Filtering network packets in multiple forwarding information base systems

• US 8,997,203 B2
• Filed: 08/07/2012
• Issued: 03/31/2015
• Est. Priority Date: 08/07/2012
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Tse, Chi Chiu, Xu, Jason Songbo, Halliop, Ania, Lai, Chun Hei Justin
• Primary Examiner(s): Zecher, Dede
• Assistant Examiner(s): MCCOY, RICHARD ANTHONY
• Application Number:
  US13/568,735
• Publication Number:
  US 20140047534A1
• Time in Patent Office: 966 Days
• Field of Search: None
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/086 using security domains

Abstract

In some implementations, a method for routing communication includes determining a binding interface for a communication session based on a forwarding information base (FIB) and a destination for the communication session. The communication session is from an application running on user equipment (UE), and the binding interface is included in a virtual private network (VPN) tunnel established through an Internet Protocol (IP) security (IPsec) interface. Whether to filter the communication session is determined based on which perimeter of the UE includes the binding interface and which perimeter of the UE includes the IPsec interface.

Claims

1. A method for routing communication, comprising:

receiving a request for a communication session from an application running on a user device, wherein the user device includes two or more perimeters, a binding interface, and an Internet Protocol (IP) security (IPsec) interface wherein the binding interface comprises a wireless interface hardware component for the receiving of the request and the routing of the communications for the communications session, each of the two or more perimeters includes resources specific to each respective perimeter and is configured to prevent the resources specific to perimeters other than the each respective perimeter from accessing the resources specific to the each respective perimeter;

determining the binding interface for the communication session based on a forwarding information base (FIB) and a destination for the communication session, the binding interface shared with the two or more perimeters;

determining that a virtual private network(VPN) tunnel is currently established through the IPsec interface and the binding interface; and

determining whether to filter the communication session based on which of the two or more perimeters of the user device includes the binding interface and which of the two or more perimeters of the user device includes the IPsec interface when the VPN tunnel is currently established.

2. The method of claim 1, the method further comprising:

determining the binding interface, the IPsec interface, and the application are included in a same perimeter; and

filtering packets from the application to prevent direct access to the binding interface, wherein the filtered packets were generated for the communication session.

3. The method of claim 2, wherein the same perimeter is an enterprise perimeter, the method further comprising:

determining applications including the application in a personal perimeter are granted access to interfaces in the enterprise perimeter; and

filtering packets from the applications in both the personal perimeter and the enterprise perimeter to substantially prevent direct access to the binding interface, wherein the filtered packets were generated for the communication session.

4. The method of claim 1, the method further comprising:

determining the binding interface and the IPsec interface are included in different perimeters;

determining applications in a personal perimeter are granted access to interfaces in an enterprise perimeter; and

filtering packets from the applications in the personal perimeter to prevent direct access to the binding interface, wherein the filtered packets were generated for the communication session.

5. The method of claim 1, the method further comprising:

determining the binding interface and the IPsec interface are included different perimeters;

determining applications in a personal perimeter are prohibited access to interfaces in an enterprise perimeter; and

routing packets for the requested communication session to the binding interface.

6. The method of claim 1, wherein the user device comprises a mobile device.

7. The method of claim 1, wherein the binding interface comprises at least one of a Wifi interface, a cellular interface, or a frequency-hopping spread spectrum interface.

8. A computer program product encoded on a tangible, non-transitory storage medium, the product comprising computer readable instructions for causing one or more processors to perform operations comprising:

receiving a request for a communication session from an application running on a user device, wherein the user device includes two or more perimeters, a binding interface, and an Internet Protocol (IP) security (IPsec) interface, wherein the binding interface comprises a wireless interface hardware component for the receiving of the request and the routing of the communications for the communications session, each of the two or more perimeters includes resources specific to each respective perimeter and is configured to prevent the resources specific to perimeters other than the each respective perimeter from accessing the resources specific to the each respective perimeter;

determining the binding interface for the communication session based on a forwarding information base (FIB) and a destination for the communication session, the binding interface shared with the two or more perimeters;

determining that a virtual private network (VPN) tunnel is currently established through the IPsec interface and the binding interface; and

determining whether to filter the communication session based on which of the two or more perimeters of the user device includes the binding interface and which of the two or more perimeters of the user device includes the IPsec interface when the VPN tunnel is currently established.

9. The computer program product of claim 8, the instructions further comprising:

determining the binding interface, the IPsec interface, and the application are included in a same perimeter; and

filtering packets from the application to prevent direct access to the binding interface, wherein the filtered packets were generated for the communication session.

10. The computer program product of claim 9, wherein the same perimeter is an enterprise perimeter, the instructions further comprising:

determining applications including the application in a personal perimeter are granted access to interfaces in the enterprise perimeter; and

filtering packets from the applications in both the personal perimeter and the enterprise perimeter to substantially prevent direct access to the binding interface, wherein the filtered packets were generated for the communication session.

11. The computer program product of claim 8, the instructions further comprising:

determining the binding interface and the IPsec interface are included different perimeters;

determining applications in a personal perimeter are granted access to interfaces in an enterprise perimeter; and

filtering packets from the applications in the personal perimeter to prevent direct access to the binding interface, wherein the filtered packets were generated for the communication session.

12. The computer program product of claim 8, the instructions further comprising:

determining the binding interface and the IPsec interface are included in different perimeters;

determining applications in a personal perimeter are prohibited access to interfaces in an enterprise perimeter; and

routing packets for the requested communication session to the binding interface.

13. The computer program product of claim 8, wherein the user device comprises a mobile device.

14. The computer program product of claim 8, wherein the binding interface comprises at least one of a Wifi interface, a cellular interface, or a frequency-hopping spread spectrum interface.

15. A user device for routing a communication, comprising:

memory that stores a plurality of FIBs including a FIB and an application, wherein each FIB in the plurality of FIBs identifies routes and interfaces for communicating messages; and

one or more processors configured to;

receive a request for a communication session from an application running on a user device, wherein the user device includes two or more perimeters, a binding interface, and an Internet Protocol (IP) security (IPsec) interface wherein the binding interface comprises a wireless interface hardware component for the receiving of the request and the routing of the communications for the communications session, each of the two or more perimeters includes resources specific to each respective perimeter and is configured to prevent the resources specific to perimeters other than the each respective perimeter from accessing the resources specific to the each respective perimeter;

determine the binding interface for the communication session based on a forwarding information base (FIB) and a destination for the communication session, the binding interface shared with the two or more perimeters;

determine that a virtual private network (VPN) tunnel is currently established through the IPsec interface and the binding interface; and

determine whether to filter the communication session based on which of the two or more perimeters of the user device includes the binding interface and which of the two or more perimeters of the user device includes the IPsec interface when the VPN tunnel is currently established.

16. The user device of claim 15, the processors further configured to:

determine the binding interface, the IPsec interface, and the application are included in a same perimeter; and

filter packets from the application to prevent direct access to the binding interface, wherein the filtered packets were generated for the communication session.

17. The user device of claim 16, wherein the same perimeter is an enterprise perimeter, the processors further configured to:

determine applications including the application in a personal perimeter are granted access to interfaces in the enterprise perimeter; and

filter packets from the applications in both the personal perimeter and the enterprise perimeter to substantially prevent direct access to the binding interface, wherein the filtered packets were generated for the communication session.

18. The user device of claim 15, the processors further configured to:

determine the binding interface and the IPsec interface are included different perimeters;

determine applications in a personal perimeter are granted access to interfaces in an enterprise perimeter; and

filter packets from the applications in the personal perimeter to prevent direct access to the binding interface, wherein the filtered packets were generated for the communication session.

19. The user device of claim 15, the processors further configured to:

determine the binding interface and the IPsec interface are included in different perimeters;

determine applications in a personal perimeter are prohibited access to interfaces in an enterprise perimeter; and

route packets for the requested communication session to the binding interface.

20. The user device of claim 15, wherein the binding interface comprises at least one of a Wifi interface, a cellular interface, or a frequency-hopping spread spectrum interface.