Data leak protection in upper layer protocols

• US 9,444,788 B2
• Filed: 11/12/2015
• Issued: 09/13/2016
• Est. Priority Date: 09/10/2014
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Hastings, Eric C.
• Primary Examiner(s): HO, DAO Q
• Application Number:
  US14/940,041
• Publication Number:
  US 20160105396A1
• Time in Patent Office: 306 Days
• Field of Search: 726/11
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Methods and systems for Data Leak Prevention (DLP) in a private network are provided. A data structure is maintained within a network security appliance identifying candidate upper layer protocols, corresponding commands of interest and a corresponding suspect field within each of the commands that is to be subjected to DLP scanning as a result of its potential for carrying sensitive information. A packet is received by the network security appliance. A protocol associated with the packet is identified. It is determined whether the identified protocol is among those of the candidate protocols. Responsive to an affirmative determination and when a command represented by the packet is among those of the corresponding commands of interest for the candidate protocol, then a DLP scan is performed on the packet. Otherwise, the packet is allowed to pass through the network security appliance without being subject to a DLP scan.

Claims

1. A data leak prevention (DLP) method comprising:

maintaining, by a network security appliance within a private network, a data structure identifying therein a plurality of candidate upper layer protocols, one or more corresponding requests or commands of interest for each of the plurality of candidate upper layer protocols and a corresponding suspect field contained within each of the one or more corresponding requests or commands of interest that is to be subjected to DLP scanning as a result of its potential for carrying sensitive information out of the network;

receiving, by the network security appliance, a packet originated by a host device within the private network and directed to a destination device outside of the private network;

identifying, by the network security appliance, an upper layer protocol associated with the received packet based on a destination port specified in a header of the received packet or information contained in a protocol field of the header;

determining, by the network security appliance, whether the identified upper layer protocol is among the plurality of candidate upper layer protocols;

when a result of the determining is affirmative and a request or command represented by the received packet is among those of the one or more corresponding requests or commands of interest for the identified upper layer protocol, then performing a DLP scan on the received packet by;

extracting a content from the corresponding suspect field contained within the received packet;

applying a plurality of DLP rules to the extracted content, wherein each of the plurality of DLP rules are defined in terms of (i) one or more of a regular expression and a string that are configured to detect existence of one or more forms of sensitive information and (ii) information defining an action to take when one or more conditions associated with the DLP rule are satisfied; and

when said applying results in a conclusion that the one or more forms of sensitive information are contained within the received packet, then performing, by the network security appliance, the defined action; and

when the result is negative or the request or command represented by the received packet is not among those of the one or more corresponding requests or commands of interest for the identified upper layer protocol, then allowing by, the network security appliance, the received packet to pass through the network security appliance without performing the DLP scan on the received packet.

2. The method of claim 1, wherein the plurality of candidate upper layer protocols are configurable by a network administrator.

3. The method of claim 1, wherein the one or more corresponding requests or commands of interest for each of the plurality of candidate upper layer protocols are configurable by a network administrator.

4. The method of claim 1, wherein the corresponding suspect field is configurable by a network administrator.

5. The method of claim 1, wherein a candidate upper layer protocol of the plurality of candidate upper layer protocol comprises domain name system (DNS) protocol, wherein the one or more corresponding requests or commands of interest for the DNS protocol include a DNS query request and wherein the corresponding suspect field contained within the DNS query request comprises a name field.

6. The method of claim 1, wherein a candidate upper layer protocol of the plurality of candidate upper layer protocols comprises hypertext transfer protocol (HTTP), wherein the one or more corresponding requests or commands of interest for HTTP include an HTTP GET command and wherein the corresponding suspect field contained within the HTTP GET command comprises a uniform resource identifier (URI).

7. The method of claim 1, wherein a candidate upper layer protocol of the plurality of candidate upper layer protocols comprises file transfer protocol (FTP), wherein the one or more corresponding requests or commands of interest for FTP include an FTP command associated with a directory operation and wherein the corresponding suspect field contained within the FTP command comprises a directory field.

8. The method of claim 1, wherein a candidate upper layer protocol of the plurality of candidate upper layer protocols comprises file transfer protocol (FTP), wherein the one or more corresponding requests or commands of interest for FTP include an FTP command associated with a file download or a file upload operation and wherein the corresponding suspect field contained within the FTP command comprises a file name field.

9. The method of claim 1, wherein a candidate upper layer protocol of the plurality of candidate upper layer protocols comprises telnet protocol, wherein the one or more corresponding requests or commands of interest for the telnet protocol comprises a telnet command having at least one parameter and wherein the corresponding suspect field contained within the telnet command comprises the at least one parameter.

10. The method of claim 1, wherein the one or more forms of sensitive information comprise a payment card number.

11. The method of claim 10, wherein the regular expression detects a format and type of content corresponding to a credit card number associated with a particular payment processing provider.

12. The method of claim 1, wherein the one or more forms of sensitive information comprise a social security number.

13. A non-transitory program storage device readable by a network security appliance, tangibly embodying a program of instructions executable by one or more computer processors of the network security appliance to perform a method of data leak prevention (DLP), the method comprising:

maintaining a data structure identifying therein a plurality of candidate upper layer protocols, one or more corresponding requests or commands of interest for each of the plurality of candidate upper layer protocols and a corresponding suspect field contained within each of the one or more corresponding requests or commands of interest that is to be subjected to DLP scanning as a result of its potential for carrying sensitive information out of a private network protected by the network security appliance;

receiving a packet originated by a host device within the private network and directed to a destination device outside of the private network;

identifying an upper layer protocol associated with the received packet based on a destination port specified in a header of the received packet or information contained in a protocol field of the header;

determining whether the identified upper layer protocol is among the plurality of candidate upper layer protocols;

when a result of the determining is affirmative and a request or command represented by the received packet is among those of the one or more corresponding requests or commands of interest for the identified upper layer protocol, then performing a DLP scan on the received packet by;

extracting a content from the corresponding suspect field contained within the received packet;

applying a plurality of DLP rules to the extracted content, wherein each of the plurality of DLP rules are defined in terms of (i) one or more of a regular expression and a string that are configured to detect existence of one or more forms of sensitive information and (ii) information defining an action to take when one or more conditions associated with the DLP rule are satisfied; and

when said applying results in a conclusion that the one or more forms of sensitive information are contained within the received packet, then performing, by the network security appliance, the defined action; and

when the result is negative or the request or command represented by the received packet is not among those of the one or more corresponding requests or commands of interest for the identified upper layer protocol, then allowing the received packet to pass through the network security appliance without performing the DLP scan on the received packet.

14. The non-transitory program storage device of claim 13, wherein a candidate upper layer protocol of the plurality of candidate upper layer protocol comprises domain name system (DNS) protocol, wherein the one or more corresponding requests or commands of interest for the DNS protocol include a DNS query request and wherein the corresponding suspect field contained within the DNS query request comprises a name field.

15. The non-transitory program storage device of claim 13, wherein a candidate upper layer protocol of the plurality of candidate upper layer protocols comprises hypertext transfer protocol (HTTP), wherein the one or more corresponding requests or commands of interest for HTTP include an HTTP GET command and wherein the corresponding suspect field contained within the HTTP GET command comprises a uniform resource identifier (URI).

16. The non-transitory program storage device of claim 13, wherein a candidate upper layer protocol of the plurality of candidate upper layer protocols comprises file transfer protocol (FTP), wherein the one or more corresponding requests or commands of interest for FTP include an FTP command associated with a directory operation and wherein the corresponding suspect field contained within the FTP command comprises a directory field.

17. The non-transitory program storage device of claim 13, wherein a candidate upper layer protocol of the plurality of candidate upper layer protocols comprises file transfer protocol (FTP), wherein the one or more corresponding requests or commands of interest for FTP include an FTP command associated with a file download or a file upload operation and wherein the corresponding suspect field contained within the FTP command comprises a file name field.

18. The non-transitory program storage device of claim 13, wherein a candidate upper layer protocol of the plurality of candidate upper layer protocols comprises telnet protocol, wherein the one or more corresponding requests or commands of interest for the telnet protocol comprises a telnet command having at least one parameter and wherein the corresponding suspect field contained within the telnet command comprises the at least one parameter.

19. The non-transitory program storage device of claim 13, wherein the one or more forms of sensitive information comprise a payment card number.

20. The non-transitory program storage device of claim 19, wherein the regular expression detects a format and type of content corresponding to a credit card number associated with a particular payment processing provider.