Application-based network traffic redirection for cloud security service

• US 8,892,766 B1
• Filed: 06/28/2012
• Issued: 11/18/2014
• Est. Priority Date: 06/28/2012
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Wei, Shaohong Peter, Jensen, Wayne
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): Asefa, Debebe
• Application Number:
  US13/536,774
• Time in Patent Office: 873 Days
• Field of Search: 370254-350, 709201-213, 709/235, 709/245, 726/22, 726/26
• US Class Current: 709/235
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

A cloud security service is made available to endpoint computers. Network traffic from originating application programs running on endpoint computers are redirected to the cloud security service based on characteristics of the originating application programs. Network traffic from an originating application program may be redirected to the cloud security service by way of a virtual private network (VPN) tunnel or generic routing encapsulation (GRE) tunnel between an endpoint computer and a cloud computing system hosting the cloud security service, for example. Network traffic from an originating application program may also be routed from an endpoint computer to a gateway system, and then redirected from the gateway system to the cloud computing system. The cloud security service may drop or forward network packets of the network traffic depending on a result of scanning the network packets.

Claims

1. A method of redirecting network traffic to a cloud security service, the method comprising:

receiving a first network traffic;

identifying a first originating application program that originated the first network traffic;

determining whether or not to redirect the first network traffic to a cloud security service based on a characteristic of the first originating application program;

redirecting the first network traffic to the cloud security service based on the characteristic of the first originating application program;

receiving a second network traffic;

identifying a second originating application program that originated the second network traffic;

determining whether or not to redirect the second network traffic to the cloud security service based on a characteristic of the second originating application program; and

not redirecting the second network traffic to the cloud security service based on the characteristic of the second originating application program,

wherein the second originating application program is different from the first originating application program.

2. The method of claim 1 wherein the first originating application program is running on a same computer that received the first network traffic.

3. The method of claim 1 wherein the first originating application program is running on a first computer and the first network traffic is received in another computer separate from the first computer.

4. The method of claim 3 wherein the other computer is a gateway computer.

5. The method of claim 3 further comprising:

determining an identity of the first originating application program in the first computer; and

providing the identity of the first originating application program and the first network traffic to the other computer.

6. The method of claim 3 further comprising:

determining an identity of the first originating application program in the first computer; and

encapsulating the network traffic in an encapsulation protocol to generate encapsulated network traffic that includes the identity of the first originating application program and the network traffic; and

transmitting the encapsulated network traffic to the other computer to provide the identity of the first originating application program and the first network traffic to the other computer.

7. The method of claim 1 further comprising:

receiving the first network traffic in the cloud security service; and

scanning network packets of the first network traffic.

8. The method of claim 7 wherein scanning the network packets of the first network traffic comprises scanning the network packets to perform content filtering.

9. The method of claim 7 wherein scanning the network packets of the first network traffic comprises scanning the network packets to perform intrusion prevention filtering.