System and method for channeling network traffic

• US 20070195776A1
• Filed: 02/23/2006
• Published: 08/23/2007
• Est. Priority Date: 02/23/2006
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Nguyen, Bich, Jagadeesan, Ramanathan, Zheng, Danyang, Cham, Jack
• Application Number:
  US11/361,465
• Publication Number:
  US 20070195776A1
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method for channeling network traffic is described, which includes identifying, with an agent disposed within a client computer of the network, a portion of the network traffic associated with the client computer that has compliance related interest. The identified compliance interesting traffic portion is encapsulated with a header. Apart from the encapsulated traffic portion, the network traffic is routed according to its designated destination. The interesting traffic portion however is diverted on the basis of the encapsulating header. The diverted traffic portion is channeled for compliance related processing. Upon being channeled, the traffic portion is processed according to a compliance related policy. The processing is performed remotely from the client computer.

Claims

1. A method for channeling network traffic, said method comprising:

identifying, with an agent disposed within a client computer of said network, a portion of said network traffic associated with said client computer that has compliance related interest;

encapsulating said identified traffic portion with a header; and

diverting said traffic portion wherein, apart from said identified traffic portion, said traffic is routed according to its designated destination and wherein, upon said diverting, said diverted traffic portion is channeled according to said encapsulating header wherein, upon said channeling, said traffic portion is processed, remotely from said client computer, according to a compliance related policy.

2. The method as recited in claim 1 wherein said encapsulating header, comprises one or more of a generic routing classification header, a multi-protocol label switching header and a tunneling header.

3. The method as recited in claim 1 further comprising, upon said compliance related processing wherein said traffic portion is deemed compliant with a programmed compliance policy, removing said encapsulating header therefrom.

4. The method as recited in claim 3 further comprising, upon said removing said encapsulating header, re-routing said traffic portion according to its designated destination.

5. The method as recited in claim 1 further comprising programming said agent according to a compliance interest policy, wherein one or more of said identifying and said encapsulating is performed according to said compliance interest policy.

6. The method as recited in claim 1 wherein said method is performed with a plurality of interconnected networks, said plurality of networks comprising:

a first network through which substantially all traffic associated with an entity flows wherein said first network comprises;

one or more first routers, wherein said clients are coupled with said first network via said first routers; and

a second router;

a second network coupled with said first network via one or more third routers and wherein said second network comprises apparatus for performing said processing according to said compliance related policy; and

one or more third networks external to said first network and coupleable thereto via said second router, wherein said traffic is routed through said third networks according to said designated destination wherein said third networks comprise one or more of the Internet and a wide area network.

7. The method as recited in claim 6 wherein, upon said compliance related processing wherein said traffic portion is deemed other than compliant with a programmed compliance policy, said method further comprises taking a compliance promoting action wherein said compliance promoting action comprises one or more of:

recording a source associated with said traffic portion;

reporting said source associated with said traffic portion; and

deterring routing of said traffic portion according to its designated destination.

8. An apparatus for channeling network traffic having compliance related interest, said apparatus comprising:

a first network device disposed within said network, for diverting a portion of said traffic according to an encapsulating header and for routing said traffic, apart from said traffic portion, according to its designated destination; and

at least one agent disposed within a client computer of said network and programmed for encapsulating said portion of said traffic with a header, wherein said portion comprises traffic having said compliance related interest, wherein a second network device, disposed to receive said traffic portion from said first network device based on said encapsulating header, channels said traffic portion for compliance related processing.

9. The apparatus as recited in claim 8 wherein said compliance related processing is performed with compliance apparatus coupled to said second network device.

10. The apparatus as recited in claim 8 wherein said encapsulating header, comprises one or more of a generic routing classification header, a multi-protocol label switching header and a tunneling header.

11. The apparatus as recited in claim 8 wherein one or more of said second network devices, upon said compliance related processing, removes said encapsulating header therefrom.

12. The apparatus as recited in claim 11 wherein said compliance related processing comprises scrutiny of said traffic portion relating to said programmed compliance policy.

13. The apparatus as recited in claim 11 wherein said second network device, upon said removing said encapsulating header, performs a re-routing function wherein said second network device re-routes said traffic portion according to its designated destination.

14. The apparatus as recited in claim 13 wherein said programmed compliance policy comprises:

upon said compliance related processing wherein said traffic portion is deemed compliant with a programmed compliance policy, said second network device performs said re-routing function; and

upon said compliance related processing wherein said traffic portion is deemed other than compliant with a programmed compliance policy, said second network devices perform one or more of;

a monitoring function comprising one or more of;

recording a source associated with said traffic portion; and

reporting said source associated with said traffic portion; and

a prophylactic function comprising deterring said re-routing function.

15. The apparatus as recited in claim 8 wherein a client agent manager, communicatively coupled with each said client having one of said agents disposed therein, programs said agent according to a compliance interest policy, wherein said encapsulating is performed according to said compliance interest policy.

16. The apparatus as recited in claim 8 wherein said apparatus functions with a plurality of interconnected networks, said plurality of networks comprising:

a first network through which substantially all traffic associated with an entity flows wherein said first network comprises;

said first network device, wherein said clients are coupled with said first network via said first network devices; and

a third network device;

a second network coupled with said first network via said second network devices and wherein said second network comprises said compliance apparatus; and

one or more third networks external to said first network and coupleable thereto via said third network device, wherein said traffic is routed through said third networks according to said designated destination.

17. The apparatus as recited in claim 16 wherein said third network comprises one or more of the Internet and a wide area network.

18. A method for channeling network traffic, said method comprising:

diverting a portion of said network traffic from its designated destination according to compliance related interest therein, wherein said compliance related interest is indicated by a header that encapsulates said traffic portion, wherein said encapsulating header is added to said traffic portion with an agent disposed within a client computer of said network;

routing said network traffic, apart from said compliance interesting traffic portion, according to its designated destination; and

upon said diverting, channeling said compliance interesting traffic portion for processing according to a compliance related policy.

19. The method as recited in claim 18 wherein said encapsulating header, comprises one or more of a generic routing classification header, a multi-protocol label switching header and a tunneling header.

20. The method as recited in claim 18 further comprising, upon performing said compliance related processing wherein said traffic portion is deemed compliant with a programmed compliance policy, removing said encapsulating header therefrom.

21. The method as recited in claim 20 further comprising, upon said removing said encapsulating header, re-routing said traffic portion according to its designated destination.

22. The method as recited in claim 18 further comprising programming said agent according to a compliance interest policy, wherein one or more of said identifying and said encapsulating is performed according to said compliance interest policy.

23. The method as recited in claim 18 wherein said method is performed with a plurality of interconnected networks, said plurality of networks comprising:

a first network through which substantially all traffic associated with an entity flows wherein said first network comprises;

one or more first routers, wherein said clients are coupled with said first network via said first routers; and

a second router;

a second network coupled with said first network via one or more third routers and wherein said second network comprises apparatus for performing said processing according to said compliance related policy; and

one or more third networks external to said first network and coupleable thereto via said second router, wherein said traffic is routed through said third networks according to said designated destination wherein said third networks comprise one or more of the Internet and a wide area network.

24. The method as recited in claim 23 wherein, upon performing said compliance related processing wherein said traffic portion is deemed other than compliant with a programmed compliance policy, said method further comprises taking a compliance promoting action wherein said compliance promoting action comprises one or more of:

recording a source associated with said traffic portion;

reporting said source associated with said traffic portion; and

deterring routing of said traffic portion according to its designated destination.

25. An apparatus for channeling network traffic having compliance related interest, said apparatus comprising:

a reader for reading a header that encapsulates said compliance interesting traffic portion wherein said encapsulating header is added to said compliance interesting traffic portion with an agent disposed in a client computer of said network and programmed to encapsulate said traffic portion with said header according to said compliance related interest; and

a channeler functional with said reader, for channeling said compliance interesting traffic portion to compliance apparatus coupled to said apparatus for processing said compliance interesting traffic portion according to a compliance policy.

26. The apparatus as recited in claim 25 wherein said compliance interesting traffic portion is diverted to said apparatus according to said encapsulating header and wherein said network traffic, apart from said compliance interesting traffic portion, is routed according to its designated destination.

27. The apparatus as recited in claim 25 wherein said encapsulating header, comprises one or more of a generic routing classification header, a multi-protocol label switching header and a tunneling header.

28. The apparatus as recited in claim 25 wherein said apparatus, upon said compliance related processing, removes said encapsulating header from said traffic portion.

29. The apparatus as recited in claim 28 wherein said compliance related processing comprises scrutiny of said traffic portion relating to said programmed compliance policy.

30. The apparatus as recited in claim 29 wherein said apparatus, upon said removing said encapsulating header, performs a re-routing function wherein said second network device re-routes said traffic portion according to its designated destination.

31. The apparatus as recited in claim 29 wherein said programmed compliance policy comprises:

upon said compliance related processing wherein said traffic portion is deemed compliant with a programmed compliance policy, said second network device performs said re-routing function; and

upon said compliance related processing wherein said traffic portion is deemed other than compliant with a programmed compliance policy, said second network devices perform one or more of;

a monitoring function comprising one or more of;

recording a source associated with said traffic portion; and

reporting said source associated with said traffic portion; and

a prophylactic function comprising deterring said re-routing function.

32. The apparatus as recited in claim 25 wherein a client agent manager, communicatively coupled with each said client having one of said agents disposed therein, programs said agent according to a compliance interest policy, wherein said encapsulating is performed according to said compliance interest policy.

33. The apparatus as recited in claim 25 wherein said apparatus functions with a plurality of interconnected networks, said plurality of networks comprising:

a first network through which substantially all traffic associated with an entity flows wherein said first network comprises;

said first network device, wherein said clients are coupled with said first network via said first network devices; and

a third network device;

a second network coupled with said first network via said apparatus and wherein said second network comprises said compliance apparatus; and

one or more third networks external to said first network and coupleable thereto via said third network device, wherein said traffic is routed through said third networks according to said designated destination.

34. The apparatus as recited in claim 33 wherein said third network comprises one or more of the Internet and a wide area network.

35. A computer readable medium having encoded thereon code for causing a computer system to perform a process for channeling network traffic, said process comprising:

identifying, with an agent disposed within a client computer of said network, a portion of said network traffic associated with said client computer that has compliance related interest;

encapsulating said identified traffic portion with a header;

diverting said traffic portion wherein, apart from said identified traffic portion, said traffic is routed according to its designated destination wherein; and

channeling said diverted traffic portion according to said encapsulating header wherein, upon said channeling, said traffic portion is processed, remotely from said client computer, according to a compliance related policy.

36. A method for managing a network, said method comprising:

programming an agent disposed on a client computer of said network according to a compliance interest policy;

identifying of a portion of said network traffic associated with said client computer that has compliance related interest according to said compliance interest policy;

encapsulating said identified traffic portion with a header;

diverting said traffic portion wherein, apart from said identified traffic portion, said traffic is routed according to its designated destination;

channeling said diverted traffic portion according to said encapsulating header wherein, upon said channeling, said traffic portion is processed, remotely from said client computer, according to a compliance related policy; and

upon said processing, managing further routing of said diverted traffic portion wherein said managing comprises;

upon said traffic portion deemed compliant with said compliance related policy, removing said encapsulating header therefrom wherein said traffic portion is routed according to its designated destination; and

upon said traffic portion deemed other than compliant with said programmed compliance policy, taking a compliance promoting action that comprises one or more of;

recording a source associated with said traffic portion;

reporting said source associated with said traffic portion; and

deterring routing of said traffic portion according to its designated destination.

37. A business method for managing a network, said business method comprising:

programming an agent disposed on a client computer of said network according to a compliance interest policy;

identifying of a portion of said network traffic associated with said client computer that has compliance related interest according to said compliance interest policy;

encapsulating said identified traffic portion with a header;

diverting said traffic portion wherein, apart from said identified traffic portion, said traffic is routed according to its designated destination;

channeling said diverted traffic portion according to said encapsulating header wherein, upon said channeling, said traffic portion is processed, remotely from said client computer, according to a compliance related policy; and

upon said processing, managing further routing of said diverted traffic portion wherein said managing comprises;

upon said traffic portion deemed compliant with said compliance related policy, removing said encapsulating header therefrom wherein said traffic portion is routed according to its designated destination;

upon said traffic portion deemed other than compliant with said programmed compliance policy, taking a compliance promoting action that comprises one or more of;

recording a source associated with said traffic portion;

reporting said source associated with said traffic portion; and

deterring routing of said traffic portion according to its designated destination; and

assessing a fee for said managing.