System and method to apply forwarding policy to an application session

• US 9,219,751 B1
• Filed: 07/16/2013
• Issued: 12/22/2015
• Est. Priority Date: 10/17/2006
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Chen, Lee, Chiong, John, Oshiba, Dennis
• Primary Examiner(s): Le, Chau
• Assistant Examiner(s): LAVELLE, GARY E
• Application Number:
  US13/943,642
• Time in Patent Office: 889 Days
• Field of Search: 726/1
• US Class Current: 1/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 65/1026 : at the edge
• CPC Class Codes: H04L 67/01 : Protocols
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1004 : Server selection for load balancing
• CPC Class Codes: H04L 67/104 : Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 69/28 : Timers or timing mechanisms used in protocols
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04M 1/7243 : with interactive means for internal management of messages
• CPC Class Codes: H04W 12/084 : using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/61 : Time-dependent

Abstract

Method for applying a security policy to an application session, includes: recognizing the application session between a network and an application via a security gateway; determining by the security gateway a user identity of the application session using information about the application session; obtaining by the security gateway the security policy comprising network parameters mapped to the user identity; and applying the security policy to the application session by the security gateway. The user identity may be a network user identity or an application user identity recognized from packets of the application session. The security policy may comprise a network traffic policy mapped and/or a document access policy mapped to the user identity, where the network traffic policy is applied to the application session. The security gateway may further generate a security report concerning the application of the security policy to the application session.

Claims

1. A method for applying a forwarding policy by a network gateway comprising:

recognizing an application session between a first host having a first host identity and an application server;

determining an application identifier, application session time, and first user identity associated with the application session;

providing the first host identity and the application session time;

receiving a second user identity in response to the first host identity corresponding to a second host identity and the application session time corresponding to an access session time, the second host identity and the access session time being in an access session record, the second host identity associated with a second host, the access session record further including a second user identity;

associating the second user identity with the first user identity;

sending the application identifier and the first user identity;

receiving a forwarding policy; and

applying the forwarding policy to the application session.

2. The method of claim 1 further comprising:

sending the application session time and the first host identity; and

receiving the first user identity.

3. The method of claim 1 further comprising:

storing the forwarding policy.

4. The method of claim 1 wherein the forwarding policy comprises a forwarding information comprising at least one of a forwarding path, a link interface preference, a server load balancing preference, and a routing policy;

and the applying the forwarding policy to the application session is based on the forwarding information.

5. The method of claim 1 wherein the forwarding policy comprises a network traffic processing information comprising at least one of bandwidth management, rate control, queuing delay, quality of service, and Differentiated Services Code Point (DSCP) marking;

and the applying the forwarding policy to the application session is based on the network traffic processing information.

6. The method of claim 1 wherein the forwarding policy comprises a security information comprising at least one of access control, packet monitoring, file and document transfer monitoring, application user identity monitoring;

and the applying the forwarding policy to the application session is based on the security information.

7. The method of claim 1 further comprising:

retrieving an application data field from the application session; and

creating an application session record for the application session including the application data field.

8. The method of claim 7 wherein the application data field comprises at least one of a file name, document information, a URL, a user name, an email, a voice mail, and an identity.

9. The method of claim 8 wherein the forwarding policy comprises forwarding information comprising at least one of a forwarding path, a link interface preference, a server load balancing preference, and a routing policy;

and the applying the forwarding policy to the application session is based on the forwarding information.

10. The method of claim 8 wherein the forwarding policy comprises a security information comprising one of access control, packet monitoring, file and document transfer monitoring, application user identity monitoring;

and the applying the forwarding policy to the application session is based on the security information.

11. A system for applying a forwarding policy by a network gateway comprising:

a network gateway that;

recognizes an application session between a first host having a first host identity and an application server;

determines an application identifier, application session time, and first user identity associated with the application session;

provides the first host identity and the application session time;

receives a second user identity in response to the first host identity corresponding to a second host identity and the application session time corresponding to an access session time, the second host identity and the access session time being in an access session record, the second host identity associated with a second host, the access session record further including a second user identity;

associates the second user identity with the first user identity;

sends the application identifier and the first user identity;

receives a forwarding policy; and

applies the forwarding policy to the application session.

12. The system of claim 11 wherein the network gateway further:

sends the application session time and the first host identity; and

receives the first user identity.

13. The system of claim 11 wherein the network gateway further:

stores the forwarding policy.

14. The system of claim 11 wherein the forwarding policy comprises a forwarding information comprising at least one of a forwarding path, a link interface preference, a server load balancing preference, and a routing policy;

and the network gateway applies the forwarding policy to the application session based on the forwarding information.

15. The system of claim 11 wherein the forwarding policy comprises a network traffic processing information comprising at least one of bandwidth management, rate control, queuing delay, quality of service, and Differentiated Services Code Point (DSCP) marking;

and network gateway applies the forwarding policy to the application session based on the network traffic processing information.

16. The system of claim 11 wherein the forwarding policy comprises a security information comprising at least one of access control, packet monitoring, file and document transfer monitoring, application user identity monitoring;

and the network gateway applies the forwarding policy to the application session based on the security information.

17. The system of claim 11 wherein the network gateway further:

retrieves an application data field from the application session; and

creates an application session record for the application session including the application data field.

18. The system of claim 17 wherein the application data field comprises at least one of a file name, document information, a URL, a user name, an email, a voice mail, and an identity.

19. The system of claim 18 wherein the forwarding policy comprises forwarding information comprising at least one of a forwarding path, a link interface preference, a server load balancing preference, and a routing policy;

and the network gateway applies the forwarding policy to the application session based on the forwarding information.

20. The method of claim 18 wherein the forwarding policy comprises a security information comprising at least one of access control, packet monitoring, file and document transfer monitoring, application user identity monitoring, and the network gateway applies the forwarding policy to the application session based on the security information.

21. A non-transitory computer-readable medium having instructions stored thereon, the instructions being executable by at least one processor to perform a method, the method comprising:

recognizing an application session between a first host having a first host identity and an application server;

determining an application identifier, application session time, and first user identity associated with the application session;

providing the first host identity and the application session time;

receiving a second user identity in response to the first host identity corresponding to a second host identity and the application session time corresponding to an access session time, the second host identity and the access session time being in an access session record, the second host identity associated with a second host, the access session record further including a second user identity;

associating the second user identity with the first user identity;

sending the application identifier and the first user identity;

receiving a forwarding policy; and

applying the forwarding policy to the application session.

22. The non-transitory computer-readable medium of claim 21 wherein the method further comprising:

sending the application session time and the first host identity; and

receiving the first user identity.

23. The non-transitory computer-readable medium of claim 21 wherein the method further comprises:

storing the forwarding policy.

24. The non-transitory computer-readable medium of claim 21 wherein the forwarding policy comprises a forwarding information comprising at least one of forwarding path, a link interface preference, a server load balancing preference, and a routing policy;

and the applying the forwarding policy to the application session is based on the forwarding information.

25. The non-transitory computer-readable medium of claim 21 wherein the forwarding policy comprises a network traffic processing information comprising at least one of bandwidth management, rate control, queuing delay, quality of service, and Differentiated Services Code Point (DSCP) marking;

and the applying the forwarding policy to the application session is based on the network traffic processing information.

26. The non-transitory computer-readable medium of claim 21 wherein the forwarding policy comprises a security information comprising at least one of access control, packet monitoring, file and document transfer monitoring, application user identity monitoring;

and the applying the forwarding policy to the application session is based on the security information.

27. The non-transitory computer-readable medium of claim 21 wherein the method further comprises:

retrieving an application data field from the application session; and

creating an application session record for the application session including the application data field.

28. The non-transitory computer-readable medium of claim 27 wherein the application data field comprises at least one of a file name, document information, a URL, a user name, an email, a voice mail, and an identity.

29. The non-transitory computer-readable medium of claim 28 wherein the forwarding policy comprises forwarding information comprising at least one of a forwarding path, a link interface preference, a server load balancing preference, and a routing policy;

and the applying the forwarding policy to the application session is based on the forwarding information.

30. The non-transitory computer-readable medium of claim 28 wherein the forwarding policy comprises a security information comprising at least one of access control, packet monitoring, file and document transfer monitoring, application user identity monitoring;

and the applying the forwarding policy to the application session is based on the security information.