FILTERING OUTBOUND NETWORK TRAFFIC

• US 20170366505A1
• Filed: 06/17/2016
• Published: 12/21/2017
• Est. Priority Date: 06/17/2016
• Status: Active Grant

• Current Assignee: Assured Information Security, Inc.
• Original Assignee: Assured Information Security, Inc.
• Inventors: Wright, Jared, Torrey, Jacob
• Granted Patent: US 10,523,635 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 47/196 Integration of transport layer protocols, e.g. TCP and UDP
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/306 User profiles

Abstract

Obtaining, in association with origination of outbound network traffic to be sent by a system, user account information of a user account on behalf of which the outbound network traffic is generated, and performing filtering of the outbound network traffic based on the obtained user account information of the user account on behalf of which the outbound network traffic is generated, where the filtering is further based on one or more rules, and the filtering includes determining whether to block or allow sending of the outbound network traffic from the system.

Claims

1. A method comprising:

obtaining, in association with origination of outbound network traffic to be sent by a system, user account information of a user account on behalf of which the outbound network traffic is generated; and

performing filtering of the outbound network traffic based on the obtained user account information of the user account on behalf of which the outbound network traffic is generated, wherein the filtering is further based on one or more rules, and the filtering comprises determining whether to block or allow sending of the outbound network traffic from the system.

2. The method of claim 1, wherein the obtained user account information comprises an indication of the user account, and wherein the filtering comprises:

checking a rule of the one or more rules, the rule specifying the user account and indicating whether sending of network traffic generated on behalf of the user account is to be blocked or is to be allowed for a particular scope applicable to the outbound network traffic; and

determining, based on the checking, whether to block or allow sending of the outbound network traffic.

3. The method of claim 1, wherein the user is included in a user group for authenticating to the system, wherein the obtained user account information comprises an indication of the user group, and wherein the filtering comprises:

checking a rule of the one or more rules, the rule specifying the user group and indicating whether sending of network traffic generated on behalf of users included in the user group is to be blocked or is to be allowed for a particular scope applicable to the outbound network traffic; and

determining, based on the checking, whether to block or allow sending of the outbound network traffic.

4. The method of claim 1, wherein the user authenticates to the system by logging onto an authentication domain, wherein the obtained user account information comprises an indication of the authentication domain, and wherein the filtering comprises:

checking a rule of the one or more rules, the rule specifying the authentication domain and indicating whether sending of network traffic generated on behalf of users authenticating to the system by logging onto the authentication domain is to be blocked or is to be allowed for a particular scope applicable to the outbound network traffic; and

determining, based on the checking, whether to block or allow sending of the outbound network traffic.

5. The method of claim 1, wherein the system is part of an internal network and a client system external to the internal network authenticates to the system using the user account, wherein the outbound network traffic comprises an attempt by the client system to access another system that is part of the internal network, and wherein the filtering prevents the attempt by the client system to access the another system.

6. The method of claim 1, wherein the filtering is implemented by a driver added to a kernel of an operating system of the system, wherein the driver is built on top of a system-level application programming interface of the system, and wherein the driver comprises a hook procedure for handling a hook installed into a networking stack of the system via the system level application programming interface.

7. The method of claim 6, further comprising providing an application programming interface that abstracts an operating system-provided transport layer to facilitate communicating configuration requests between userspace and the driver in kernel space to configure the filtering.

8. The method of claim 1, wherein the filtering comprises inspecting network traffic of the system to identify network traffic of one or more network traffic types, wherein the filtering of the outbound network traffic based on the indicated user account on behalf of which the outbound network traffic is generated applies to the one or more network traffic types, wherein outbound network traffic of a network traffic type other than the one or more networking traffic types is not subject to the filtering.

9. The method of claim 8, wherein the one or more network traffic types comprises TCP SYN packets and UDP packets.

10. The method of claim 8, wherein the one or more network traffic types comprises TCP data packets.

11. A computer program product comprising:

a non-transitory computer-readable storage medium comprising program instructions for execution to perform a method comprising;

obtaining, in association with origination of outbound network traffic to be sent by a system, user account information of a user account on behalf of which the outbound network traffic is generated; and

performing filtering of the outbound network traffic based on the obtained user account information of the user account on behalf of which the outbound network traffic is generated, wherein the filtering is further based on one or more rules, and the filtering comprises determining whether to block or allow sending of the outbound network traffic from the system.

12. The computer program product of claim 11, wherein the obtained user account information comprises an indication of the user account, and wherein the filtering comprises:

checking a rule of the one or more rules, the rule specifying the user account and indicating whether sending of network traffic generated on behalf of the user account is to be blocked or is to be allowed for a particular scope applicable to the outbound network traffic; and

determining, based on the checking, whether to block or allow sending of the outbound network traffic.

13. The computer program product of claim 11, wherein the user is included in a user group for authenticating to the system, wherein the obtained user account information comprises an indication of the user group, and wherein the filtering comprises:

checking a rule of the one or more rules, the rule specifying the user group and indicating whether sending of network traffic generated on behalf of users included in the user group is to be blocked or is to be allowed for a particular scope applicable to the outbound network traffic; and

determining, based on the checking, whether to block or allow sending of the outbound network traffic.

14. The computer program product of claim 11, wherein the user authenticates to the system by logging onto an authentication domain, wherein the obtained user account information comprises an indication of the authentication domain, and wherein the filtering comprises:

checking a rule of the one or more rules, the rule specifying the authentication domain and indicating whether sending of network traffic generated on behalf of users authenticating to the system by logging onto the authentication domain is to be blocked or is to be allowed for a particular scope applicable to the outbound network traffic; and

determining, based on the checking, whether to block or allow sending of the outbound network traffic.

15. The computer program product of claim 11, wherein the filtering comprises inspecting network traffic of the system to identify network traffic of one or more network traffic types, wherein the filtering of the outbound network traffic based on the indicated user account on behalf of which the outbound network traffic is generated applies to the one or more network traffic types, wherein outbound network traffic of a network traffic type other than the one or more networking traffic types is not subject to the filtering.

16. A computer system configured to perform a method comprising:

obtaining, in association with origination of outbound network traffic to be sent by a system, user account information of a user account on behalf of which the outbound network traffic is generated; and

performing filtering of the outbound network traffic based on the obtained user account information of the user account on behalf of which the outbound network traffic is generated, wherein the filtering is further based on one or more rules, and the filtering comprises determining whether to block or allow sending of the outbound network traffic from the system.

17. The computer system of claim 16, wherein the obtained user account information comprises an indication of the user account, and wherein the filtering comprises:

checking a rule of the one or more rules, the rule specifying the user account and indicating whether sending of network traffic generated on behalf of the user account is to be blocked or is to be allowed for a particular scope applicable to the outbound network traffic; and

determining, based on the checking, whether to block or allow sending of the outbound network traffic.

18. The computer system of claim 16, wherein the user is included in a user group for authenticating to the system, wherein the obtained user account information comprises an indication of the user group, and wherein the filtering comprises:

checking a rule of the one or more rules, the rule specifying the user group and indicating whether sending of network traffic generated on behalf of users included in the user group is to be blocked or is to be allowed for a particular scope applicable to the outbound network traffic; and

determining, based on the checking, whether to block or allow sending of the outbound network traffic.

19. The computer system of claim 16, wherein the user authenticates to the system by logging onto an authentication domain, wherein the obtained user account information comprises an indication of the authentication domain, and wherein the filtering comprises:

checking a rule of the one or more rules, the rule specifying the authentication domain and indicating whether sending of network traffic generated on behalf of users authenticating to the system by logging onto the authentication domain is to be blocked or is to be allowed for a particular scope applicable to the outbound network traffic; and

determining, based on the checking, whether to block or allow sending of the outbound network traffic.

20. The computer system of claim 16, wherein the filtering comprises inspecting network traffic of the system to identify network traffic of one or more network traffic types, wherein the filtering of the outbound network traffic based on the indicated user account on behalf of which the outbound network traffic is generated applies to the one or more network traffic types, wherein outbound network traffic of a network traffic type other than the one or more networking traffic types is not subject to the filtering.