Intelligent integrated network security device

• US 9,100,364 B2
• Filed: 03/31/2014
• Issued: 08/04/2015
• Est. Priority Date: 02/08/2002
• Status: Expired due to Fees

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Zuk, Nir
• Primary Examiner(s): Reza, Mohammad W
• Application Number:
  US14/230,180
• Publication Number:
  US 20140259146A1
• Time in Patent Office: 491 Days
• Field of Search: 726/13
• US Class Current: 1/1
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Methods, computer program products and apparatus for processing data packets are described. Methods include receiving the data packet, examining the data packet, determining a single flow record associated with the packet and extracting flow instructions for two or more devices from the single flow record.

Claims

1. A method comprising:

receiving, by one or more processors of a device, a data packet;

examining, by the one or more processors, the data packet;

determining, by the one or more processors, a single flow record associated with the data packet,

determining the single flow record including;

determining a packet identifier associated with the data packet, and

evaluating a flow table to identify the single flow record using the packet identifier;

extracting, by the one or more processors, a session identifier and flow instructions, for two or more security devices, from the single flow record,

the session identifier identifying a session associated with the data packet,

the two or more security devices being included in the device;

sending, by the one or more processors, the flow instructions and the session identifier to respective ones of the two or more security devices to facilitate processing of the data packet;

receiving, by the one or more processors and from the two or more security devices, processing results,

the processing results being generated by the two or more security devices when processing the data packet based on the flow instructions and the session identifier; and

processing, by the one or more processors, the data packet using the processing results.

2. The method of claim 1, where processing the data packet using the processing results includes:

dropping the packet;

or

forwarding the packet toward a destination of the packet.

3. The method of claim 1, where the data packet is included in a flow of packets associated with the session, and

where the single flow record further includes:

information identifying the flow of packets.

4. The method of claim 3, where sending the flow instructions and the session identifier to the respective ones of the two or more security devices includes:

sending, to the respective ones of the two or more security devices, the information identifying the flow of packets and the session identifier for the session.

5. The method of claim 3, where the single flow record further includes device specific information, and

where sending the flow instructions and the session identifier to the respective ones of the two or more security devices includes:

sending, to the respective ones of the two or more security devices, the information identifying the flow of packets, the session identifier for the session, and the device specific information.

6. The method of claim 1, where the two or more security devices include two or more of:

an intrusion prevention system,

a firewall, or

a router.

7. The method of claim 1, where determining the packet identifier includes:

extracting, from the data packet, a source address, a destination address, a source port number, a destination port number, and a protocol type associated with the data packet,

the packet identifier being based on the source address, the destination address, the source port number, the destination port number, and the protocol type.

8. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions which, when executed by one or more processors of a device, cause the one or more processors to receive a data packet;

one or more instructions which, when executed by the one or more processors, cause the one or more processors to examine the data packet;

one or more instructions which, when executed by the one or more processors, cause the one or more processors to determine a single flow record associated with the data packet,

the one or more instructions to determine the single flow record including;

one or more instructions which, when executed by the one or more processors, cause the one or more processors to determine a packet identifier associated with the data packet, and

one or more instructions which, when executed by the one or more processors, cause the one or more processors to evaluate a flow table to identify the single flow record using the packet identifier;

one or more instructions which, when executed by the one or more processors, cause the one or more processors to extract a session identifier and flow instructions, for two or more security devices, from the single flow record,

the two or more security devices being included in the device;

the session identifier identifying a session associated with the data packet;

one or more instructions which, when executed by the one or more processors, cause the one or more processors to send the session identifier and the flow instructions to respective ones of the two or more security devices to facilitate processing of the data packet;

one or more instructions which, when executed by the one or more processors, cause the one or more processors to receive, from the two or more security devices, processing results,

the processing results being generated by the two or more security devices when processing the data packet based on the flow instructions and the session identifier; and

one or more instructions which, when executed by the one or more processors, cause the one or more processors to process the data packet using the processing results.

9. The non-transitory computer-readable medium of claim 8, where the one or more instructions to process the data packet using the processing results include:

one or more instructions which, when executed by the one or more processors, cause the one or more processors to selectively;

log information regarding the data packet based on the processing results,

store the data packet based on the processing results, or

modify the data packet based on the processing results.

10. The non-transitory computer-readable medium of claim 8, where the instructions further include:

one or more instructions which, when executed by the one or more processors, cause the one or more processors to receive another data packet;

one or more instructions which, when executed by the one or more processors, cause the one or more processors to determine that a single flow record, associated with the other data packet, is not found in the flow table; and

one or more instructions which, when executed by the one or more processors, cause the one or more processors to create and store, in the flow table, a new single flow record associated with the other data packet.

11. The non-transitory computer-readable medium of claim 10, where the other data packet is associated with another session, and

where the instructions further include:

one or more instructions which, when executed by the one or more processors, cause the one or more processors to communicate with the two or more security devices to determine a security policy for packets associated with the other session;

one or more instructions which, when executed by the one or more processors, cause the one or more processors to assign an identifier to the other session; and

one or more instructions which, when executed by the one or more processors, cause the one or more processors to store, in the new single flow record, the identifier of the other session and the security policy.

12. The non-transitory computer-readable medium of claim 8, where the one or more instructions to process the data packet using the processing results include:

one or more instructions which, when executed by the one or more processors, cause the one or more processors to selectively;

drop the data packet based on the processing results, or

forward the data packet to a destination of the data packet based on the processing results.

13. The non-transitory computer-readable medium of claim 8, where each security device, of the two or more security devices, includes a different one of:

an intrusion prevention system,

a firewall, or

a router.

14. The non-transitory computer-readable medium of claim 8, where the one or more instructions to determine the packet identifier include:

one or more instructions which, when executed by the one or more processors, cause the one or more processors to extract, from the data packet, a source address, a destination address, a source port number, a destination port number, and a protocol type associated with the data packet, and

where the packet identifier is based on the source address, the destination address, the source port number, the destination port number, and the protocol type.

15. A system comprising:

a device to;

receive a data packet;

determine a packet identifier associated with the data packet;

search a flow table, using the packet identifier, to identify a single flow record associated with the data packet;

extract a session identifier and flow instructions, for two or more security devices, from the single flow record,

the two or more security devices being included in the device;

the session identifier identifying a session associated with the data packet;

send the session identifier and the flow instructions to respective ones of the two or more security devices to facilitate processing of the data packet;

receive, from the two or more security devices, processing results,

the processing results being generated by the two or more security devices when processing the data packet based on the flow instructions and the session identifier; and

selectively;

drop the data packet based on the processing results, or

forward the data packet to a destination of the data packet based on the processing results.

16. The system of claim 15, where each security device, of the two or more security devices, includes a different one of:

an intrusion prevention system,

a firewall, or

a router.

17. The system of claim 15, where the data packet is included in a flow of packets associated with the session, and

where the single flow record includes:

information identifying the flow of packets.

18. The system of claim 17, where, when sending the flow instructions, the device is to:

send, to the respective ones of the two or more security devices, the information identifying the flow of packets and the session identifier for the session.

19. The system of claim 15, where the device is further to:

receive another data packet;

determine that a single flow record, associated with the other data packet, is not found in the flow table; and

create and store, in the flow table, a new single flow record associated with the other data packet.

20. The system of claim 19, where the other data packet is associated with another session, and

where the device is further to:

communicate with the two or more security devices to obtain information relating to processing packets associated with the other session;

assign another session identifier to the other session; and

store, in the new single flow record, the other session identifier and the information relating to processing the packets associated with the other session.