagram of a security policy structured according to an embodiment.
- FIG. 4 is a screenshot of an endpoint display.
- FIG. 5 is a network diagram illustrating a deployment of a management server according to an embodiment.
- FIG. 6 is a flowchart illustrating a method for operating an air-gapped endpoint in a virtualized environment according to an embodiment.
- FIG. 7 is a flowchart illustrating a method for clipping virtual layers in multiple isolated virtual machine environments as a single unified UX (user interface) according to an embodiment.
- a virtualized environment designed to secure endpoints from execution of malicious code is provided.
- the disclosed embodiments allow for operation of any endpoint in a virtual air-gap mode, thereby ensuring that the endpoint is isolated from unsecured resources (such as networks, external drives, and the like).
- the disclosed virtualized environment allows for executing multiple applications in a number of different secured zones, while providing a seamless user experience.
- each zone is isolated from other zones, and each application that can be accessed by a user is executed in one of a few virtualized environments.
- the virtualized environment does not require a full host OS to interface between the security zones and the hardware of the endpoint.
- a user of the endpoint cannot configure any element of the underlying virtualized environment.
- FIG. 1 shows a schematic diagram illustrating an endpoint 100 arranged with a virtualized environment 110 according to an embodiment.
- the endpoint 100 may be a computing device, such as a personal computer (PC) in a form factor of either a laptop or desktop.
- PC personal computer
- the endpoint 100 includes hardware 120 , such as can be found in a standard desktop or laptop computer.
- the hardware 120 may include, for example, a processing circuitry (CPU) 121 , a memory (Mem) 122 , a storage 123 , a network interface card (NIC) 124 , input/output (I/O) peripherals ( 10 P) 125 , a graphics processing unit (GPU) 126 , and a sound card (SC) 127 .
- the processing circuitry 121 may be realized by one or more hardware logic components and circuits.
- the memory 122 may be volatile (e.g., RAM, etc.), non-volatile (e.g., ROM, flash memory, etc.), or a combination thereof.
- the storage 123 may be magnetic storage, optical storage, and the like and may be realized, for example, as flash memory or other memory technology, CD-ROM, Digital Versatile Disks (DVDs) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information.
- the NIC 124 allows the endpoint 100 to communicate with external networks over a wired connection, a wireless connection, or both.
- the NIC 124 may transmit communication media, receive communication media, or both.
- the NIC 124 may in a form of a modem, an integrated network interface, a radio frequency transmitter/receiver, an infrared port, a USB connection, and the like.
- the I/O peripheral 125 allows connectivity to external peripherals, such as a disk drive, printers, wireless keyboard, pointing device, a microphone, a speaker, a docking station, and the like.
- the I/O peripherals 125 may allow connectivity through USB ports, PS/2 ports, Infrared ports, and the like.
- the GPU 126 provides connectivity to a monitor display.
- the sound card 127 (or audio card) provides input and output of audio signals to and from an endpoint under control of guest OS.
- Such components are included in a typical hardware of an endpoint which are not illustrated herein. Such components may include, but are not limited to, a motherboard, a power source, and the like.
- the virtualized environment 110 is designed to provide a complete virtual air-gapping for a plurality of security zones 130 - 1 through 130 - n (hereinafter referred to individually as a security zone 130 and collectively as security zones 130 , merely for simplicity purposes).
- the virtualized environment 110 is also arranged to include a hypervisor 140 controlling the security zones 130 , a networking VM (N-VM) 150 , and a primitive operating system (OS) 160 .
- N-VM networking VM
- OS primitive operating system
- Each security zone 130 is realized as a virtual machine executing a plurality of applications 131 over a guest OS 132 .
- Each security zone 130 is configured to host applications based on their security and sensitivity levels.
- a security zone 130 may be a corporate zone for general corporate applications, a personal zone for untrusted content and applications, a privileged IT zone for production applications, a financial zone for sensitive financial applications (e.g., SWIFT), a zone for critical infrastructure applications (e.g., SCADA), and so on.
- Each security zone 130 is completely isolated from each of the other zones 130 . That is, an application executed in zone 130 - 1 cannot access any content or applications executed in zone 130 - 2 .
- the zone 130 - 1 may be a trusted corporate zone (executing sensitive corporate applications) while the zone 130 - 2 can run applications that can access untrusted applications and resources. That is, the corporate zone 130 - 1 provides access to sensitive corporate resources and can be strictly locked down, while the personal zone 130 - 2 can provide free access to the Internet and allow the user to install and run any application.
- the corporate zone 130 - 1 provides access to sensitive corporate resources and can be strictly locked down, while the personal zone 130 - 2 can provide free access to the Internet and allow the user to install and run any application.
- the virtualized environment 110 provides a complete separation between the zones 130 - 1 and 130 - 2 , thereby providing a complete air-gap between the zones.
- applications from different zones 130 are displayed on the same display, content can be copied from one zone to another (under a control of a user), and switching between zones is seamless.
- the virtualized environment 110 would allow improved productivity for users.
- the operation of the security zones 130 is controlled by the hypervisor 140 .
- the hypervisor 140 is configured to instantiate a VM for each security zone 130 .
- the applications 132 are executed in each corresponding VM.
- the hypervisor 140 is configured to present the zones 130 , and hence the applications 131 executed therein, with a unified user experience (UX).
- UX unified user experience
- the hypervisor 140 is also configured to instantiate the N-VM 150 .
- the N-VM 150 is not accessible to the user, i.e., no user applications are executed therein and no local configuration of the N-VM 150 is allowed.
- the N-VM 150 is configured to control and regulate access to the external networks (not shown in FIG. 1 ) through the NIC 124 . Examples for such networks may include, but are not limited to, the Internet, a local area network (LAN), a virtual private network (VPN), a short-range network (e.g., Bluetooth®), and the like. The operation of the N-VM 150 is discussed in greater detail below.
- the hypervisor 140 is configured to virtualize the components of the hypervisor 140 . That is, for each guest OS 132 , the hypervisor 140 provides a limited set of virtualized hardware services. For example, when the user is in a security zone 130 - 1 an access to a microphone will be permitted to access the applications 131 running in that zone.
- the hypervisor 140 is configured to instantiate and control the VMs, as well as to virtualize hardware services to such VMs. This allows for programming the hypervisor 140 with a significantly lower number of code lines, thereby reducing the risks of vulnerabilities that can be exploited by, for example, the guest OS 132 .
- controlling the VMs (zones 130 ) includes enforcing security policies for each zone, as discussed in greater detail below.
- FIG. 2 is an example block diagram illustrating the arrangement of the hypervisor 140 according to an embodiment.
- the hypervisor 140 includes an abstraction layer 210 that allows the integration with a plurality of commercially available native hypervisors 220 .
- Non-limiting examples for such native hypervisors 220 include Oracle® VM, Microsoft® Hyper-V®, and the like.
- the native hypervisors 220 primarily provide access to guest OSs such as Windows® 10, Windows® 7, Linux, and the like.
- the hypervisor 140 also includes an optimization module 230 configured to perform optimization processes to accelerate or otherwise improve the operation of the native hypervisors 220 .
- optimization processes include, but are not limited to, display optimization (3D and graphic rendering), audio optimization (playback and audio recordings), and power optimization.
- the audio optimization includes bypassing all emulation layers, typically performed by a standard native hypervisor when emulating a sound card ( 127 , FIG. 1 ).
- the optimization module 230 is configured to interact directly with an application layer of a guest OS 131 , so as to receive the audio signals.
- the optimization module 230 replays the audio signals to the audio card (in the host's hardware device). This allows for reducing latency involved by emulating the standard audio hardware, thereby improving latency and performance.
- the display optimization includes causing the GPU ( 126 , FIG. 1 ) to render only specific windows of applications running in a VM (zone), and displaying such windows on a desktop display of another VM.
- the optimization module 236 is configured to provide the GPU 126 only with the regions of the application windows in the guest OS. Such regions can be deducted from the data provided by a guest OS.
- the optimization module 230 is further configured to capture a full screen display of the VM and instruct the GPU 126 to crop that VM's virtual display window while not rendering any region that does not belong to one of the application windows in the guest OS. It should be noted that the GPU 126 would typically show the VM's virtual display as a full screen window. This optimization allows minimal data copy of each frame, resulting in improved video performance.
- the power optimization is designed to extend the operating hours of a battery (not shown).
- the virtualized environment ( 110 , FIG. 1 ) is designed to run multiple operating systems in multiple VMs. This can rapidly drain battery power as there is intensive usage of the processing circuitry ( 121 , FIG. 1 ) and I/O devices by multiple operating systems instead of just one I/O device on a normal machine.
- the optimization module 230 is configured to “freeze” all virtual machines (i.e., change their current states into an idle state) that do not have an active foreground window. In their idle state, VMs no longer consume CPU or perform I/O operations. The applications executed in the idle (frozen) VMs are displayed in their last state before the freeze operation. When the user switches the focus back to one of the frozen VMs, the optimization module 236 changes its state to that of a normal operation. It should be noted that the power optimization provides a security benefit, as a frozen VM cannot be attacked because it does not have any attack-vulnerable surface at that time.
- the hypervisor 140 also includes a security module 240 configured to directly communicate with the VMs 130 and 150 . That is, any request to access the hypervisor 140 is received and handled by the security module 240 .
- a request (or command) to access a resource of the hypervisor 140 is captured by the security module 240 such that the request does not reach the OS 160 .
- a keyboard shortcut e.g., Ctrl+C
- the hypervisor 140 disclosed herein prevents any interfacing of a user device with the primitive OS 160 .
- the primitive OS 160 is configured to merely execute device drivers. For example, a display driver, a printer driver, a PCIe chipset drivers will be executed by the primitive OS 160 .
- the primitive OS 160 does not and cannot access any user applications (e.g., applications installed by a user), any user-controlled OS, or any user commands. That is, the primitive OS 160 cannot execute any code which may be originated from any software installed or uploaded by the user. For example, a user accesses an unsecure website from a browser running in a personal secure zone and unintentionally downloads a malware. The malware cannot access and cannot be executed by the primitive OS 160 . Further, the user cannot directly install software applications outside of the security zones 130 , and specifically cannot install software directly on the primitive OS 160 .
- the primitive OS 160 is configured to execute only pre-signed code. Thus, any malware code will not be executed by the primitive OS 160 .
- the primitive OS 160 cannot access the NIC 124 , thus, cannot access an external network. The communication is performed through the N-VM 150 . To this end, any TCP/IP activity by the primitive OS is controlled and restricted by the N-VM 150 .
- the primitive OS 160 may implement a virtual NIC (not shown) configured with a virtual IP to allow communication with the N-VM 150 .
- the files of the primitive OS 160 are non-persistent, ensuring that the primitive OS 160 is reset to its original configuration after each boot of the endpoint 110 .
- the files of the primitive OS 160 are encrypted, so that cannot be tampered or manipulated.
- the primitive OS 160 may be, for example, Windows®, Mac OS®, or Linux®, that has been configured to allow only execution of drivers and to eliminate any functionality as discussed herein.
- the N-VM 150 is configured to manage network connectivity. That is, the N-VM 150 is monitoring or auditing and policing all communications between the applications 131 in the different security zones 130 and external networks (not shown in FIG. 1 ).
- the N-VM 150 is configured with a network policy (e.g., the network policy 310 , FIG. 3 ) for each security zone 130 determining which networks can be accessed for the zone.
- the network policy may be defined for each application 131 in a zone or for a group of applications.
- the access may be defined with a set of permissions. As an example, a full access to a network resource, a limited access to a network resource, access is permitted after authentication, and so on.
- all network access requests are routed to the N-VM 150 .
- the N-VM 150 is configured to identify for a security zone 130 (i.e., a VM) requesting to access an external network.
- the N-VM 150 allows or denies the access request based on the network policy determined for the requesting zone. As an example, requests from a personal zone to a corporate network will be blocked by the N-VM 150 , while requests from a corporate network to the same network will be allowed.
- the network policies are pre-configured using, for example, a management server (not shown in FIG. 1 ) connected to the endpoint 100 .
- the management server is discussed in detail herein below.
- the primitive OS 160 , the hypervisor 140 , or both do not manage the network connection, and as such do not allow or deny connections to external networks. It should be further appreciated that physical connection to the external networks are established through the NIC 124 under the control of the N-VM 150 .
- the N-VM 150 operates in a non-persistent mode and is reverted to its initial state upon each connect or disconnect event, adding another layer of security in case the N-VM somehow becomes infected.
- the N-VM 150 is configured to perform network identification at various layers, e.g., MAC layer, TCP/IP layer, and application layer (e.g., HTTPS or SSL identification).
- the network policies can be enforced by applying access control or firewall rules at TCP/IP or application layers (e.g., layers 4 or 7 of the OSI module).
- the N-VM 150 is configured to allow connection using VLAN tags or through DHCP proxy implemented in the N-VM 150 .
- the virtualized environment 110 provides a complete virtual air-gapping secured solution to applications executed in each security zone even if one or more of the zones becomes vulnerable.
- the design of the virtualized environment 110 assumes that all VMs, guest OSs, and applications executed in the zones 130 are not trusted. Additional layers of protection are achieved by means of the hypervisor 140 , the N-VM 150 , and the limited functionality of the primitive OS 160 .
- a corporate zone e.g., one of the security zones 130
- a malicious bot communicating with a command-and-control server.
- the bot cannot communicate with its command-and-control server on the Internet, as such access attempt will be blocked by the N-VM 150 . That is, the N-VM 150 may allow access to an internal corporate network or a whitelisted set of cloud hosts, as defined in a network policy for the corporate zone.
- VMs of the security zones 130 are non-persistent. That is, the VMs are initialized to an original configuration after each boot, log off, application event, and so on. That is, VMs infected with malware will return to their initial “clean” state after, e.g., each boot.
- a security policy 300 is preconfigured for a security zone 130 .
- a security policy 300 includes at least a network policy 310 , a user interface (UX) policy 320 , a browsing policy 330 , and a connectivity policy 340 .
- a security policy 300 is configured for each security zone 130 by, for example, a management server.
- the UX policy 320 defines which user interface actions are allowed to be performed by the user in the respective zone. Examples for such actions include, but are not limited to, clipboard, printing, screenshoting, and the like.
- the UX policy 320 can define if the user can copy content and paste such content in a different zone, or if content from a different zone can be pasted in the current zone. Content may include, for example, text, an image, a file and the like. The UX policy 320 may also designate what type of content can be copied, pasted, or both.
- cross-transfer of content between security zones is allowed only when explicitly approved by the user. This ensures that a malware cannot copy content from one zone to another.
- the browsing policy 330 defines a whitelist of URLs or domain names that can be accessed from a browser executed in the respective zone. This allows, for example, blocking browsers from accessing malicious URLs when the user mistakenly browses to such URLs in the wrong security zone. In an optional embodiment, the blocked URL can be accessed and launched in another security zone which is allowed to access that URL. It should be noted that the browsing policy 330 is different from the network policy 310 in that it restricts access to certain URLs after a network established (based on the definitions) defined in the network policy. The network policy 310 is discussed in detailed above.
- the connectivity policy 340 defines a set of allowed peripheral devices through wired or wireless connections.
- the connectivity policy 340 may define if connections through a USB plug are allowed or restricted. Restricted connectivity may limit all connections or connections to designated USB devices (e.g., printer but not Flash Drive). Examples for other wired connections may include, for example, DisplayPort, ThunderboltTM, HDMI, PS/2, and the like. Wireless connections may include short range connections that allow wireless docking of peripheral devices (e.g., WiGigTM), and the like.
- one security zone e.g., 130 - 1
- another secure zone e.g., 130 - 2
- the applications and OS of the primary zone are executed in the foreground, while those of the secondary zone are executed on the background.
- a user can interact with applications of the primary zone, i.e., windows of such applications are displayed on the endpoint's display.
- the applications from the secondary zone can be displayed on the endpoint's display providing the user with the ability to interact with applications from different zones.
- Windows of applications from different zones are optionally marked differently.
- FIG. 4 shows an example screenshot 400 of an endpoint's desktop display showing windows 401 , 402 , and 403 .
- the windows 401 and 402 are of web browsers, while the window 403 is a remote desktop client.
- the application of window 401 is running in a first security zone (e.g., a corporate zone) while the applications of windows 402 and 403 are of the second security zones (e.g., a privileged zone).
- the borders of applications are utilized to distinguish between the first and second zone.
- a user can switch between the windows 410 through 430 , that is, between zones.
- only applications of the primary security zones are displayed.
- application windows in the primary security zone are hidden and the application windows in the secondary security zones are exclusively shown.
- the switching between zone can be performed using a predefined UX command (e.g., Ctrl+F[ 1 ], an icon, a taskbar shortcut, etc.).
- FIG. 5 shows an example network diagram 500 illustrating a deployment of a management server 530 according to an embodiment.
- the security zones can be configured through the management server 530 . This includes defining the type of each zone, the zone's guest OS, and the applications that can be installed and executed in the zone.
- a security zone can be defined to be a corporate zone running Linux OS and corporate approved applications.
- the security policy for the security zone is also defined through the management server 530 .
- a security policy may include network, UX, browser, and connectivity policies.
- the management server 530 may include preconfigured security zones and policies that can be easily uploaded to a new endpoint. In yet another embodiment, the management server 530 can be utilized to clone security zones from one endpoint to another. Therefore, the management server 530 simplifies the process of reconfiguring new endpoints.
- the management server 530 is connected to a plurality of endpoints 510 - 1 through 510 -M (collectively referred to as endpoints 510 ) through a network 520 .
- the network 520 may include a local area network (LAN), a wide area network (WAN), the Internet, and the like.
- the management server 530 may be deployed on-premises of an organization and managed by the IT personnel of the organization.
- the management server 530 may be deployed in a cloud computing platform, such as a private cloud, a public cloud, or a hybrid cloud. In such deployment, the management server 530 can serve a plurality of different tenants.
- the management server 530 is a secured device. As such, only specific designated endpoints can access the management server 530 .
- the server 530 accepts connection requests from endpoints including valid certificates, e.g., SSL client certificates. Such certificates are installed only on the designated endpoints.
- only the endpoint 510 - 2 can access the management server 530 over a secured connection (e.g., SSL connection).
- the endpoint 510 - 2 may be, for example, of an administrator.
- only a specific security zone (VM) within the designated endpoint 510 - 2 can access the management server 530 .
- the management server 530 accesses the endpoints 510 , the access is performed over a secured connection. Any connection attempt made by the management server 530 to an endpoint 510 is verified by a hypervisor (e.g., the hypervisor 140 , FIG. 1 ). That is, the hypervisor verifies the certificate of the management server 530 before accepting a connection with the management server 530 .
- a hypervisor e.g., the hypervisor 140 , FIG. 1
- the management server 530 may be structured as a computing device including a processing circuitry coupled to a memory, a storage, and a network interface (not shown in FIG. 5 ).
- the processing circuitry may be realized as one or more hardware logic components and circuits.
- illustrative types of hardware logic components include field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), Application-specific standard products (ASSPs), system-on-a-chip systems (SOCs), general-purpose microprocessors, microcontrollers, digital signal processors (DSPs), and the like, or any other hardware logic components that can perform calculations or other manipulations of information.
- FPGAs field programmable gate arrays
- ASICs application-specific integrated circuits
- ASSPs Application-specific standard products
- SOCs system-on-a-chip systems
- DSPs digital signal processors
- the memory may be volatile (e.g., RAM, etc.), non-volatile (e.g., ROM, flash memory, etc.), or a combination thereof.
- computer readable instructions to implement one or more embodiments disclosed herein may be stored in the storage.
- the memory is configured to store software.
- Software shall be construed broadly to mean any type of instructions, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise. Instructions may include code (e.g., in source code format, binary code format, executable code format, or any other suitable format of code).
- the instructions when executed by the one or more processors, cause the processing circuitry to perform the various processes described herein with respect to the operation of the management server, such as configuring security zones and policies with the endpoints.
- the storage may be magnetic storage, optical storage, and the like, and may be realized, for example, as flash memory or other memory technology, CD-ROM, Digital Versatile Disks (DVDs), or any other medium which can be used to store the desired information.
- the storage may store the received templates of security zones, policies defined for each zone, SSL certificates, configuration of entire secured zones, and so on.
- FIG. 6 shows an example flowchart 600 illustrating a method for operating an air-gapped endpoint in a virtualized environment according to an embodiment.
- a hypervisor is initialized to be executed over a primitive OS.
- the initialization occurs when the endpoint boots.
- the primitive OS is limited version of an operating system designed to only run drivers of hardware components.
- a plurality of secure zones is created in the endpoint.
- S 610 includes instantiating a plurality of VMs by a hypervisor executed over a primitive OS. Each VM runs its own guest OS and a set of applications.
- a security policy is associated with each security zone defining at least any one of, or a combination of: a network policy, a UX policy, a browsing policy, and a connectivity policy.
- the type of the guest OS, applications and policies of each security zone can be retrieved from the management server, e.g., the server 530 .
- an operating system (OS) booted with the endpoint may be migrated to operate as one of the guest OSs.
- OS operating system
- a networking VM is instantiated by the hypervisor.
- the networking VM is configured with the network policy of each security zone.
- At S 630 at least one security zone is activated to be a primary zone. This allows execution of the security zone's applications in the foreground.
- execution of the applications and guest OS in the at least one security zone are monitored or audited to at least maintain compliance with the security policy.
- all network access attempts are directed to the networking VM.
- the networking VM enforces access to external networks based on the network policy. The operation of the networking VM is discussed in detail above.
- S 640 further includes checking each HTTP request from a web browser to determine if the request is to access an allowed domain name, as defined in the browsing policy. In an embodiment, S 640 further includes capturing UX command initiated by the user and determining, based on the UX policy, if the request UX command is allowed. In yet another embodiment, S 640 monitoring connectivity to peripheral devices to determine if such connectivity is permitted. Such connectivity attempt is performed against the connectivity policy.
- the endpoint can be configured to display applications from different zones, or applications from a different zone only.
- windows of applications from different zones are visually distinguished. All applications regardless of their zone are displayed on a unified UX.
- FIG. 7 is a flowchart 700 illustrating a method for clipping virtual layers in multiple isolated virtual machine environments as a single unified UX (user interface) according to an embodiment.
- a first primary virtual layer (first entity window) within a primary guest is acquired.
- the first virtual layer is configured to execute within a process space of the primary guest executing an operating system in the single user interface.
- a second virtual layer within a secondary guest is acquired.
- the second virtual layer (second entity window) is configured to execute within a process space of the secondary guest separately executing operating systems distinctly from the process space of the primary guest in the single user interface.
- a command to link the first and second virtual layers is received.
- the command may be received through a user interface including a graphical user interface replicating, customizing, or both, of the graphical user interface of operating systems that the host and a plurality of guests separately execute.
- the virtual layers are linked.
- the linkage of such layers causes, when the primary guest is activated, the first and second virtual layers visually to overlap. That is, while operating within distinct operating systems, the primary guest is presented on top.
- the linking is performed at least in part by: specifying, through the user interface, the first virtual layer and the second virtual layer as visually overlapping for including the single user interface as a single desktop environment; executing the command to create OS-specific captured user interface elements clipping, according to the specifying of the first virtual layer and the second virtual layer, such that the first virtual layer and the second virtual layer execute within the process space of distinct operating systems, wherein the primary guest is presented on top; and presenting, through the user interface, the first virtual layer and the second virtual layer as visually overlapping for including the single user interface as a single desktop environment.
- both VM windows can be displayed in such a way that the second VM window is displayed above (thus overlapping) the first VM window. Since the second VM window now contains only the second entity, the achieved configuration is that the second entity displayed on top of the entire first VM content (including the first entity as graphically illustrated in FIG. 8 ).
- the method of flowchart 700 may include receiving a command to also clip the area of the first entity that intersects with the second entity.
- both VM windows can be displayed in such way that the second VM window is displayed on top of the entire first VM content (including the first entity). Since the second VM window now contains only part of the second entity (the entity area that does not overlap with the first entity area), the achieved configuration is that the first entity is on top of the second entity, which is on top of the rest of the first VM content (as graphically illustrated in FIG. 9 ).
- an attempt by a user to modify position, dimensions, state, or a combination thereof, of a guest entity while the virtual clipping layer is active may be identified.
- the modification may be applied to the single desktop environment, such modification as a result of user interaction to graphical user interface in a form of overlapping is updated in real-time.
- the modification can be additionally configured to toggle the activation of the first virtual layer and the second virtual layer in the graphical user interface interchangeably based on the user interaction using the integrated access to the mouse, keyboard, screen, and resources in the single user interface comprising a single desktop environment.
- the user interaction includes managing changes to applications and interface components of the displayed environments based on default security policies, predetermined security policies, or both, using the integrated access to the mouse, keyboard, screen, and resources in the single user interface comprising a single desktop environment in real-time.
- the integrated access to the mouse, keyboard, screen, and resources in the single user interface comprising a single desktop environment in real-time acquires priority condition based on the default security policies, predetermined security policies, or both.
- the keyboard can be redirected to the VM that the top entity (guest window) belongs to.
- the host can also show entities (host windows), that can be displayed on top of the first VM but below the second VM.
- the clipping action will isolate an area in the second VM in the area of the host entity.
- the achieved configuration is that the host entity appears as the top window.
- the modification can also be configured to toggle the activation of the first virtual layer and the second virtual layer in the graphical user interface interchangeably based on the user interaction.
- entities (guest windows) of the second VM can be represented in the task-bar and app-switcher (ALT+TAB) with the corresponding icons, even though they are not running on said VM.
- ALT+TAB app-switcher
- the various embodiments disclosed herein can be implemented as hardware, firmware, software, or any combination thereof.
- the software is preferably implemented as an application program tangibly embodied on a program storage unit or computer readable medium consisting of parts, or of certain devices and/or a combination of devices.
- the application program may be uploaded to, and executed by, a machine comprising any suitable architecture.
- the machine is implemented on a computer platform having hardware such as one or more central processing units (“CPUs”), a memory, and input/output interfaces.
- CPUs central processing units
- the computer platform may also include an operating system and microinstruction code.
- a non-transitory computer readable medium is any computer readable medium except for a transitory propagating signal.
- the phrase “at least one of” followed by a listing of items means that any of the listed items can be utilized individually, or any combination of two or more of the listed items can be utilized. For example, if a system is described as including “at least one of A, B, and C,” the system can include A alone; B alone; C alone; A and B in combination; B and C in combination; A and C in combination; or A, B, and C in combination.
- any reference to an element herein using a designation such as “first,” “second,” and so forth does not generally limit the quantity or order of those elements. Rather, these designations are generally used herein as a convenient method of distinguishing between two or more elements or instances of an element. Thus, a reference to first and second elements does not mean that only two elements may be employed there or that the first element must precede the second element in some manner. Also, unless stated otherwise, a set of elements comprises one or more elements.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computing Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- User Interface Of Digital Computer (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Storage Device Security (AREA)
- Computer And Data Communications (AREA)
Abstract
Description
- This application is a continuation of U.S. patent application Ser. No. 15/808,306 filed Nov. 9, 2017 claims. The Ser. No. 15/808,306 application claims the benefit of U.S. Provisional Application No. 62/449,123 filed on Jan. 23, 2017, the contents of which are hereby incorporated by reference.
- The present disclosure relates generally to security systems, and more specifically to allowing air gapping security using virtual computing.
- Air gapping is a security measure that involves isolating a computer from an external connection. For example, an air gapped computer is one that is physically segregated and incapable of connecting wirelessly or physically with other computers or network devices. Air gapped systems and networks are used to protect many types of critical systems, such as those utilized in industries including financial, military, government, utility facilities, and the like.
- Preventing a computer or a network from accessing an external network significantly limits the productivity of users using such a computer or network. For example, an application executed on an “air gapped” computer cannot access any resource over the Internet. To do so, the user would need to use a different computer having access to the Internet.
- In the related art, there are a number of solutions attempting to isolate different computing environments on a single computer. However, such solutions do not provide a complete air gapping architecture. Furthermore, such solutions often suffer from user experience issues.
- As a prime example, most isolation solutions are based on virtual machine (VM) technologies. That is, VMs are containers in which applications and guest operating systems can be executed. By design, all VMs are isolated from one another. This isolation enables multiple virtual machines to run securely while sharing hardware.
- Although virtual machines share hardware (e.g., CPU, memory, and I/O devices, etc.), a guest operating system running on an individual virtual machine cannot detect any device other than the virtual devices made available to the guest operating system. In various virtualization environments, a hypervisor acts as an interface between the guest operating system and the host operating system for some or all of the functions of the guests. A host operating system directly interacts with the hardware. A host operating system may be Windows®, Linux®, and the like.
- Endpoints (e.g., desktop or laptop computer) configured with VM isolation does not provide a complete defense against malicious code. One vulnerability point in such virtualization environments is the host operating system. That is, hackers can exploit security vulnerabilities integrated in such operating systems to propagate malicious code to the hypervisors and then to the guest operating systems. Further, a user can install malicious software directly on the host operating systems (i.e., outside of the virtualization environment). To prevent users from installing software directly on the host operating system, such an operating system should be restricted. However, such an approach limits the user experience as the user cannot install applications, plug-ins, change settings, and so on.
- Other isolation solutions are based on sandboxing of critical applications executed in an endpoint. The sandboxing is achieved by running each application in a separate VM. This isolation can also be penetrated by hackers, as the sandboxed applications are executed over a vulnerable host operating system which is controlled by the user and has a wide attack surface.
- Another isolation solution is based on separating any browsing activity from the endpoint to eliminate malware and phishing from websites and emails. In such solutions, the browser is executed in a VM in a cloud computing platform, where all webpages are rendered in the cloud and sent to the endpoint for display therein. This solution does not defend from other applications executed in a typical endpoint. Further, such solution does not prevent a user from installing malicious software on the endpoint.
- It would therefore be advantageous to provide a solution that would overcome the deficiencies noted above.
- A summary of several example embodiments of the disclosure follows. This summary is provided for the convenience of the reader to provide a basic understanding of such embodiments and does not wholly define the breadth of the disclosure. This summary is not an extensive overview of all contemplated embodiments, and is intended to neither identify key or critical elements of all embodiments nor to delineate the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a prelude to the more detailed description that is presented later. For convenience, the term “some embodiments” or “certain embodiments” may be used herein to refer to a single embodiment or multiple embodiments of the disclosure.
- Certain embodiments disclosed herein include a method for operating an air-gapped endpoint is provided. The method includes initializing, on the endpoint, a hypervisor for execution over a primitive operating system (OS) of the endpoint; creating an isolated security zone by instantiating a virtual machine using the hypervisor, wherein the security zone includes a plurality of applications executed over a guest OS; and auditing, by the hypervisor, any action performed by any application executed in the security zone.
- Certain embodiments disclosed herein also include am air-gapped computing system, comprising: a network card interface; a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: initialize, on the endpoint, a hypervisor for execution over a primitive operating system (OS) of the endpoint; create an isolated security zone by instantiating a virtual machine using the hypervisor, wherein the security zone includes a plurality of applications executed over a guest OS; and audit, by the hypervisor, any action performed by any application executed in the security zone.
- The subject matter disclosed herein is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other objects, features, and advantages of the disclosed embodiments will be apparent from the following detailed description taken in conjunction with the accompanying drawings.
-
FIG. 1 is a schematic diagram of an endpoint arranged with a virtualized environment according to an embodiment. -
FIG. 2 is a block diagram illustrating the arrangement of a hypervisor according to an embodiment. -
FIG. 3 is a policy diagram of a security policy structured according to an embodiment. -
FIG. 4 is a screenshot of an endpoint display. -
FIG. 5 is a network diagram illustrating a deployment of a management server according to an embodiment. -
FIG. 6 is a flowchart illustrating a method for operating an air-gapped endpoint in a virtualized environment according to an embodiment. -
FIG. 7 is a flowchart illustrating a method for clipping virtual layers in multiple isolated virtual machine environments as a single unified UX (user interface) according to an embodiment. - It is important to note that the embodiments disclosed herein are only examples of the many advantageous uses of the innovative teachings herein. In general, statements made in the specification of the present application do not necessarily limit any of the various claimed embodiments. Moreover, some statements may apply to some inventive features but not to others. In general, unless otherwise indicated, singular elements may be in plural and vice versa with no loss of generality. In the drawings, like numerals refer to like parts through several views.
- By way of example to the disclosed embodiments, a virtualized environment designed to secure endpoints from execution of malicious code is provided. Specifically, the disclosed embodiments allow for operation of any endpoint in a virtual air-gap mode, thereby ensuring that the endpoint is isolated from unsecured resources (such as networks, external drives, and the like). The disclosed virtualized environment allows for executing multiple applications in a number of different secured zones, while providing a seamless user experience.
- In an embodiment, each zone is isolated from other zones, and each application that can be accessed by a user is executed in one of a few virtualized environments. In addition, the virtualized environment does not require a full host OS to interface between the security zones and the hardware of the endpoint. As another security measure, a user of the endpoint cannot configure any element of the underlying virtualized environment.
-
FIG. 1 shows a schematic diagram illustrating anendpoint 100 arranged with a virtualized environment 110 according to an embodiment. Theendpoint 100 may be a computing device, such as a personal computer (PC) in a form factor of either a laptop or desktop. - The
endpoint 100 includeshardware 120, such as can be found in a standard desktop or laptop computer. Thehardware 120 may include, for example, a processing circuitry (CPU) 121, a memory (Mem) 122, astorage 123, a network interface card (NIC) 124, input/output (I/O) peripherals (10P) 125, a graphics processing unit (GPU) 126, and a sound card (SC) 127. Theprocessing circuitry 121 may be realized by one or more hardware logic components and circuits. For example, and without limitation, a general-purpose microprocessor, a central processing unit (CPU), a multi-core CPU, a digital signal processor (DSP), and the like, or any other hardware logic components that can perform calculations or other manipulations of information. Thememory 122 may be volatile (e.g., RAM, etc.), non-volatile (e.g., ROM, flash memory, etc.), or a combination thereof. - The
storage 123 may be magnetic storage, optical storage, and the like and may be realized, for example, as flash memory or other memory technology, CD-ROM, Digital Versatile Disks (DVDs) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information. TheNIC 124 allows theendpoint 100 to communicate with external networks over a wired connection, a wireless connection, or both. - The
NIC 124 may transmit communication media, receive communication media, or both. For example, theNIC 124 may in a form of a modem, an integrated network interface, a radio frequency transmitter/receiver, an infrared port, a USB connection, and the like. - The I/O peripheral 125 allows connectivity to external peripherals, such as a disk drive, printers, wireless keyboard, pointing device, a microphone, a speaker, a docking station, and the like. The I/
O peripherals 125 may allow connectivity through USB ports, PS/2 ports, Infrared ports, and the like. TheGPU 126 provides connectivity to a monitor display. The sound card 127 (or audio card) provides input and output of audio signals to and from an endpoint under control of guest OS. - It should be noted that other hardware components are included in a typical hardware of an endpoint which are not illustrated herein. Such components may include, but are not limited to, a motherboard, a power source, and the like.
- According to the disclosed embodiments, the virtualized environment 110 is designed to provide a complete virtual air-gapping for a plurality of security zones 130-1 through 130-n (hereinafter referred to individually as a
security zone 130 and collectively assecurity zones 130, merely for simplicity purposes). The virtualized environment 110 is also arranged to include ahypervisor 140 controlling thesecurity zones 130, a networking VM (N-VM) 150, and a primitive operating system (OS) 160. - Each
security zone 130 is realized as a virtual machine executing a plurality ofapplications 131 over aguest OS 132. Eachsecurity zone 130 is configured to host applications based on their security and sensitivity levels. For example, asecurity zone 130 may be a corporate zone for general corporate applications, a personal zone for untrusted content and applications, a privileged IT zone for production applications, a financial zone for sensitive financial applications (e.g., SWIFT), a zone for critical infrastructure applications (e.g., SCADA), and so on. - Each
security zone 130 is completely isolated from each of theother zones 130. That is, an application executed in zone 130-1 cannot access any content or applications executed in zone 130-2. - As an example, the zone 130-1 may be a trusted corporate zone (executing sensitive corporate applications) while the zone 130-2 can run applications that can access untrusted applications and resources. That is, the corporate zone 130-1 provides access to sensitive corporate resources and can be strictly locked down, while the personal zone 130-2 can provide free access to the Internet and allow the user to install and run any application.
- According to the disclosed embodiments, the virtualized environment 110 provides a complete separation between the zones 130-1 and 130-2, thereby providing a complete air-gap between the zones. As will be discussed below, applications from
different zones 130 are displayed on the same display, content can be copied from one zone to another (under a control of a user), and switching between zones is seamless. Thus, the virtualized environment 110 would allow improved productivity for users. - The operation of the
security zones 130 is controlled by thehypervisor 140. Specifically, thehypervisor 140 is configured to instantiate a VM for eachsecurity zone 130. Theapplications 132 are executed in each corresponding VM. Thehypervisor 140 is configured to present thezones 130, and hence theapplications 131 executed therein, with a unified user experience (UX). - According to an embodiment, the
hypervisor 140 is also configured to instantiate the N-VM 150. The N-VM 150 is not accessible to the user, i.e., no user applications are executed therein and no local configuration of the N-VM 150 is allowed. The N-VM 150 is configured to control and regulate access to the external networks (not shown inFIG. 1 ) through theNIC 124. Examples for such networks may include, but are not limited to, the Internet, a local area network (LAN), a virtual private network (VPN), a short-range network (e.g., Bluetooth®), and the like. The operation of the N-VM 150 is discussed in greater detail below. - According to the disclosed embodiments, after instantiating the VMs of the
zones 130 and the N-VM 150, thehypervisor 140 is configured to virtualize the components of thehypervisor 140. That is, for eachguest OS 132, thehypervisor 140 provides a limited set of virtualized hardware services. For example, when the user is in a security zone 130-1 an access to a microphone will be permitted to access theapplications 131 running in that zone. - In an embodiment, the
hypervisor 140 is configured to instantiate and control the VMs, as well as to virtualize hardware services to such VMs. This allows for programming thehypervisor 140 with a significantly lower number of code lines, thereby reducing the risks of vulnerabilities that can be exploited by, for example, theguest OS 132. In an embodiment, controlling the VMs (zones 130) includes enforcing security policies for each zone, as discussed in greater detail below. -
FIG. 2 is an example block diagram illustrating the arrangement of thehypervisor 140 according to an embodiment. Thehypervisor 140 includes anabstraction layer 210 that allows the integration with a plurality of commercially availablenative hypervisors 220. Non-limiting examples for suchnative hypervisors 220 include Oracle® VM, Microsoft® Hyper-V®, and the like. Thenative hypervisors 220 primarily provide access to guest OSs such as Windows® 10, Windows® 7, Linux, and the like. - The
hypervisor 140 also includes anoptimization module 230 configured to perform optimization processes to accelerate or otherwise improve the operation of thenative hypervisors 220. Such optimization processes include, but are not limited to, display optimization (3D and graphic rendering), audio optimization (playback and audio recordings), and power optimization. - In an embodiment, the audio optimization includes bypassing all emulation layers, typically performed by a standard native hypervisor when emulating a sound card (127,
FIG. 1 ). To this end, theoptimization module 230 is configured to interact directly with an application layer of aguest OS 131, so as to receive the audio signals. Theoptimization module 230 replays the audio signals to the audio card (in the host's hardware device). This allows for reducing latency involved by emulating the standard audio hardware, thereby improving latency and performance. - In another embodiment, the display optimization includes causing the GPU (126,
FIG. 1 ) to render only specific windows of applications running in a VM (zone), and displaying such windows on a desktop display of another VM. To this end, the optimization module 236 is configured to provide theGPU 126 only with the regions of the application windows in the guest OS. Such regions can be deducted from the data provided by a guest OS. Theoptimization module 230 is further configured to capture a full screen display of the VM and instruct theGPU 126 to crop that VM's virtual display window while not rendering any region that does not belong to one of the application windows in the guest OS. It should be noted that theGPU 126 would typically show the VM's virtual display as a full screen window. This optimization allows minimal data copy of each frame, resulting in improved video performance. - In yet another embodiment, the power optimization is designed to extend the operating hours of a battery (not shown). The virtualized environment (110,
FIG. 1 ) is designed to run multiple operating systems in multiple VMs. This can rapidly drain battery power as there is intensive usage of the processing circuitry (121,FIG. 1 ) and I/O devices by multiple operating systems instead of just one I/O device on a normal machine. - The
optimization module 230 is configured to “freeze” all virtual machines (i.e., change their current states into an idle state) that do not have an active foreground window. In their idle state, VMs no longer consume CPU or perform I/O operations. The applications executed in the idle (frozen) VMs are displayed in their last state before the freeze operation. When the user switches the focus back to one of the frozen VMs, the optimization module 236 changes its state to that of a normal operation. It should be noted that the power optimization provides a security benefit, as a frozen VM cannot be attacked because it does not have any attack-vulnerable surface at that time. - According to the disclosed embodiments, the
hypervisor 140 also includes asecurity module 240 configured to directly communicate with theVMs hypervisor 140 is received and handled by thesecurity module 240. In an embodiment, a request (or command) to access a resource of thehypervisor 140 is captured by thesecurity module 240 such that the request does not reach theOS 160. For example, a keyboard shortcut (e.g., Ctrl+C) would be captured and handled by thehypervisor 140. That is, thehypervisor 140 disclosed herein prevents any interfacing of a user device with theprimitive OS 160. - Returning to
FIG. 1 , theprimitive OS 160 is configured to merely execute device drivers. For example, a display driver, a printer driver, a PCIe chipset drivers will be executed by theprimitive OS 160. Theprimitive OS 160 does not and cannot access any user applications (e.g., applications installed by a user), any user-controlled OS, or any user commands. That is, theprimitive OS 160 cannot execute any code which may be originated from any software installed or uploaded by the user. For example, a user accesses an unsecure website from a browser running in a personal secure zone and unintentionally downloads a malware. The malware cannot access and cannot be executed by theprimitive OS 160. Further, the user cannot directly install software applications outside of thesecurity zones 130, and specifically cannot install software directly on theprimitive OS 160. - In an embodiment, the
primitive OS 160 is configured to execute only pre-signed code. Thus, any malware code will not be executed by theprimitive OS 160. In yet another embodiment, theprimitive OS 160 cannot access theNIC 124, thus, cannot access an external network. The communication is performed through the N-VM 150. To this end, any TCP/IP activity by the primitive OS is controlled and restricted by the N-VM 150. - In an example implementation, the
primitive OS 160 may implement a virtual NIC (not shown) configured with a virtual IP to allow communication with the N-VM 150. In yet another embodiment, the files of theprimitive OS 160 are non-persistent, ensuring that theprimitive OS 160 is reset to its original configuration after each boot of the endpoint 110. In yet another embodiment, the files of theprimitive OS 160 are encrypted, so that cannot be tampered or manipulated. - In an embodiment, the
primitive OS 160 may be, for example, Windows®, Mac OS®, or Linux®, that has been configured to allow only execution of drivers and to eliminate any functionality as discussed herein. - The N-
VM 150 is configured to manage network connectivity. That is, the N-VM 150 is monitoring or auditing and policing all communications between theapplications 131 in thedifferent security zones 130 and external networks (not shown inFIG. 1 ). In an embodiment, the N-VM 150 is configured with a network policy (e.g., thenetwork policy 310,FIG. 3 ) for eachsecurity zone 130 determining which networks can be accessed for the zone. The network policy may be defined for eachapplication 131 in a zone or for a group of applications. Further, the access may be defined with a set of permissions. As an example, a full access to a network resource, a limited access to a network resource, access is permitted after authentication, and so on. - In an embodiment, all network access requests are routed to the N-
VM 150. In response, the N-VM 150 is configured to identify for a security zone 130 (i.e., a VM) requesting to access an external network. The N-VM 150 allows or denies the access request based on the network policy determined for the requesting zone. As an example, requests from a personal zone to a corporate network will be blocked by the N-VM 150, while requests from a corporate network to the same network will be allowed. The network policies are pre-configured using, for example, a management server (not shown inFIG. 1 ) connected to theendpoint 100. The management server is discussed in detail herein below. - It should be appreciated that the
primitive OS 160, thehypervisor 140, or both, do not manage the network connection, and as such do not allow or deny connections to external networks. It should be further appreciated that physical connection to the external networks are established through theNIC 124 under the control of the N-VM 150. The N-VM 150 operates in a non-persistent mode and is reverted to its initial state upon each connect or disconnect event, adding another layer of security in case the N-VM somehow becomes infected. - In an embodiment, the N-
VM 150 is configured to perform network identification at various layers, e.g., MAC layer, TCP/IP layer, and application layer (e.g., HTTPS or SSL identification). In another embodiment, the network policies can be enforced by applying access control or firewall rules at TCP/IP or application layers (e.g., layers 4 or 7 of the OSI module). In yet another embodiment, the N-VM 150 is configured to allow connection using VLAN tags or through DHCP proxy implemented in the N-VM 150. - It should be appreciated that the virtualized environment 110 provides a complete virtual air-gapping secured solution to applications executed in each security zone even if one or more of the zones becomes vulnerable. The design of the virtualized environment 110 assumes that all VMs, guest OSs, and applications executed in the
zones 130 are not trusted. Additional layers of protection are achieved by means of thehypervisor 140, the N-VM 150, and the limited functionality of theprimitive OS 160. - As an example, a corporate zone (e.g., one of the security zones 130) is infected by a malicious bot communicating with a command-and-control server. According to the disclosed embodiments, the bot cannot communicate with its command-and-control server on the Internet, as such access attempt will be blocked by the N-
VM 150. That is, the N-VM 150 may allow access to an internal corporate network or a whitelisted set of cloud hosts, as defined in a network policy for the corporate zone. - In an embodiment, VMs of the
security zones 130 are non-persistent. That is, the VMs are initialized to an original configuration after each boot, log off, application event, and so on. That is, VMs infected with malware will return to their initial “clean” state after, e.g., each boot. - The operation of the
security zones 130 is also regulated by additional preconfigured policies. In an embodiment, illustrated inFIG. 3 , asecurity policy 300 is preconfigured for asecurity zone 130. Asecurity policy 300 includes at least anetwork policy 310, a user interface (UX)policy 320, abrowsing policy 330, and aconnectivity policy 340. Asecurity policy 300 is configured for eachsecurity zone 130 by, for example, a management server. - In an example embodiment, the
UX policy 320 defines which user interface actions are allowed to be performed by the user in the respective zone. Examples for such actions include, but are not limited to, clipboard, printing, screenshoting, and the like. As a non-limiting example, theUX policy 320 can define if the user can copy content and paste such content in a different zone, or if content from a different zone can be pasted in the current zone. Content may include, for example, text, an image, a file and the like. TheUX policy 320 may also designate what type of content can be copied, pasted, or both. - In an embodiment, cross-transfer of content between security zones is allowed only when explicitly approved by the user. This ensures that a malware cannot copy content from one zone to another.
- The
browsing policy 330 defines a whitelist of URLs or domain names that can be accessed from a browser executed in the respective zone. This allows, for example, blocking browsers from accessing malicious URLs when the user mistakenly browses to such URLs in the wrong security zone. In an optional embodiment, the blocked URL can be accessed and launched in another security zone which is allowed to access that URL. It should be noted that thebrowsing policy 330 is different from thenetwork policy 310 in that it restricts access to certain URLs after a network established (based on the definitions) defined in the network policy. Thenetwork policy 310 is discussed in detailed above. - The
connectivity policy 340 defines a set of allowed peripheral devices through wired or wireless connections. As an example, theconnectivity policy 340 may define if connections through a USB plug are allowed or restricted. Restricted connectivity may limit all connections or connections to designated USB devices (e.g., printer but not Flash Drive). Examples for other wired connections may include, for example, DisplayPort, Thunderbolt™, HDMI, PS/2, and the like. Wireless connections may include short range connections that allow wireless docking of peripheral devices (e.g., WiGig™), and the like. - Returning to
FIG. 1 , the disclosed embodiments allow concurrent execution ofapplications 131 fromdifferent security zones 130. In one configuration, one security zone (e.g., 130-1) is set as a primary zone, while another secure zone (e.g., 130-2) is set as a secondary zone. The applications and OS of the primary zone are executed in the foreground, while those of the secondary zone are executed on the background. Primarily, a user can interact with applications of the primary zone, i.e., windows of such applications are displayed on the endpoint's display. - In one embodiment, the applications from the secondary zone can be displayed on the endpoint's display providing the user with the ability to interact with applications from different zones. Windows of applications from different zones are optionally marked differently.
-
FIG. 4 shows anexample screenshot 400 of an endpoint's desktop display showing windows 401, 402, and 403. The windows 401 and 402 are of web browsers, while the window 403 is a remote desktop client. In this example, the application of window 401 is running in a first security zone (e.g., a corporate zone) while the applications of windows 402 and 403 are of the second security zones (e.g., a privileged zone). The borders of applications are utilized to distinguish between the first and second zone. In the embodiment illustrated inFIG. 4 , a user can switch between thewindows 410 through 430, that is, between zones. - In another embodiment, only applications of the primary security zones are displayed. In order to display windows of applications from the secondary security zones, application windows in the primary security zone are hidden and the application windows in the secondary security zones are exclusively shown. The switching between zone can be performed using a predefined UX command (e.g., Ctrl+F[1], an icon, a taskbar shortcut, etc.).
- It should be emphasized that, regardless of the display mode, applications executed in different zones cannot access each other. There is a complete separation between zones and applications executed therein.
-
FIG. 5 shows an example network diagram 500 illustrating a deployment of amanagement server 530 according to an embodiment. As noted above, the security zones can be configured through themanagement server 530. This includes defining the type of each zone, the zone's guest OS, and the applications that can be installed and executed in the zone. For example, a security zone can be defined to be a corporate zone running Linux OS and corporate approved applications. - In another embodiment, the security policy for the security zone is also defined through the
management server 530. As noted above, a security policy may include network, UX, browser, and connectivity policies. - In an embodiment, the
management server 530 may include preconfigured security zones and policies that can be easily uploaded to a new endpoint. In yet another embodiment, themanagement server 530 can be utilized to clone security zones from one endpoint to another. Therefore, themanagement server 530 simplifies the process of reconfiguring new endpoints. - As shown in
FIG. 5 , themanagement server 530 is connected to a plurality of endpoints 510-1 through 510-M (collectively referred to as endpoints 510) through anetwork 520. Thenetwork 520 may include a local area network (LAN), a wide area network (WAN), the Internet, and the like. In an embodiment, themanagement server 530 may be deployed on-premises of an organization and managed by the IT personnel of the organization. In yet another embodiment, themanagement server 530 may be deployed in a cloud computing platform, such as a private cloud, a public cloud, or a hybrid cloud. In such deployment, themanagement server 530 can serve a plurality of different tenants. - According to the disclosed embodiments, the
management server 530 is a secured device. As such, only specific designated endpoints can access themanagement server 530. In an embodiment, theserver 530 accepts connection requests from endpoints including valid certificates, e.g., SSL client certificates. Such certificates are installed only on the designated endpoints. - In the example diagram shown in
FIG. 5 , only the endpoint 510-2 can access themanagement server 530 over a secured connection (e.g., SSL connection). The endpoint 510-2 may be, for example, of an administrator. In a further embodiment, only a specific security zone (VM) within the designated endpoint 510-2 can access themanagement server 530. - Furthermore, when the
management server 530 accesses theendpoints 510, the access is performed over a secured connection. Any connection attempt made by themanagement server 530 to anendpoint 510 is verified by a hypervisor (e.g., thehypervisor 140,FIG. 1 ). That is, the hypervisor verifies the certificate of themanagement server 530 before accepting a connection with themanagement server 530. - The
management server 530 may be structured as a computing device including a processing circuitry coupled to a memory, a storage, and a network interface (not shown inFIG. 5 ). - The processing circuitry may be realized as one or more hardware logic components and circuits. For example, and without limitation, illustrative types of hardware logic components that can be used include field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), Application-specific standard products (ASSPs), system-on-a-chip systems (SOCs), general-purpose microprocessors, microcontrollers, digital signal processors (DSPs), and the like, or any other hardware logic components that can perform calculations or other manipulations of information.
- The memory may be volatile (e.g., RAM, etc.), non-volatile (e.g., ROM, flash memory, etc.), or a combination thereof. In one configuration, computer readable instructions to implement one or more embodiments disclosed herein may be stored in the storage.
- In another embodiment, the memory is configured to store software. Software shall be construed broadly to mean any type of instructions, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise. Instructions may include code (e.g., in source code format, binary code format, executable code format, or any other suitable format of code). The instructions, when executed by the one or more processors, cause the processing circuitry to perform the various processes described herein with respect to the operation of the management server, such as configuring security zones and policies with the endpoints.
- The storage may be magnetic storage, optical storage, and the like, and may be realized, for example, as flash memory or other memory technology, CD-ROM, Digital Versatile Disks (DVDs), or any other medium which can be used to store the desired information. The storage may store the received templates of security zones, policies defined for each zone, SSL certificates, configuration of entire secured zones, and so on.
-
FIG. 6 shows anexample flowchart 600 illustrating a method for operating an air-gapped endpoint in a virtualized environment according to an embodiment. - At S605, a hypervisor is initialized to be executed over a primitive OS. The initialization occurs when the endpoint boots. As discussed in detail above, the primitive OS is limited version of an operating system designed to only run drivers of hardware components.
- At S610, a plurality of secure zones is created in the endpoint. In an embodiment, S610 includes instantiating a plurality of VMs by a hypervisor executed over a primitive OS. Each VM runs its own guest OS and a set of applications. In an embodiment, a security policy is associated with each security zone defining at least any one of, or a combination of: a network policy, a UX policy, a browsing policy, and a connectivity policy. The type of the guest OS, applications and policies of each security zone can be retrieved from the management server, e.g., the
server 530. In an embodiment, an operating system (OS) booted with the endpoint may be migrated to operate as one of the guest OSs. - At S620, a networking VM is instantiated by the hypervisor. In an embodiment, the networking VM is configured with the network policy of each security zone.
- At S630, at least one security zone is activated to be a primary zone. This allows execution of the security zone's applications in the foreground.
- At S640, execution of the applications and guest OS in the at least one security zone are monitored or audited to at least maintain compliance with the security policy. To this end, all network access attempts are directed to the networking VM. The networking VM enforces access to external networks based on the network policy. The operation of the networking VM is discussed in detail above.
- In an embodiment, S640 further includes checking each HTTP request from a web browser to determine if the request is to access an allowed domain name, as defined in the browsing policy. In an embodiment, S640 further includes capturing UX command initiated by the user and determining, based on the UX policy, if the request UX command is allowed. In yet another embodiment, S640 monitoring connectivity to peripheral devices to determine if such connectivity is permitted. Such connectivity attempt is performed against the connectivity policy.
- As noted above, two or more security zones can be concurrently executed in the virtualized environment concurrently. The endpoint can be configured to display applications from different zones, or applications from a different zone only. In an embodiment, windows of applications from different zones are visually distinguished. All applications regardless of their zone are displayed on a unified UX.
-
FIG. 7 is aflowchart 700 illustrating a method for clipping virtual layers in multiple isolated virtual machine environments as a single unified UX (user interface) according to an embodiment. - At S710, a first primary virtual layer (first entity window) within a primary guest is acquired. The first virtual layer is configured to execute within a process space of the primary guest executing an operating system in the single user interface.
- At S720, a second virtual layer within a secondary guest is acquired. The second virtual layer (second entity window) is configured to execute within a process space of the secondary guest separately executing operating systems distinctly from the process space of the primary guest in the single user interface.
- At S730, a command to link the first and second virtual layers is received. The command may be received through a user interface including a graphical user interface replicating, customizing, or both, of the graphical user interface of operating systems that the host and a plurality of guests separately execute.
- At S740, the virtual layers are linked. The linkage of such layers causes, when the primary guest is activated, the first and second virtual layers visually to overlap. That is, while operating within distinct operating systems, the primary guest is presented on top.
- In an embodiment, the linking is performed at least in part by: specifying, through the user interface, the first virtual layer and the second virtual layer as visually overlapping for including the single user interface as a single desktop environment; executing the command to create OS-specific captured user interface elements clipping, according to the specifying of the first virtual layer and the second virtual layer, such that the first virtual layer and the second virtual layer execute within the process space of distinct operating systems, wherein the primary guest is presented on top; and presenting, through the user interface, the first virtual layer and the second virtual layer as visually overlapping for including the single user interface as a single desktop environment.
- In the endpoint's display, both VM windows can be displayed in such a way that the second VM window is displayed above (thus overlapping) the first VM window. Since the second VM window now contains only the second entity, the achieved configuration is that the second entity displayed on top of the entire first VM content (including the first entity as graphically illustrated in
FIG. 8 ). - In another embodiment, the method of
flowchart 700 may include receiving a command to also clip the area of the first entity that intersects with the second entity. In the endpoint's display, both VM windows can be displayed in such way that the second VM window is displayed on top of the entire first VM content (including the first entity). Since the second VM window now contains only part of the second entity (the entity area that does not overlap with the first entity area), the achieved configuration is that the first entity is on top of the second entity, which is on top of the rest of the first VM content (as graphically illustrated inFIG. 9 ). - Upon completion of the clipping process, an attempt by a user to modify position, dimensions, state, or a combination thereof, of a guest entity while the virtual clipping layer is active may be identified. The modification may be applied to the single desktop environment, such modification as a result of user interaction to graphical user interface in a form of overlapping is updated in real-time.
- The modification can be additionally configured to toggle the activation of the first virtual layer and the second virtual layer in the graphical user interface interchangeably based on the user interaction using the integrated access to the mouse, keyboard, screen, and resources in the single user interface comprising a single desktop environment. The user interaction includes managing changes to applications and interface components of the displayed environments based on default security policies, predetermined security policies, or both, using the integrated access to the mouse, keyboard, screen, and resources in the single user interface comprising a single desktop environment in real-time. The integrated access to the mouse, keyboard, screen, and resources in the single user interface comprising a single desktop environment in real-time acquires priority condition based on the default security policies, predetermined security policies, or both. For example, the keyboard can be redirected to the VM that the top entity (guest window) belongs to. The host can also show entities (host windows), that can be displayed on top of the first VM but below the second VM. The clipping action will isolate an area in the second VM in the area of the host entity. The achieved configuration is that the host entity appears as the top window. The modification can also be configured to toggle the activation of the first virtual layer and the second virtual layer in the graphical user interface interchangeably based on the user interaction.
- In an embodiment, entities (guest windows) of the second VM can be represented in the task-bar and app-switcher (ALT+TAB) with the corresponding icons, even though they are not running on said VM. This creates an illusion for the user that the entities from the second VM are running on the first VM (or in other words, that entities from both VMs are all running on the first primary VM).
- The various embodiments disclosed herein can be implemented as hardware, firmware, software, or any combination thereof. Moreover, the software is preferably implemented as an application program tangibly embodied on a program storage unit or computer readable medium consisting of parts, or of certain devices and/or a combination of devices. The application program may be uploaded to, and executed by, a machine comprising any suitable architecture. Preferably, the machine is implemented on a computer platform having hardware such as one or more central processing units (“CPUs”), a memory, and input/output interfaces. The computer platform may also include an operating system and microinstruction code. The various processes and functions described herein may be either part of the microinstruction code or part of the application program, or any combination thereof, which may be executed by a CPU, whether or not such a computer or processor is explicitly shown. In addition, various other peripheral units may be connected to the computer platform such as an additional data storage unit and a printing unit. Furthermore, a non-transitory computer readable medium is any computer readable medium except for a transitory propagating signal.
- All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the principles of the disclosed embodiment and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions. Moreover, all statements herein reciting principles, aspects, and embodiments of the disclosed embodiments, as well as specific examples thereof, are intended to encompass both structural and functional equivalents thereof. Additionally, it is intended that such equivalents include both currently known equivalents as well as equivalents developed in the future, i.e., any elements developed that perform the same function, regardless of structure.
- As used herein, the phrase “at least one of” followed by a listing of items means that any of the listed items can be utilized individually, or any combination of two or more of the listed items can be utilized. For example, if a system is described as including “at least one of A, B, and C,” the system can include A alone; B alone; C alone; A and B in combination; B and C in combination; A and C in combination; or A, B, and C in combination.
- It should be understood that any reference to an element herein using a designation such as “first,” “second,” and so forth does not generally limit the quantity or order of those elements. Rather, these designations are generally used herein as a convenient method of distinguishing between two or more elements or instances of an element. Thus, a reference to first and second elements does not mean that only two elements may be employed there or that the first element must precede the second element in some manner. Also, unless stated otherwise, a set of elements comprises one or more elements.
Claims (21)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US16/879,387 US20200285734A1 (en) | 2017-01-23 | 2020-05-20 | Operating a security zone on an air-gapped endpoint |
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201762449123P | 2017-01-23 | 2017-01-23 | |
US15/808,306 US10699003B2 (en) | 2017-01-23 | 2017-11-09 | Virtual air-gapped endpoint, and methods thereof |
US16/879,387 US20200285734A1 (en) | 2017-01-23 | 2020-05-20 | Operating a security zone on an air-gapped endpoint |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/808,306 Continuation US10699003B2 (en) | 2017-01-23 | 2017-11-09 | Virtual air-gapped endpoint, and methods thereof |
Publications (1)
Publication Number | Publication Date |
---|---|
US20200285734A1 true US20200285734A1 (en) | 2020-09-10 |
Family
ID=62906364
Family Applications (6)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/808,306 Active 2038-06-09 US10699003B2 (en) | 2017-01-23 | 2017-11-09 | Virtual air-gapped endpoint, and methods thereof |
US15/876,654 Active 2038-09-10 US10699004B2 (en) | 2017-01-23 | 2018-01-22 | Techniques for improving seamless user experience on air-gapped endpoints |
US15/876,675 Active 2038-09-10 US10699005B2 (en) | 2017-01-23 | 2018-01-22 | Techniques for controlling and regulating network access on air-gapped endpoints |
US16/879,380 Active 2038-10-06 US11537710B2 (en) | 2017-01-23 | 2020-05-20 | Method for rendering virtual desktops on an air-gapped endpoint |
US16/879,401 Active 2038-10-05 US11531749B2 (en) | 2017-01-23 | 2020-05-20 | Controlling access to external networks by an air-gapped endpoint |
US16/879,387 Abandoned US20200285734A1 (en) | 2017-01-23 | 2020-05-20 | Operating a security zone on an air-gapped endpoint |
Family Applications Before (5)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/808,306 Active 2038-06-09 US10699003B2 (en) | 2017-01-23 | 2017-11-09 | Virtual air-gapped endpoint, and methods thereof |
US15/876,654 Active 2038-09-10 US10699004B2 (en) | 2017-01-23 | 2018-01-22 | Techniques for improving seamless user experience on air-gapped endpoints |
US15/876,675 Active 2038-09-10 US10699005B2 (en) | 2017-01-23 | 2018-01-22 | Techniques for controlling and regulating network access on air-gapped endpoints |
US16/879,380 Active 2038-10-06 US11537710B2 (en) | 2017-01-23 | 2020-05-20 | Method for rendering virtual desktops on an air-gapped endpoint |
US16/879,401 Active 2038-10-05 US11531749B2 (en) | 2017-01-23 | 2020-05-20 | Controlling access to external networks by an air-gapped endpoint |
Country Status (1)
Country | Link |
---|---|
US (6) | US10699003B2 (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20220060476A1 (en) * | 2017-12-05 | 2022-02-24 | Goldilock Secure s.r.o. | Air gap-based network isolation device |
US20220191204A1 (en) * | 2017-12-05 | 2022-06-16 | Goldilock Secure s.r.o. | Air gap-based network isolation device |
Families Citing this family (13)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9935813B2 (en) * | 2011-12-20 | 2018-04-03 | Blackberry Limited | Virtual window screen rendering using application connectors |
US20190114630A1 (en) | 2017-09-29 | 2019-04-18 | Stratus Digital Systems | Transient Transaction Server DNS Strategy |
CN109792446A (en) * | 2016-10-03 | 2019-05-21 | 斯特拉图斯数字系统公司 | Transient state trading server |
US10693909B2 (en) * | 2018-01-19 | 2020-06-23 | International Business Machines Corporation | Securing an endpoint in a computer network |
US11212084B2 (en) * | 2018-07-21 | 2021-12-28 | Fundacja “Blockchain Development Foundation” | System and a method for signing transactions using air-gapped private keys |
CN110780871A (en) * | 2018-07-31 | 2020-02-11 | 中兴通讯股份有限公司 | Negative one-screen loading method and device, terminal and computer readable storage medium |
US11138313B2 (en) | 2018-08-13 | 2021-10-05 | Juniper Networks, Inc. | Malware detection based on user interactions |
CN109167796B (en) * | 2018-09-30 | 2020-05-19 | 浙江大学 | Deep packet inspection platform based on industrial SCADA system |
US12047390B2 (en) | 2020-05-06 | 2024-07-23 | Kyndryl, Inc. | Device connectivity power control |
CN114168239B (en) * | 2021-10-21 | 2024-04-30 | 北京字节跳动网络技术有限公司 | Window display method, device, equipment and storage medium |
US20230251842A1 (en) * | 2022-01-13 | 2023-08-10 | Vmware, Inc. | Application installation on a remote desktop using local installation files |
CN114898506B (en) * | 2022-05-12 | 2023-06-27 | 南京百米需供应链管理有限公司 | Intelligent cabinet control system and control method |
US12040977B1 (en) * | 2023-06-13 | 2024-07-16 | Zscaler, Inc. | Systems and methods for providing secure software-as-a-service (SaaS) access from unmanaged devices |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20110167473A1 (en) * | 2009-11-02 | 2011-07-07 | International Business Machines Corporation | Endpoint-Hosted Hypervisor Management |
US20120222084A1 (en) * | 2011-02-25 | 2012-08-30 | International Business Machines Corporation | Virtual Securty Zones for Data Processing Environments |
US20150139238A1 (en) * | 2013-11-18 | 2015-05-21 | Telefonaktiebolaget L M Ericsson (Publ) | Multi-tenant isolation in a cloud environment using software defined networking |
US20170235951A1 (en) * | 2016-02-12 | 2017-08-17 | Sophos Limited | Virtual machine security |
US20170302692A1 (en) * | 2008-09-12 | 2017-10-19 | George Mason Research Foundation, Inc. | Methods and apparatus for application isolation |
US10885189B2 (en) * | 2017-05-22 | 2021-01-05 | Microsoft Technology Licensing, Llc | Isolated container event monitoring |
Family Cites Families (71)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6496847B1 (en) * | 1998-05-15 | 2002-12-17 | Vmware, Inc. | System and method for virtualizing computer systems |
US6745333B1 (en) * | 2002-01-31 | 2004-06-01 | 3Com Corporation | Method for detecting unauthorized network access by having a NIC monitor for packets purporting to be from itself |
US8972977B2 (en) * | 2004-06-30 | 2015-03-03 | Microsoft Technology Licensing, Llc | Systems and methods for providing seamless software compatibility using virtual machines |
US8274518B2 (en) * | 2004-12-30 | 2012-09-25 | Microsoft Corporation | Systems and methods for virtualizing graphics subsystems |
US7698706B2 (en) * | 2005-05-20 | 2010-04-13 | International Business Machines Corporation | Methods and apparatus for implementing an integrated user interface for managing multiple virtual machines operative in a computing system |
US8555274B1 (en) | 2006-03-31 | 2013-10-08 | Vmware, Inc. | Virtualized desktop allocation system using virtual infrastructure |
US8117554B1 (en) * | 2006-04-25 | 2012-02-14 | Parallels Holdings, Ltd. | Seamless integration of non-native widgets and windows with dynamically scalable resolution into native operating system |
US8209408B1 (en) * | 2006-05-01 | 2012-06-26 | Vmware, Inc. | Multiple virtual machine consoles in a single interface |
US8141075B1 (en) | 2006-05-08 | 2012-03-20 | Vmware, Inc. | Rule engine for virtualized desktop allocation system |
US20070288247A1 (en) | 2006-06-11 | 2007-12-13 | Michael Mackay | Digital life server |
US8220047B1 (en) | 2006-08-09 | 2012-07-10 | Google Inc. | Anti-phishing system and method |
US8165101B2 (en) * | 2006-09-29 | 2012-04-24 | Microsoft Corporation | Automatic detection of hidden networks |
US8856782B2 (en) | 2007-03-01 | 2014-10-07 | George Mason Research Foundation, Inc. | On-demand disposable virtual work system |
US20080228865A1 (en) | 2007-03-15 | 2008-09-18 | Nazareno Brier Cruzada | Electronic personal computing and videophone system consisting of a remote server system providing dynamic, subscription based virtual computing services & resources, a thin client hardware device connected to a television set and wireless keyboard & mouse, and a wireless mobile device (a Pocket PC Phone) |
US8060876B2 (en) * | 2007-08-10 | 2011-11-15 | Intel Corporation | Methods and apparatus for creating an isolated partition for a virtual trusted platform module |
JP4488077B2 (en) * | 2008-02-29 | 2010-06-23 | 日本電気株式会社 | Virtualization system, virtualization method, and virtualization program |
US8065714B2 (en) * | 2008-09-12 | 2011-11-22 | Hytrust, Inc. | Methods and systems for securely managing virtualization platform |
US8924961B2 (en) | 2008-10-29 | 2014-12-30 | Dell Products L.P. | Virtual machine scheduling methods and systems |
US8856783B2 (en) | 2010-10-12 | 2014-10-07 | Citrix Systems, Inc. | Allocating virtual machines according to user-specific virtual machine metrics |
US9552497B2 (en) * | 2009-11-10 | 2017-01-24 | Mcafee, Inc. | System and method for preventing data loss using virtual machine wrapped applications |
US8572706B2 (en) * | 2010-04-26 | 2013-10-29 | Vmware, Inc. | Policy engine for cloud platform |
EP2569698B1 (en) * | 2010-05-10 | 2019-07-10 | Citrix Systems, Inc. | Redirection of information from secure virtual machines to unsecure virtual machines |
US8752047B2 (en) * | 2010-05-28 | 2014-06-10 | Bromium, Inc. | Automated management of virtual machines to process untrusted data based on client policy information |
US10310696B1 (en) * | 2010-05-28 | 2019-06-04 | Bromium, Inc. | Supporting a consistent user interface within a virtualized environment |
US9116733B2 (en) | 2010-05-28 | 2015-08-25 | Bromium, Inc. | Automated provisioning of secure virtual execution environment using virtual machine templates based on requested activity |
US9386021B1 (en) | 2011-05-25 | 2016-07-05 | Bromium, Inc. | Restricting network access to untrusted virtual machines |
US9148428B1 (en) * | 2011-05-25 | 2015-09-29 | Bromium, Inc. | Seamless management of untrusted data using virtual machines |
US8171176B2 (en) | 2010-08-31 | 2012-05-01 | Lsi Corporation | Method for selective replication of physical devices on a virtual self-configuring zoning expander |
US9384029B1 (en) | 2010-09-30 | 2016-07-05 | Amazon Technologies, Inc. | Managing virtual computing nodes |
US8910277B1 (en) * | 2010-12-22 | 2014-12-09 | Google Inc. | Process-based domain isolation |
US9210213B2 (en) * | 2011-03-03 | 2015-12-08 | Citrix Systems, Inc. | Reverse seamless integration between local and remote computing environments |
WO2012131933A1 (en) * | 2011-03-30 | 2012-10-04 | 富士通株式会社 | Information processing device, program, and analysis method |
US8966581B1 (en) | 2011-04-07 | 2015-02-24 | Vmware, Inc. | Decrypting an encrypted virtual machine using asymmetric key encryption |
US9100188B2 (en) * | 2011-04-18 | 2015-08-04 | Bank Of America Corporation | Hardware-based root of trust for cloud environments |
CA2876380C (en) | 2011-06-13 | 2021-03-16 | Lynx Software Technologies Inc. | Systems and methods of secure domain isolation |
US8966004B2 (en) * | 2011-09-29 | 2015-02-24 | Comcast Cable Communications, LLC. | Multiple virtual machines in a mobile virtualization platform |
DE102012217202B4 (en) | 2011-10-12 | 2020-06-18 | International Business Machines Corporation | Method and system for optimizing the placement of virtual machines in cloud computing environments |
US20130093776A1 (en) | 2011-10-14 | 2013-04-18 | Microsoft Corporation | Delivering a Single End User Experience to a Client from Multiple Servers |
US8893261B2 (en) * | 2011-11-22 | 2014-11-18 | Vmware, Inc. | Method and system for VPN isolation using network namespaces |
SG11201403482TA (en) | 2011-12-21 | 2014-07-30 | Ssh Comm Security Oyj | Automated access, key, certificate, and credential management |
US8745745B2 (en) | 2012-06-26 | 2014-06-03 | Lynuxworks, Inc. | Systems and methods involving features of hardware virtualization such as separation kernel hypervisors, hypervisors, hypervisor guest context, hypervisor context, rootkit detection/prevention, and/or other features |
US9069766B2 (en) * | 2012-11-02 | 2015-06-30 | Microsoft Technology Licensing, Llc | Content-based isolation for computing device security |
US9584544B2 (en) * | 2013-03-12 | 2017-02-28 | Red Hat Israel, Ltd. | Secured logical component for security in a virtual environment |
US9565202B1 (en) | 2013-03-13 | 2017-02-07 | Fireeye, Inc. | System and method for detecting exfiltration content |
US9641559B2 (en) | 2013-03-15 | 2017-05-02 | Swyme Ip Bv | Methods and systems for dynamic adjustment of session parameters for effective video collaboration among heterogeneous devices |
US9292328B2 (en) | 2013-05-24 | 2016-03-22 | Bromium, Inc. | Management of supervisor mode execution protection (SMEP) by a hypervisor |
US20150006930A1 (en) * | 2013-06-28 | 2015-01-01 | Lexmark International, Inc. | Systems and Methods for Power Management |
CN105830477A (en) * | 2013-08-12 | 2016-08-03 | 哥莱菲特软件公司 | Operating system integrated domain management |
KR102033009B1 (en) | 2013-09-13 | 2019-10-16 | 한국전자통신연구원 | Cyber physical system and virtual machine monitoring method thereof |
US9202046B2 (en) * | 2014-03-03 | 2015-12-01 | Bitdefender IPR Management Ltd. | Systems and methods for executing arbitrary applications in secure environments |
US20150277949A1 (en) * | 2014-03-27 | 2015-10-01 | Thiam Wah Loh | Securing shared interconnect for virtual machine |
WO2015175753A1 (en) | 2014-05-14 | 2015-11-19 | Hay Peter Mcclelland | Systems and methods for ensuring computer system security via a virtualized layer of application abstraction |
US9781055B2 (en) * | 2014-08-18 | 2017-10-03 | Cisco Technology, Inc. | Dynamic cascaded clustering for dynamic VNF |
US9600312B2 (en) | 2014-09-30 | 2017-03-21 | Amazon Technologies, Inc. | Threading as a service |
US9602525B2 (en) * | 2015-02-27 | 2017-03-21 | Cisco Technology, Inc. | Classification of malware generated domain names |
US10148693B2 (en) * | 2015-03-25 | 2018-12-04 | Fireeye, Inc. | Exploit detection system |
US10417031B2 (en) * | 2015-03-31 | 2019-09-17 | Fireeye, Inc. | Selective virtualization for security threat detection |
WO2016181423A1 (en) * | 2015-05-11 | 2016-11-17 | Nec Corporation | Communication apparaus, system, method, and program |
US11381566B2 (en) | 2015-08-12 | 2022-07-05 | Red Hat, Inc. | Isolating network resources in a virtualized environment |
US9792143B1 (en) | 2015-10-23 | 2017-10-17 | Amazon Technologies, Inc. | Platform secure execution modes |
US9794292B2 (en) | 2015-10-26 | 2017-10-17 | Amazon Technologies, Inc. | Providing fine-grained access remote command execution for virtual machine instances in a distributed computing environment |
US9832024B2 (en) * | 2015-11-13 | 2017-11-28 | Visa International Service Association | Methods and systems for PKI-based authentication |
US20170180325A1 (en) * | 2015-12-22 | 2017-06-22 | Intel Corporation | Technologies for enforcing network access control of virtual machines |
US10055144B1 (en) | 2016-03-30 | 2018-08-21 | Amazon Technologies, Inc. | Configurable storage drive |
US10505806B2 (en) * | 2016-08-29 | 2019-12-10 | Vmware, Inc. | Learning and deploying datacenter landscapes |
CN107959582B (en) | 2016-10-18 | 2020-12-01 | 华为技术有限公司 | Slice instance management method and device |
CN108370595B (en) * | 2016-10-28 | 2021-09-28 | 慧与发展有限责任合伙企业 | Multi-connection access point |
US11010352B2 (en) * | 2017-01-23 | 2021-05-18 | Hysolate Ltd. | Unified file system on air-gapped endpoints |
US20190109768A1 (en) | 2017-10-06 | 2019-04-11 | Huawei Technologies Co., Ltd. | Management of network slices and associated services |
US10805406B2 (en) * | 2018-06-21 | 2020-10-13 | Microsoft Technology Licensing, Llc | Zone redundant computing services using multiple local services in distributed computing systems |
US10922423B1 (en) | 2018-06-21 | 2021-02-16 | Amazon Technologies, Inc. | Request context generator for security policy validation service |
-
2017
- 2017-11-09 US US15/808,306 patent/US10699003B2/en active Active
-
2018
- 2018-01-22 US US15/876,654 patent/US10699004B2/en active Active
- 2018-01-22 US US15/876,675 patent/US10699005B2/en active Active
-
2020
- 2020-05-20 US US16/879,380 patent/US11537710B2/en active Active
- 2020-05-20 US US16/879,401 patent/US11531749B2/en active Active
- 2020-05-20 US US16/879,387 patent/US20200285734A1/en not_active Abandoned
Patent Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20170302692A1 (en) * | 2008-09-12 | 2017-10-19 | George Mason Research Foundation, Inc. | Methods and apparatus for application isolation |
US20110167473A1 (en) * | 2009-11-02 | 2011-07-07 | International Business Machines Corporation | Endpoint-Hosted Hypervisor Management |
US20120222084A1 (en) * | 2011-02-25 | 2012-08-30 | International Business Machines Corporation | Virtual Securty Zones for Data Processing Environments |
US20150139238A1 (en) * | 2013-11-18 | 2015-05-21 | Telefonaktiebolaget L M Ericsson (Publ) | Multi-tenant isolation in a cloud environment using software defined networking |
US20170235951A1 (en) * | 2016-02-12 | 2017-08-17 | Sophos Limited | Virtual machine security |
US10885189B2 (en) * | 2017-05-22 | 2021-01-05 | Microsoft Technology Licensing, Llc | Isolated container event monitoring |
Non-Patent Citations (1)
Title |
---|
Tholeti, Dive into the Xen hypervisor, 09/24/2011, IBM, 7 Pages (Year: 2011) * |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20220060476A1 (en) * | 2017-12-05 | 2022-02-24 | Goldilock Secure s.r.o. | Air gap-based network isolation device |
US20220191204A1 (en) * | 2017-12-05 | 2022-06-16 | Goldilock Secure s.r.o. | Air gap-based network isolation device |
US11616781B2 (en) * | 2017-12-05 | 2023-03-28 | Goldilock Secure s.r.o. | Air gap-based network isolation device |
Also Published As
Publication number | Publication date |
---|---|
US20180213002A1 (en) | 2018-07-26 |
US20180213001A1 (en) | 2018-07-26 |
US20200279042A1 (en) | 2020-09-03 |
US11537710B2 (en) | 2022-12-27 |
US10699004B2 (en) | 2020-06-30 |
US20180211036A1 (en) | 2018-07-26 |
US20200285735A1 (en) | 2020-09-10 |
US10699005B2 (en) | 2020-06-30 |
US11531749B2 (en) | 2022-12-20 |
US10699003B2 (en) | 2020-06-30 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20200285734A1 (en) | Operating a security zone on an air-gapped endpoint | |
US11010352B2 (en) | Unified file system on air-gapped endpoints | |
Pék et al. | A survey of security issues in hardware virtualization | |
US9923926B1 (en) | Seamless management of untrusted data using isolated environments | |
US9626204B1 (en) | Automated provisioning of secure virtual execution environment using virtual machine templates based on source code origin | |
EP3049985B1 (en) | A separate, disposable execution environment for accessing unverified content | |
US8972980B2 (en) | Automated provisioning of secure virtual execution environment using virtual machine templates based on requested activity | |
US9319380B2 (en) | Below-OS security solution for distributed network endpoints | |
US20220004623A1 (en) | Managed isolated workspace on a user device | |
US9767274B2 (en) | Approaches for efficient physical to virtual disk conversion | |
US11599675B2 (en) | Detecting data leakage to websites accessed using a remote browsing infrastructure | |
WO2021242618A1 (en) | System for tuning a device having security software for security and performance | |
EP3516841B1 (en) | Remote computing system providing malicious file detection and mitigation features for virtual machines | |
US11308204B2 (en) | Agentless security | |
WO2020263917A1 (en) | Cloud-based shared security cache | |
US11150936B2 (en) | Techniques for binding user identities to appropriate virtual machines with single sign-on | |
US11153322B2 (en) | Techniques for seamlessly launching applications in appropriate virtual machines | |
England et al. | Virtual machines for enterprise desktop security | |
Banga et al. | Trustworthy computing for the cloud-mobile era: A leap forward in systems architecture | |
Verma et al. | Next‐Generation Optimization Models and Algorithms in Cloud and Fog Computing Virtualization Security: The Present State and Future | |
Ramos | Security challenges with virtualization | |
dos Santos Ramos | Security challenges with virtualization | |
Rutkowska | Software compartmentalization vs. physical separation | |
Kar | Planning a virtual lab for analysis of malware: A study of virtualization on an Intel platform |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: HYSOLATE LTD., ISRAEL Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:ZAMIR, TAL;ZLOTNIK, OLEG;FIGOVSKY, BORIS;AND OTHERS;REEL/FRAME:052716/0103 Effective date: 20200519 |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: APPLICATION DISPATCHED FROM PREEXAM, NOT YET DOCKETED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
AS | Assignment |
Owner name: PERCEPTION POINT LTD., ISRAEL Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:HYSOLATE LTD.;REEL/FRAME:060958/0747 Effective date: 20220401 |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
AS | Assignment |
Owner name: KREOS CAPITAL VII AGGREGATOR SCSP, LUXEMBOURG Free format text: SECURITY INTEREST;ASSIGNOR:PERCEPTION POINT LTD;REEL/FRAME:063103/0450 Effective date: 20221220 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |