Implementation method of non-bypassable PC application firewalls using virtualization technologies

Modern complex PC applications access the Internet and can produce unwanted network traffic. Application firewalls or personal firewalls can monitor communications on users' PCs and block such unwanted communication. Because conventional application firewalls are implemented using OS APIs, they are bypassable. This paper describes an implementation method of a non-bypassable application firewall using virtualization technologies. The proposed method runs a virtual machine (VM) for each application and monitors network traffic with a virtual switch. The controller of the virtual switch interacts with a user and allows the user to edit firewall rules through a graphical user interface (GUI). The controller translates these rules into forwarding table entries of the virtual switch on demand. This on-demand feature makes it easy to write firewall rules with domain names, which can include wildcards. This firewall does not depend on any code in VMs, and its controller is isolated by the virtual machine monitor (VMM). If the VMM and virtual switch have no vulnerability, this firewall is non-bypassable. Based on the proposed method, an application firewall has been implemented using Linux Qemu KVM as the VMM and Open vSwitch as the virtual switch. Experimental results show that the proposed method is feasible in a current powerful PC and Internet access environment.