Secure and lightweight traffic forwarding systems and methods to cloud based network security systems

• US 10,243,997 B2
• Filed: 04/19/2016
• Issued: 03/26/2019
• Est. Priority Date: 04/13/2012
• Status: Active Grant

• Current Assignee: Zscaler Incorporated
• Original Assignee: Zscaler Incorporated
• Inventors: Desai, Purvi, Mahajan, Vikas, Bansal, Abhinav
• Primary Examiner(s): Dada, Beemnet W
• Application Number:
  US15/132,584
• Publication Number:
  US 20160248812A1
• Time in Patent Office: 1,071 Days
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 45/14 Routing performance; Theoretical aspects
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A method implemented by an agent operating on a mobile device communicating to a cloud-based system includes opening up local listening sockets on the mobile device; redirecting outgoing traffic from all application on the mobile device except the agent to the local listening sockets; and forwarding the outgoing traffic from the local listening sockets to the cloud-based system with additional information included therein for the cloud-based system.

Claims

1. A cloud node in a cloud system, the cloud node comprising:

a network interface communicatively coupled to a network, a processor communicatively coupled to the network interface, and memory storing instructions that when executed cause the processor to;

receiving traffic from a mobile device based on forwarding from local listening sockets on the mobile device, wherein the local listening sockets are opened on the mobile device and the traffic is redirected from applications on the mobile device to the local listening sockets and forwarded to the cloud node with additional information related to an associated application on the mobile device; and

applying one or more remote policies in the cloud node to the traffic based in part on the additional information.

2. The cloud node of claim 1, wherein the local listening sockets are a Transmission Control Protocol (TCP) listening socket for Web traffic and a User Datagram Protocol (UDP) listening socket for Domain Name System (DNS) traffic.

3. The cloud node of claim 1, wherein the additional information comprises any of application unique package name, application version, operating system version, device model, and agent version.

4. The cloud node of claim 1, wherein the memory storing instructions that when executed further cause the processor to:

enroll a user of the mobile device in the cloud system and authorize the mobile device in the cloud system.

5. The cloud node of claim 1, wherein the memory storing instructions that when executed further cause the processor to:

responsive to a violation of the one or more remote policies, provide an end user notification to the mobile device via a push notification to the mobile device.

6. The cloud node of claim 5, wherein the push notification is via a mobile operating system notification cloud.

7. The cloud node of claim 1, wherein the memory storing instructions that when executed further cause the processor to:

responsive to a violation of the one or more remote policies, block the traffic in the cloud node and provide an end user notification to the mobile device.

8. The cloud node of claim 1, wherein the one or more remote policies comprise allowing or blocking transactions from one or more applications on the mobile device.

9. The cloud node of claim 8, wherein the one or more applications are allowed or block based on one or more of malware detection, location, and susceptibility to information leakage.

10. The cloud node of claim 1, wherein the mobile device comprises a user device configured with the one or more remote policies for an organization associated with a user of the mobile device.

11. A cloud method in a node in a cloud system, the cloud method comprising:

receiving traffic from a mobile device based on forwarding from local listening sockets on the mobile device, wherein the local listening sockets are opened on the mobile device and the traffic is redirected from applications on the mobile device to the local listening sockets and forwarded to the cloud node with additional information related to an associated application on the mobile device; and

applying one or more remote policies in the cloud node to the traffic based in part on the additional information.

12. The cloud method of claim 11, wherein the local listening sockets are a Transmission Control Protocol (TCP) listening socket for Web traffic and a User Datagram Protocol (UDP) listening socket for Domain Name System (DNS) traffic.

13. The cloud method of claim 11, wherein the additional information comprises any of application unique package name, application version, operating system version, device model, and agent version.

14. The cloud method of claim 11, further comprising:

enrolling a user of the mobile device in the cloud system and authorizing the mobile device in the cloud system.

15. The cloud method of claim 11, further comprising:

responsive to a violation of the one or more remote policies, providing an end user notification to the mobile device via a push notification to the mobile device.

16. The cloud method of claim 15, wherein the push notification is via a mobile operating system notification cloud.

17. The cloud method of claim 11, further comprising:

responsive to a violation of the one or more remote policies, blocking the traffic in the cloud node and providing an end user notification to the mobile device.

18. The cloud method of claim 11, wherein the one or more remote policies comprise allowing or blocking transactions from one or more applications on the mobile device.

19. The cloud method of claim 18, wherein the one or more applications are allowed or block based on one or more of malware detection, location, and susceptibility to information leakage.

20. A non-transitory computer readable medium comprising instructions that when executed cause a processor in a cloud node to:

receive traffic from a mobile device based on forwarding from local listening sockets on the mobile device, wherein the local listening sockets are opened on the mobile device and the traffic is redirected from applications on the mobile device to the local listening sockets and forwarded to the cloud node with additional information related to an associated application on the mobile device; and

apply one or more remote policies in the cloud node to the traffic based in part on the additional information.