Providing server security via a security sensor application shared by multiple operating system partitions

[0001] 1. Technical Field

[0002] The present invention relates in general to data processing and in particular to computer server security. Still more particularly, the present invention relates to an improved method and system for providing server security.

[0003] 2. Description of the Related Art

[0004] Partitioned enterprise computer server systems include multiple operating system (OS) partitions and software and/or firmware, referred to herein as a Hypervisor, which passes messages between the OS partitions. The Hypervisor also enables the OS partitions to communicate with a Virtual Input/Output Server (VIOS). Enterprise server systems also include software applications that provide security against incoming malicious Input/Output (I/O) traffic, such as the Internet Security Systems (ISS) security sensor (SS). As utilized herein, a SS refers to an application program that provides network intrusion detection and prevention mechanisms.

[0005] In conventional enterprise server systems, the ISS is located in the user space of each OS. Each OS partition within the enterprise server system therefore has a separate copy of the SS code in the user space of the OS. Maintaining multiple copies of the SS code for each partition is inefficient, complex, and costly to manage. Furthermore, SS code running within user space may not be able to communicate directly with a memory and/or a network adapter, thereby impairing system performance.

[0006] Disclosed are a method, system, and computer program product for providing server security. When a hypervisor in a computer server receives input/output (I/O) data traffic, the hypervisor sends the I/O data traffic to a security sensor application shared by multiple operating system (OS) partitions. If the security sensor application indicates that the I/O data traffic meets pre-defined security standards in the security sensor application, and the I/O data traffic is addressed to one of the OS partitions in the computer server, the hypervisor sends the I/O data traffic to the applicable OS partition. If the I/O data traffic meets the pre-defined security standards, and the I/O data traffic is not addressed to one of the OS partitions, the hypervisor sends the I/O data traffic to an external destination in a network coupled to the computer server.

[0007] The above as well as additional objectives, features, and advantages of the present invention will become apparent in the following detailed written description.

[0019] With reference now to FIG. 1, there is depicted a block diagram of an exemplary server 100, with which the present invention may be utilized. As shown, server 100 includes processor 102, which is coupled to memory 104. Server 100 also includes Input/Output (I/O) interface 130. I/O interface 130 enables server 100 to communicate with network 135, which includes multiple computers and/or servers that may be configured similarly to server 100. An example of I/O interface 130 is a Peripheral Component Interface (PCI), PCI-X, or PCI Express Adapter.

[0020] In one embodiment, memory 104 includes virtual I/O server (VIOS) 105 and multiple operating system (OS) partitions 110a through 110n. VIOS 105 and OS partitions 110a-110n are logically coupled to hypervisor 115 for communication therebetween. In one embodiment, I/O interface 130 is also coupled to hypervisor 115. Hypervisor 115 routes data between different components in memory 104 according to the process illustrated in FIGS. 2-3, which are described below. OS partitions 110a-110n communicate with VIOS 105 via hypervisor 115. Similarly, data traffic coming in and/or out of I/O interface 130 passes through VIOS 105 via hypervisor 115.

[0021] According to the illustrative embodiment, VIOS 105 includes one or more application programs, such as security sensor (SS) 120 and host interface 125. Host interface 125 provides I/O functionality to VIOS 105 and routes data traffic to SS 120, which determines whether or not the data traffic meets pre-defined security standards. SS 120 thus protects VIOS 105 and OS partitions 110a-110n from malicious I/O data traffic. In one embodiment, a network administrator enters the pre-defined security standards. The pre-defined security standards may subsequently be updated as needed (e.g., if a new security threat arises).

[0022] OS partitions 110a-110n include device driver proxies 112a through 112n, respectively. Device driver proxies 112a-112n manipulate data traffic and provide output to different applications (e.g., device driver proxies in other OS partitions and/or applications in computers within network 135).

[0023] With reference now to FIG. 2, there is illustrated a high level logical flowchart of an exemplary method of receiving data in server 100 of FIG. 1, according to an embodiment of the invention. The process begins at block 200. SS 120 (FIG. 1) performs a registration procedure (not shown) to initialize one or more buffers that receive incoming data packets in server 100, as depicted in block 205. SS 120 posts a receive messages notification to hypervisor 115 (FIG. 1), which receives incoming message packets from I/O interface 130 (FIG. 1), as shown in block 210.

[0024] At block 215, SS 120 determines whether or not an incoming message setting in hypervisor 115 is set to a “poll” value or a “block and wait” value. If an incoming message setting is set to a “poll” value, SS 120 determines whether or not an adapter (e.g., I/O interface 130) in server 100 has posted a notification to hypervisor 115 in response to completely receiving a message packet (i.e., a “receive completion” notification). If an adapter has not posted a receive completion notification, the process returns to block 220. Once an adapter posts a receive completion notification, the process proceeds to block 230.

[0025] Otherwise, if an incoming message setting is set to a “block and wait” value, SS 120 waits for hypervisor 115 to perform a message completion interrupt, as depicted in block 225. SS 120 subsequently retrieves a receive completion from hypervisor 115, as shown in block 230.

[0026] At block 235, SS 120 determines whether or not a message packet was received successfully (i.e., without data integrity errors). If the message packet was received successfully, SS 120 invokes the security algorithm illustrated in FIG. 3, which is described below, and the process terminates at block 250. If the message packet was not received successfully (e.g., the packet is missing data), SS 120 discards the message packet and logs a bad completion event in memory 104, as depicted in block 245. The process subsequently terminates at block 250.

[0027] With reference now to FIG. 3, there is illustrated a high level logical flowchart of an exemplary method of providing server security in server 100 of FIG. 1, according to an embodiment of the invention. The process begins at block 300. Hypervisor 115 (FIG. 1) receives one or more data packets and sends the received data traffic to a SS application (e.g., SS 120 of FIG. 1) that is shared by OS partitions 110a-110n, as shown in block 302.

[0028] At block 304, SS 120 determines whether or not the data traffic meets pre-defined security standards. If the data traffic does not meet the pre-defined security standards (i.e., the data is malicious), SS 120 drops (i.e., does not forward) the data traffic, as depicted in block 306. SS 120 logs an intrusion event that corresponds to the malicious data, as shown in block 308, and the process terminates at block 324. In another embodiment, if the data traffic is malicious, SS application may automatically output an error message, quarantine the malicious data (i.e., store the code in an isolated place), and/or delete the malicious traffic.

[0029] If the data traffic meets the pre-defined security standards (i.e., the data is safe), SS 120 releases the data traffic and determines whether or not the data traffic is addressed to one of OS partitions 110a-110n, as depicted in block 310. If the data traffic is addressed to one of OS partitions 110a-110n, SS 120 invokes host interface 125 in VIOS 105 (FIG. 1) and passes a pointer to the data traffic to host interface 125, as depicted in block 312. SS 120 sends the data traffic to the corresponding OS partition, as shown in block 314, and the process terminates at block 324.

[0030] If the data traffic is not addressed to one of OS partitions 110a-110n (i.e., the data traffic has an external destination), SS 120 determines whether or not server 100 is configured as a router, as depicted in block 316. If server 100 is configured as a router, SS 120 sends the data traffic to the corresponding destination within network 135, as shown in block 318, and the process terminates at block 324.

[0031] Otherwise, if server 100 is not configured as a router, SS 120 drops the data traffic, as depicted in block 320. SS 120 logs a routing error event that corresponds to the malicious data, as shown in block 322, and the process terminates at block 324.

[0032] With reference now to FIG. 4, there is depicted a block diagram of an exemplary server 400, with which the present invention may be utilized. As indicated by like reference numerals, server 400 has similar components to server 100 of FIG. 1. However, SS 420 is coupled to host interface 125, which is in turn communicably coupled to hypervisor 115. Thus, SS 420 communicates with hypervisor 115 via host interface 125. SS 420 performs the same functions as SS 120, as illustrated in FIGS. 5-6, which are described below.

[0033] With reference now to FIG. 5, there is illustrated a high level logical flowchart of an exemplary method of receiving data in server 400 of FIG. 4, according to an embodiment of the invention. The process begins at block 500. Host interface 125 (FIG. 4) performs a registration procedure (not shown) to initialize one or more buffers that receive incoming data packets in server 400, as depicted in block 505. Host interface 125 posts a receive messages notification to hypervisor 115 (FIG. 4), which receives incoming message packets from I/O interface 130 (FIG. 4), as shown in block 510.

[0034] At block 515, host interface 125 determines whether or not an incoming message setting in hypervisor 115 is set to a “poll” value or a “block and wait” value. If an incoming message setting is set to a “poll” value, host interface 125 determines whether or not an adapter in server 400 has posted a notification to hypervisor 115 in response to completely receiving a message packet (i.e., a “receive completion” notification). If an adapter has not posted a receive completion notification, the process returns to block 520. Once an adapter posts a receive completion notification, the process proceeds to block 530.

[0035] Otherwise, if an incoming message setting is set to a “block and wait” value, host interface 125 waits for hypervisor 115 to perform a message completion interrupt, as depicted in block 525. Host interface 125 subsequently retrieves a receive completion from hypervisor 115, as shown in block 530.

[0036] At block 535, host interface 125 determines whether or not a message packet was received successfully (i.e., without data integrity errors). If the message packet was received successfully, host interface 125 invokes the security algorithm of SS 420 that is illustrated in FIG. 6, which is described below, and the process terminates at block 550. If the message packet was not received successfully (e.g., the packet is missing data), host interface 125 discards the message packet and logs a bad completion event in memory 104, as depicted in block 545. The process subsequently terminates at block 550.

[0037] With reference now to FIG. 6, there is illustrated a high level logical flowchart of an exemplary method of providing server security in server 400 of FIG. 4, according to an embodiment of the invention. The process begins at block 600. Hypervisor 115 (FIG. 4) receives one or more data packets and sends the received data traffic to a SS application (e.g., SS 420 of FIG. 4) that is shared by OS partitions 110a-110n, as shown in block 602.

[0038] At block 604, SS 420 determines whether or not the data traffic meets pre-defined security standards. If the data traffic does not meet the pre-defined security standards (i.e., the data is malicious), SS 420 drops (i.e., does not forward) the data traffic, as depicted in block 606. SS 420 logs an intrusion event that corresponds to the malicious data, as shown in block 608, and the process terminates at block 624. In another embodiment, if the data traffic is malicious, SS application may automatically output an error message, quarantine the malicious data (i.e., store the code in an isolated place), and/or delete the malicious traffic.

[0039] If the data traffic meets the pre-defined security standards (i.e., the data is safe), SS 420 releases the data traffic and determines whether or not the data traffic is addressed to one of OS partitions 110a-110n, as depicted in block 610. If the data traffic is addressed to one of OS partitions 110a-110n, SS 420 invokes host interface 125 in VIOS 105 (FIG. 4) and passes a pointer to the data traffic to host interface 125, as depicted in block 612. Host interface 420 sends the data traffic to the corresponding OS partition, as shown in block 614, and the process terminates at block 624.

[0040] If the data traffic is not addressed to one of OS partitions 110a-110n (i.e., the data traffic has an external destination), SS 420 determines whether or not server 400 is configured as a router, as depicted in block 616. If server 400 is configured as a router, SS 420 sends the data traffic to the corresponding destination within network 135, as shown in block 618, and the process terminates at block 624.

[0041] Otherwise, if server 400 is not configured as a router, SS 420 drops the data traffic, as depicted in block 620. SS 420 logs a routing error event that corresponds to the malicious data, as shown in block 622, and the process terminates at block 624.

[0042] With reference now to FIG. 7, there is depicted a block diagram of server 700 according to another embodiment of the present invention. As indicated by like reference numerals, server 700 has similar components to server 100 of FIG. 1. However, server 700 implements an SS 705 in a separate special purpose security partition 702 coupled to hypervisor 115, rather than in VIOS 105. In one embodiment, OS partition 110a may include device driver 712a, which is the only device driver assigned to the I/O interface 130, and/or OS partition 110b may include device driver with native I/O virtualization (IOV) 712b, which shares the I/O interface 130 with other device drivers with native IOV that reside in server 700. SS 705 performs the same functions as SS 120, as illustrated in FIGS. 8-10, which are described below. Again, server 700 only includes a single security sensor shared by all OS partitions 110a-110n. For example, if server 700 includes SS 705 in security partition 702, then server 700 does not include SS 120 in VIOS 105, and vice versa.

[0043] With reference now to FIG. 8, there is illustrated a high level logical flowchart of an exemplary method of receiving data in server 700 of FIG. 7, according to another embodiment of the invention. A device driver, such as device driver 712a (FIG. 7) or device driver with native IOV 712b (FIG. 7), performs the processes illustrated in FIG. 8. In one embodiment, device driver 712a performs the processes illustrated in FIG. 8, and OS partition 110a is the sole owner of an adapter (i.e., no other OS communicates with the adapter). In another embodiment, device driver with native IOV 712b performs the processes illustrated in FIG. 8, and OS partition 110b may directly share an adapter with one or more other OS partitions.

[0044] According to the illustrative embodiment, the process begins at block 800. The device driver performs a registration procedure (not shown) to initialize one or more buffers that receive incoming data packets in server 700, as depicted in block 805. The device driver posts a receive messages notification to hypervisor 115 (FIG. 7), which receives incoming message packets from I/O interface 130 (FIG. 7), as shown in block 810.

[0045] At block 815, the device driver determines whether or not an incoming message setting in hypervisor 115 is set to a “poll” value or a “block and wait” value. If an incoming message setting is set to a “poll” value, host interface 125 determines whether or not an adapter in server 700 has posted a notification to hypervisor 115 in response to completely receiving a message packet (i.e., a “receive completion” notification). If an adapter has not posted a receive completion notification, the process returns to block 820. Once an adapter posts a receive completion notification, the process proceeds to block 830.

[0046] Otherwise, if an incoming message setting is set to a “block and wait” value, the device driver waits for hypervisor 115 to perform a message completion interrupt, as depicted in block 825. The device driver subsequently retrieves a receive completion from hypervisor 115, as shown in block 830.

[0047] At block 835, the device driver determines whether or not a message packet was received successfully (i.e., without data integrity errors). If the message packet was received successfully, the device driver invokes the security algorithm of SS 705 that is illustrated in FIG. 10, which is described below, and the process terminates at block 850. If the message packet was not received successfully (e.g., the packet is missing data), the device driver discards the message packet and logs a bad completion event in memory 104, as depicted in block 845. The process subsequently terminates at block 850.

[0048] With reference now to FIG. 9, there is illustrated a high level logical flowchart of an exemplary method of receiving data in server 700 of FIG. 7, according to another embodiment of the invention. The process begins at block 900. VIOS 105 (FIG. 7) performs a registration procedure (not shown) to initialize one or more buffers that receive incoming data packets in server 700, as depicted in block 905. VIOS 105 posts a receive messages notification to hypervisor 115 (FIG. 7), which receives incoming message packets from I/O interface 130 (FIG. 7), as shown in block 910.

[0049] At block 915, VIOS 105 determines whether or not an incoming message setting in hypervisor 115 is set to a “poll” value or a “block and wait” value. If an incoming message setting is set to a “poll” value, VIOS 105 determines whether or not an adapter in server 700 has posted a notification to hypervisor 115 in response to completely receiving a message packet (i.e., a “receive completion” notification). If an adapter has not posted a receive completion notification, the process returns to block 920. Once an adapter posts a receive completion notification, the process proceeds to block 930.

[0050] Otherwise, if an incoming message setting is set to a “block and wait” value, VIOS 105 waits for hypervisor 115 to perform a message completion interrupt, as depicted in block 925. VIOS 105 subsequently retrieves a receive completion from hypervisor 115, as shown in block 930.

[0051] At block 935, VIOS 105 determines whether or not a message packet was received successfully (i.e., without data integrity errors). If the message packet was received successfully, VIOS 105 invokes the security algorithm of SS 705 that is illustrated in FIG. 10, which is described below, and the process terminates at block 950. If the message packet was not received successfully (e.g., the packet is missing data), VIOS 105 discards the message packet and logs a bad completion event in memory 104, as depicted in block 945. The process subsequently terminates at block 950.

[0052] Turning now to FIG. 10, there is illustrated a high level logical flowchart of an exemplary method of providing server security, according to another embodiment of the invention. The process begins at block 970. Hypervisor 115 (FIG. 7) receives one or more data packets and sends the received data traffic to a SS application (e.g., SS 705 of FIG. 7) that is shared by OS partitions 110a-110n, as shown in block 972.

[0053] At block 974, SS 705 determines whether or not the data traffic meets pre-defined security standards. If the data traffic does not meet the pre-defined security standards (i.e., the data is malicious), SS 705 drops (i.e., does not forward) the data traffic, as depicted in block 976. SS 705 logs an intrusion event that corresponds to the malicious data, as shown in block 978, and the process terminates at block 994. In another embodiment, if the data traffic is malicious, SS application may automatically output an error message, quarantine the malicious data (i.e., store the code in an isolated place), and/or delete the malicious traffic.

[0054] If the data traffic meets the pre-defined security standards (i.e., the data is safe), SS 705 releases the data traffic and determines whether or not the data traffic is addressed to one of OS partitions 110a-110n, as depicted in block 980. If the data traffic is addressed to one of OS partitions 110a-110n, SS 705 invokes host interface 125 in VIOS 105 (FIG. 7) and passes a pointer to the data traffic to host interface 125, as depicted in block 982. SS 705 returns the data traffic to VIOS 105 and/or the corresponding OS partition, as shown in block 984, and the process terminates at block 994.

[0055] If the data traffic is not addressed to one of OS partitions 110a-110n (i.e., the data traffic has an external destination), SS 705 determines whether or not server 700 is configured as a router, as depicted in block 986. If server 700 is configured as a router, SS 705 sends the data traffic to the corresponding destination within network 135, as shown in block 988, and the process terminates at block 994.

[0056] Otherwise, if server 700 is not configured as a router, SS 705 drops the data traffic, as depicted in block 990. SS 705 logs a routing error event that corresponds to the malicious data, as shown in block 992, and the process terminates at block 994.

[0057] The present invention thus provides a method of providing server security. When hypervisor 115 in computer server 100 receives I/O data traffic, hypervisor 115 sends the I/O data traffic to a security sensor (SS) application, such as SS 120 (FIG. 1) or SS 205 (FIG. 2). The SS application is shared by OS partitions 110a-110n. If the I/O data traffic meets pre-defined security standards in the SS application, and the I/O data traffic is addressed to one of OS partitions 110a-110n, hypervisor 115 sends the I/O data traffic to the OS partition. If the I/O data traffic meets the pre-defined security standards, and the I/O data traffic is not addressed to one of OS partitions 110a-110n, hypervisor 115 sends the I/O data traffic to an external destination in network 135, which is coupled to computer server 100.

[0058] It is understood that the use herein of specific names are for example only and not meant to imply any limitations on the invention. The invention may thus be implemented with different nomenclature/terminology and associated functionality utilized to describe the above devices/utility, etc., without limitation.

[0059] In the flow charts (FIGS. 2-3, 5-6, and 8-10) above, while the process steps are described and illustrated in a particular sequence, use of a specific sequence of steps is not meant to imply any limitations on the invention. Changes may be made with regards to the sequence of steps without departing from the spirit or scope of the present invention. Use of a particular sequence is therefore, not to be taken in a limiting sense, and the scope of the present invention is defined only by the appended claims.

[0060] While an illustrative embodiment of the present invention has been described in the context of a fully functional computer server system with installed software, those skilled in the art will appreciate that the software aspects of an illustrative embodiment of the present invention are capable of being distributed as a program product in a variety of forms, and that an illustrative embodiment of the present invention applies equally regardless of the particular type of media used to actually carry out the distribution. Examples of the types of media include recordable type media such as thumb drives, floppy disks, hard drives, CD ROMs, DVDs, and transmission type media such as digital and analog communication links.

[0061] While the invention has been particularly shown and described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention.