Network Adapter Based Zoning Enforcement

摘要

Embodiments of the present invention are directed to enforcing zoning at a network adapter of an end point device. Thus, a network adapter can monitor the communications that are sent and/or received by the adapter and discard communications that are prohibited based on the zoning rules applicable to the adapter. In some embodiments, zoning configuration information can be defined and stored at a central entity and sent to the various network adapters. Alternatively, or in addition, each network adapter can also check outgoing communications to ensure that they include a proper source address. More specifically, outgoing communications may be checked to ensure that their source address is the address (or one of the addresses) that are associated with the network adapter. This can be used to detect and/or prevent malfunctions and/or intentional tampering or hacking.

主权项

1. A method comprising:
receiving a first set of addresses, each address in the first set of addresses corresponding to a network device in a first zone to which a first virtual device has access, wherein the end point device comprises the first virtual device; receiving a second set of addresses, each address in the second set of addresses corresponding to a network device in a second zone to which a second virtual device has access, wherein the end point device comprises the second virtual device; enforcing network zoning at the first virtual device by monitoring communications of the first virtual device and discarding communications of the first virtual device that do not include an address from the first set of addresses; and enforcing network zoning at the second virtual device by monitoring communications of the second virtual device and discarding communications that do not include an address from the second set of addresses.