APPLICATION SIGNATURE AUTHORIZATION

• US 20150281282A1
• Filed: 06/30/2014
• Published: 10/01/2015
• Est. Priority Date: 03/31/2014
• Status: Active Grant

• Current Assignee: SonicWALL US Holdings, Inc. (SonicWall Holdings Ltd.)
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Medappa, Chemira, Peterson, Chris D.
• Granted Patent: US 10,382,398 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

An appliance works in conjunction with an agent on a remote device to control application access to a corporate network. In conjunction with an SSL tunnel and policy operating at the appliance, granular application control may be implemented. In particular, a device user may determine what applications from a set of applications may access the corporate network and which applications do not access the network. The applications may be analyzed to determine whether the application is good or bad, as what security configurations, approvals and denials are associated with the application.

Claims

1. A method for establishing a connection, comprising:

establishing a connection between a user client device and a server, the user client device having a plurality of applications;

receiving application information derived from the application for one of the plurality of applications from the user client device; and

processing traffic for the application of the plurality of applications based on the application information derived from the application.

2. The method of claim 1, wherein the application information includes a hash.

3. The method of claim 2, wherein a failed request to access a corporate network is detected from a trusted user and client device pair.

4. The method of claim 3, wherein the application hash values are added to the application information for the request, wherein subsequent requests having the hash value of the application will be denied.

5. The method of claim 2, wherein the hash is created from an application information.

6. The method of claim 5, wherein the application hash changes based on changes to the application information.

7. The method of claim 1, further including:

comparing the hash to a table of application hashes and corresponding application classifications; and

processing traffic for the application based on the application classification.

8. The method of claim 7, wherein processing traffic includes blocking application traffic if the application is classified as a bad application.

9. The method of claim 7, wherein processing traffic includes allowing application traffic if the application is classified as a good application.

10. The method of claim 1, further comprising:

collecting application level information; and

comparing application level information to an application policy to determine compliance of the application.

11. The method of claim 1, further comprising:

determining the application information does not satisfy a policy rule; and

processing traffic for the application of the plurality of applications based on the application information corresponding to a trusted application.

12. The method of claim 10, further comprising adding a code signature for the trusted application to a list of code signatures that are acceptable for the trusted application.

13. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for establishing a connection, the method comprising:

establishing a connection between a user client device and a server, the user client device having a plurality of applications;

receiving application information derived from the application for one of the plurality of applications from the user client device; and

processing traffic for the application of the plurality of applications based on the application information derived from the application.

14. The non-transitory computer readable storage medium of claim 13, wherein the application information includes a hash.

15. The method of claim 14, wherein a failed request to access a corporate network is detected from a trusted user and client device pair.

16. The method of claim 15, wherein the application hash values are added to the application information for the request, wherein subsequent requests having the hash value of the application will be denied.

17. The non-transitory computer readable storage medium of claim 13, wherein the hash is created from an application information.

18. The method of claim 17, wherein the application hash changes based on changes to the application information.

19. The non-transitory computer readable storage medium of claim 13, further including:

comparing the hash to a table of application hashes and corresponding application classifications; and

processing traffic for the application based on the application classification.

20. The non-transitory computer readable storage medium of claim 19, wherein processing traffic includes blocking application traffic if the application is classified as a bad application.

21. The non-transitory computer readable storage medium of claim 19, wherein processing traffic includes allowing application traffic if the application is classified as a good application.

22. The non-transitory computer readable storage medium of claim 13, further comprising:

collecting application level information; and

comparing application level information to an application policy to determine compliance of the application.

23. The non-transitory computer readable storage medium of claim 13, further comprising:

determining the application information does not satisfy a policy rule; and

processing traffic for the application of the plurality of applications based on the application information corresponding to a trusted application.

24. The non-transitory computer readable storage medium of claim 23, further comprising adding a code signature for the trusted application to a list of code signatures that are acceptable for the trusted application.

25. A system for establishing a connection, the system including:

a server in communication with a user client device, the server including a processor, memory, and one or more applications stored in memory at the server and executable to establish a connection between a user client device and a server, the user client device having a plurality of applications, receive application information derived from the application for one of the plurality of applications from the user client device, and process traffic for the application of the plurality of applications based on the application information derived from the application.

26. The system of claim 25, wherein the application information includes a hash.

27. The method of claim 26, wherein a failed request to access a corporate network is detected from a trusted user and client device pair.

28. The method of claim 27, wherein the application hash values are added to the application information for the request, wherein subsequent requests having the hash value of the application will be denied.

29. The system of claim 26, wherein the hash is created from an application information.

30. The method of claim 29, wherein the application hash changes based on changes to the application information.

31. The system of claim 25, the one or more applications further executable to:

compare the hash to a table of application hashes and corresponding application classifications; and

process traffic for the application based on the application classification.

32. The system of claim 31, the one or more applications further executable to block application traffic if the application is classified as a bad application.

33. The system of claim 25, the one or more applications further executable to allow application traffic if the application is classified as a good application.

34. The system of claim 25, the one or more applications further executable to:

collect application level information; and

compare application level information to an application policy to determine compliance of the application.

35. The system of claim 25, the one or more applications further executable to determine the application information does not satisfy a policy rule and process traffic for the application of the plurality of applications based on the application information corresponding to a trusted application.

36. The system of claim 25, the one or more applications further executable to add a code signature for the trusted application to a list of code signatures that are acceptable for the trusted application.