Dynamic policy provisioning within network security devices

• US 8,856,926 B2
• Filed: 05/20/2009
• Issued: 10/07/2014
• Est. Priority Date: 06/27/2008
• Status: Expired due to Fees

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Narayanaswamy, Krishna, Arun, Prashanth
• Primary Examiner(s): SCOTT, RANDY A
• Application Number:
  US12/468,905
• Publication Number:
  US 20090328219A1
• Time in Patent Office: 1,966 Days
• Field of Search: 709/239
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The invention is directed to techniques for dynamic policy provisioning. A network security device may comprise a memory that stores a first policy that identifies a first set of patterns that correspond to a first set of network attacks and a second policy, and a control unit that applies the first policy to the network traffic to detect the first set of network attacks. The control unit, while applying the first policy, monitors parameters corresponding to one or more resources and dynamically determines whether to apply a second policy to the network traffic based on the parameters. The control unit, based on the dynamic determination, applies the second policy to the network traffic to detect a second set of network attacks and forwards the network traffic based on the application of the second policy. In this manner, the network security device may implement the dynamic policy provisioning techniques.

Claims

1. A method comprising:

receiving, with a network security device of a network, network traffic;

while processing the network traffic, monitoring, with the network security device, a level of utilization of one or more internal hardware resources of the network security device;

when the level of utilization of the one or more internal hardware resources is less than a threshold, applying, with the network security device, a first policy to the network traffic to detect a first set of network attacks, wherein the first policy identifies a first set of attack patterns that correspond to the first set of network attacks;

when the level of utilization of the one or more internal hardware resources equals or exceeds the threshold, applying, with the network security device, the second policy to at least a portion of the network traffic to detect a second set of network attacks, wherein the second policy identifies a second set of attack patterns that correspond to the second set of network attacks, and wherein the first set of attack patterns and the second set of attack patterns identify at least one different attack pattern; and

forwarding, with the network security device, at least the portion of the network traffic based on the application of the first policy or the second policy.

2. The method of claim 1,

wherein the network security device internally comprises a first path for processing initial packets of new packet flows and a fast path for processing packets for existing packet flows,

wherein the second policy specifies that the second set of attack patterns are to be applied to the initial packets of the fast path without application to the packets of the first path.

3. The method of claim 1, further comprising:

configuring the threshold by which to determine when to dynamically apply the second policy,

calculating, based on the level of utilization of the one or more internal hardware resources, an indicator that represents a condition of the network,

wherein applying the second policy comprises;

comparing the indicator to the threshold; and

applying the second policy to at least the portion of the network traffic when the indicator equals or exceeds the threshold.

4. The method of claim 3,

wherein the first set of patterns include a full set of attack patterns,

wherein the first set of network attacks include a full set of known network attacks,

wherein the second set of network attacks include a subset of the full set of known attack patterns, and

wherein the second policy identifies a subset of the full set of attack patterns that correspond to the subset of the full set of network attacks.

5. The method of claim 1, wherein the first set of attack patterns include the second set of attack patterns and an additional set of attack patterns that correspond to the second set of network attacks and an additional set of network attacks.

6. The method of claim 1,

wherein the threshold comprises a first threshold, and

wherein the method further comprises:

when the level of utilization of the one or more internal hardware resources equals or exceeds a second threshold, applying, with the network security device, a third policy to the network traffic; and

forwarding, with the network security device, the network traffic based on the application of the third policy.

7. The method of claim 1, wherein applying the first policy to the network traffic includes:

classifying a packet of the network traffic by (i) extracting a five-tuple from the packet, (ii) retrieving, from a flow table that stores a plurality of flow entries, one of the plurality of flow entries that correspond to the extracted five-tuple and (iii) determining that the first policy is associated with the packet in the retrieved one of the plurality of flow entries;

storing the packet to a queue of the network security device with a tag that identifies the first policy;

retrieving the packet and the corresponding tag from the queue; and

processing the packet by applying the first policy indicated by the tag to the packet.

8. The method of claim 7, further comprising updating, with the network security device, the flow table when the indicator equals or exceeds the threshold such that one or more of the plurality of flow entries are updated to associate one or more corresponding flows with the second policy,

wherein applying the second policy comprises:

classifying another packet of the network traffic by (i) extracting another five-tuple from the other packet, (ii) retrieving one of the plurality of updated flow entries that correspond to the other five-tuple and (iii) determining that the second policy is associated with the packet in the retrieved one of the plurality of updated flow entries;

storing the other packet to a queue of the network security device with another tag that identifies the second policy;

retrieving the other packet and the corresponding other tag from the queue; and

processing the other packet by applying the second policy indicated by the other tag to the packet.

9. The method of claim 1, wherein the network security device comprises one of an intrusion prevention device, an intrusion detection device, and an intrusion detection and prevention (IDP) device.

10. The method of claim 1, further comprising receiving the first and second policies via either direct interaction between the network security device and an administrator or remotely from a network security management (NSM) device.

11. The method of claim 1, wherein the parameters include a queue depth, a memory resource, a queue threshold, a processor utilization, and a number of sessions.

12. The method of claim 1, further comprising:

classifying the incoming network traffic to determine a first packet of the network traffic and a second packet of the network traffic, wherein the first packet has a first characteristic and the second packet has a second characteristic different from the first characteristic,

wherein applying the second policy comprises applying the second policy by applying the first policy only to the first packet, and

wherein forwarding the portion of the network traffic comprises;

forwarding the second packet without applying the first or second policies to the second packet; and

forwarding the first packet based on the application of the first policy to the first packet.

13. A network security device of a network that receives network traffic comprising:

a memory that stores a first policy and a second policy, wherein the first policy identifies a first set of attack patterns that correspond to a first set of network attacks, the second policy identifies a second set of attack patterns that correspond to the second set of network attacks, and the first set of attack patterns and the second set of attack patterns identify at least one different attack pattern; and

a control unit that monitors, while processing the network traffic, a level of utilization of one or more internal hardware resources of the network security device, when the level of utilization of the one or more internal hardware resources is less than a threshold, applies the first policy to the network traffic to detect the first set of network attacks, when the level of utilization of the one or more internal hardware resources equals or exceeds the thresholds, applies the second policy to at least a portion of the network traffic to detect a second set of network attacks based on the dynamic determination, and forwards at least the portion of the network traffic based on the application of the first policy or the second policy.

14. The network security device of claim 13,

wherein the control unit comprises a first path for processing initial packets of new packet flows and a fast path for processing packets for existing packet flows,

wherein the second policy specifies that the second set of attack patterns are to be applied to the initial packets of the fast path without application to the packets of the first path.

15. The network security device of claim 13, wherein the control unit comprises a dynamic security manager module that configures the threshold by which to determine whether to apply the second policy, calculates, based on the level of utilization of the one or more internal hardware resources, an indicator that represents a condition of the network, and

compares the indicator to the threshold;

and

dynamically selects to apply the second policy to at least the portion of the network traffic when the indicator equals or exceeds the threshold.

16. The network security device of claim 15,

wherein the first set of patterns include a full set of attack patterns,

wherein the first set of network attacks include a full set of known network attacks,

wherein the second set of network attacks include a subset of the full set of known attack patterns, and

wherein the second policy identifies a subset of the full set of attack patterns that correspond to the subset of the full set of network attacks.

17. The network security device of claim 13, wherein the first set of attack patterns include the second set of attack patterns and an additional set of attack patterns that correspond to the second set of network attacks and an additional set of network attacks.

18. The network security device of claim 13,

wherein the threshold comprises a first threshold, and

wherein the control unit further, when the level of utilization equals or exceeds a second threshold, applies a third policy to at least the portion of the network traffic, the third policy different from the first and second policies in that the third policy identifies at least one attack pattern different from the first and second sets of attack patterns and forwards the network traffic based on the application of the third policy.

19. The network security device of claim 13,

wherein the memory further includes a flow table that stores a plurality of flow entries, and

wherein, to apply the first policy to the network traffic, the control unit includes:

a classifier module that classifies a packet of the network traffic by (i) extracting a five-tuple from the packet, (ii) retrieving, from the flow table, one of the plurality of flow entries that correspond to the extracted five-tuple and (iii) determining that the first policy is associated with the packet in the retrieved one of the plurality of flow entries, and stores the packet to a queue of the network security device with a tag that identifies the first policy; and

a servicing engine that retrieves the packet and the corresponding tag from the queue and processes the packet by applying the first policy indicated by the tag to the packet.

20. The network security device of claim 19, wherein the control unit further includes:

a table management module that, in response to the dynamic security manager module dynamically determining to apply the second policy, updates the flow table such that one or more of the plurality of flow entries are updated to associate one or more corresponding flows with the second policy,

wherein, to apply the second policy, the classifier module classifies another packet of the network traffic by (i) extracting another five-tuple from the other packet, (ii) retrieving one of the plurality of updated flow entries that correspond to the other five-tuple and (iii) determining that the second policy is associated with the packet in the retrieved one of the plurality of updated flow entries and stores the other packet to a queue of the network security device with another tag that identifies the second policy,

wherein, to further apply the second policy, the servicing engine retrieves the other packet and the corresponding other tag from the queue and processes the other packet by applying the second policy indicated by the other tag to the packet.

21. The network security device of claim 13, wherein the network security device comprises one of an intrusion prevention device, an intrusion detection device, and an intrusion detection and prevention (IDP) device.

22. The network security device of claim 13, wherein the control unit further includes a user interface module that receives the first and second policies via either direct interaction with an administrator or remotely from a network security management (NSM) device.

23. The network security device of claim 13, wherein the parameters include a queue depth, a memory resource, a queue threshold, a processor utilization, and a number of sessions.

24. The network security device of claim 13,

wherein the control unit further classifies the incoming network traffic to determine a first packet of the network traffic and a second packet of the network traffic, wherein the first packet has a first characteristic and the second packet has a second characteristic different from the first characteristic,

wherein the control unit includes a servicing engine that applies the second policy by applying the first policy only to the first packet based on the dynamic determination,

wherein the control unit includes a classifier module that forwards the portion of the network traffic by forwarding the second packet without applying the first or second policies to the second packet,

wherein the servicing engine forwards the first packet based on the application of the first policy to the first packet.

25. A network system comprising:

a plurality of computing nodes of a network that transmit and receive network traffic;

a plurality of network security devices of the network that process the network traffic; and

a network security manager (NSM) device that distributes a plurality of policies to each of the plurality of network security devices,

wherein each of the plurality of network security devices includes;

a memory that stores a first one of the plurality of policies and a second one of the plurality of policies, wherein the first one of the plurality of policies identifies a first set of attack patterns that correspond to a first set of network attacks, the second one of the plurality of policies identifies a second set of attack patterns that correspond to the second set of network attacks, and the first set of attack patterns and the second set of attack patterns identify at least one different attack pattern; and

a control unit that monitors, while processing the network traffic, a level of utilization of one or more internal hardware resources of the network security device, when the level of utilization of the one or more internal hardware resources is less than a threshold, applies the first policy to the network traffic to detect the first set of network attacks, when the level of utilization of the one or more internal hardware resources equals or exceeds the thresholds, applies the second policy to at least a portion of the network traffic to detect a second set of network attacks based on the dynamic determination, and forwards at least the portion of the network traffic based on the application of the first policy or the second policy.

26. The network system of claim 25,

wherein the network security device internally comprises a first path for processing initial packets of new packet flows and a fast path for processing packets for existing packet flows,

wherein the second one of the plurality policies specifies that the second set of attack patterns are to be applied to the initial packets of the fast path without application to the packets of the first path.

27. The network system of claim 25, wherein the control unit of each of the plurality of network security devices comprises a dynamic security manager module that configures the threshold by which to determine whether to apply the second policy, calculates, based on the level of utilization of the one or more internal hardware resources, an indicator that represents a condition of the network, and

compares the indicator to the threshold;

and

dynamically selects to apply the second policy to at least the portion of the network traffic when the indicator equals or exceeds the threshold.

28. The network system of claim 27,

wherein the first set of patterns include a full set of attack patterns,

wherein the first set of network attacks include a full set of known network attacks,

wherein the second set of network attacks include a subset of the full set of known attack patterns, and

wherein the second one of the policies identifies a subset of the full set of attack patterns that correspond to the subset of the full set of network attacks.

29. The network security device of claim 25, wherein NSM device distributes the first one and second one of the policies of a first one of the plurality of network security devices are different from the first one and second one of the plurality of policies of a second one of the plurality of network security devices.

30. A non-transitory computer-readable storage medium comprising instructions for causing a programmable processor to:

receive, with a network security device of a network, network traffic;

while processing the network traffic, monitor, with the network security device, parameters corresponding to utilization of one or more internal resources of the network security device;

when the level of utilization of the one or more internal hardware resources is less than a threshold, apply, with the network security device, a first policy to the network traffic to detect a first set of network attacks, wherein the first policy identifies a first set of attack patterns that correspond to the first set of network attacks;

when the level of utilization of the one or more internal hardware resources equals or exceeds the threshold, apply, with the network security device, the second policy to at least a portion of the network traffic to detect a second set of network attacks, wherein the second policy identifies a second set of attack patterns that correspond to the second set of network attacks, and wherein the first set of attack patterns and the second set of attack patterns identify at least one different attack pattern; and

forward, with the network security device, at least the portion of the network traffic based on the application of the first policy or the second policy.

31. A method comprising:

receiving, with a network security device of a network, network traffic, wherein the network security device internally comprises a first path for processing initial packets of new packet flows and a fast path for processing packets for existing packet flows;

while processing the network traffic, monitoring, with the network security device, a level of utilization of one or more internal hardware resources of the network security device;

when the level of utilization of the one or more internal hardware resources is less than a threshold, applying, with the network security device, a first policy to the network traffic to detect a first set of network attacks, wherein the first policy identifies a first set of attack patterns that correspond to the first set of network attacks;

when the level of utilization of the one or more internal hardware resources equals or exceeds the threshold, applying, with the network security device, the second policy to at least a portion of the network traffic, wherein the second policy specifies that the first set of attack patterns are to be applied to all the packets of the fast path for the existing packet flows setup prior to the dynamic determination and without application to all the packets of the new flows that go through the first path after the dynamic determination; and

forwarding, with the network security device, at least the portion of the network traffic based on the application of the first policy or the second policy.