Secure and lightweight traffic forwarding systems and methods to cloud based network security systems

• US 9,350,644 B2
• Filed: 12/04/2014
• Issued: 05/24/2016
• Est. Priority Date: 04/13/2012
• Status: Active Grant

• Current Assignee: Zscaler Incorporated
• Original Assignee: Zscaler Incorporated
• Inventors: Mahajan, Vikas, Bansal, Abhinav, Desai, Purvi
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US14/560,609
• Publication Number:
  US 20150143504A1
• Time in Patent Office: 537 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 45/14 Routing performance; Theoretical aspects
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A method implemented by an agent operating on a mobile device communicating to a cloud-based system includes opening up local listening sockets on the mobile device; redirecting outgoing traffic from all application on the mobile device except the agent to the local listening sockets; and forwarding the outgoing traffic from the local listening sockets to the cloud-based system with additional information included therein for the cloud-based system.

Claims

1. A method implemented by an agent operating on a mobile device communicating to a cloud-based system, the method comprising:

opening up local listening sockets on the mobile device;

redirecting outgoing traffic from all applications on the mobile device except the agent to the local listening sockets; and

forwarding the outgoing traffic from the local listening sockets to the cloud-based system with additional information included therein for the cloud-based system.

2. The method of claim 1, wherein the local listening sockets are a Transmission Control Protocol (TCP) listening socket for Web traffic and a User Datagram Protocol (UDP) listening socket for Domain Name System (DNS) traffic.

3. The method of claim 1, wherein the redirecting outgoing traffic comprises using an Internet Protocol (IP) tables, firewall rules-based approach where the agent configures firewall rules to reroute the outgoing traffic to the local listening sockets.

4. The method of claim 1, wherein the redirecting outgoing traffic comprises using a tunnel interface approach using a tunnel interface to reroute the outgoing traffic to the local listening sockets.

5. The method of claim 1, further comprising:

applying local policies at the mobile device, through the agent, prior to forwarding the outgoing traffic.

6. The method of claim 5, wherein the cloud-based system is configured to apply remote policies subsequent to the forwarding the outgoing traffic.

7. The method of claim 5, further comprising:

blocking an outgoing request based on the outgoing traffic based on the local policies and displaying a locally generated end user notification.

8. The method of claim 5, wherein the local policies comprise bandwidth quota limits.

9. The method of claim 1, wherein the additional information comprises any of app unique package name, app version, operating system version, device model, and agent app version.

10. A mobile device, comprising:

a network interface communicatively coupled to a network, a processor communicatively coupled to the network interface, and memory storing instructions that when executed cause the processor to;

open up local listening sockets on the mobile device;

redirect outgoing traffic from all applications on the mobile device except an agent to the local listening sockets; and

forward the outgoing traffic from the local listening sockets to a cloud-based system with additional information included therein for the cloud-based system.

11. The mobile device of claim 10, wherein the local listening sockets are a Transmission Control Protocol (TCP) listening socket for Web traffic and a User Datagram Protocol (UDP) listening socket for Domain Name System (DNS) traffic.

12. The mobile device of claim 10, wherein the outgoing traffic is redirected using an Internet Protocol (IP) tables, firewall rules-based approach where the agent configures firewall rules to reroute the outgoing traffic to the local listening sockets.

13. The mobile device of claim 10, wherein the outgoing traffic is redirected using a tunnel interface approach using a tunnel interface to reroute the outgoing traffic to the local listening sockets.

14. The mobile device of claim 10, wherein the memory storing instructions that when executed further cause the processor to:

apply local policies at the mobile device, through the agent, prior to forwarding the outgoing traffic.

15. The mobile device of claim 14, wherein the cloud-based system is configured to apply remote policies subsequent to the forwarding the outgoing traffic.

16. The mobile device of claim 14, wherein the memory storing instructions that when executed further cause the processor to:

block an outgoing request based on the outgoing traffic based on the local policies and displaying a locally generated end user notification.

17. The mobile device of claim 14, wherein the local policies comprise bandwidth quota limits.

18. The mobile device of claim 14, wherein the additional information comprises any of app unique package name, app version, operating system version, device model, and agent app version.