Secure data flow open information analytics

• US 9,787,581 B2
• Filed: 09/21/2015
• Issued: 10/10/2017
• Est. Priority Date: 09/21/2015
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Dosovitsky, Gennady
• Primary Examiner(s): Javaid, Jamal
• Application Number:
  US14/860,601
• Publication Number:
  US 20170085440A1
• Time in Patent Office: 750 Days
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 45/38 Flow based routing
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Provided are methods and systems for processing a secure data flow. An example method for processing a secure data flow includes receiving a data packet, determining network conditions associated with the data traffic, and determining that the data packet is associated with the secure data flow. Upon determination that the data packet is associated with the secure data flow, the data packet is analyzed. Thereafter, the method proceeds to classify the secure data flow based on the analysis. Subscriber data associated with the data packet may be obtained. The method can then process the secure data flow based on the subscriber data and the classification of the secure data flow.

Claims

1. A system for processing a secure data flow, the system comprising:

a servicing node comprising at least one processor, wherein the servicing node is operable to;

receive a data packet;

determine that the data packet is associated with the secure data flow;

obtain subscriber data associated with the data packet; and

relay the unsecure data to a network controller for behavioral analysis; and

an analyzing unit comprising at least one processor, wherein the analyzing unit is operable to;

analyze the data packet, wherein the analyzing of the data packet includes analyzing unsecure data associated with the data packet;

based on the analysis, classify the secure data flow; and

process the secure data flow based on the subscriber data and based on the classification of the secure data flow.

2. The system of claim 1, wherein obtaining of the subscriber data includes:

obtaining host data associated with the data packet; and

matching the host data to a subscriber in a database.

3. The system of claim 2, wherein the host data includes at least one of the following:

a session start indication, a session end indication, a host Internet Protocol (IP) address, and a subscriber identifier (ID).

4. The system of claim 1, wherein the determining that the data packet is associated with the secure data flow includes determining that a payload associated with the data packet is encrypted.

5. The system of claim 1, wherein the unsecure data includes at least one of the following:

a Media Access Control (MAC) address, a source network (IP/port) address prior to network address translation (NAT), a source network (IP/port) address after the NAT, a destination network address (DNA), a data packet size, a flow direction, a data packet sequence, an interpacket gap, a certificate, a security key, and a secure sockets layer (SSL) certificate common name.

6. The system of claim 1, wherein the subscriber data is acquired during a subscriber discovery process.

7. A method for processing a secure data flow, the method comprising:

receiving, by a servicing node, a data packet;

determining that the data packet is associated with the secure data flow;

analyzing the data packet;

based on the analyzing, classifying the secure data flow;

obtaining subscriber data associated with the data packet; and

processing the secure data flow based on the subscriber data and based on the classification of the secure data flow, wherein the processing of the secure data flow includes one or more of the following;

providing a security policy associated with the secure data flow to a further servicing node and providing a relay policy associated with the secure data flow to the further servicing node.

8. The method of claim 7, wherein obtaining of the subscriber data includes:

obtaining host data associated with the data packet; and

matching the host data to a subscriber in a database.

9. The method of claim 8, wherein the host data includes at least one of the following:

a session start indication, a session end indication, a host IP address, and a subscriber ID.

10. The method of claim 7, wherein the determining that the data packet is associated with the secure data flow includes determining that a payload associated with the data packet is encrypted.

11. The method of claim 7, wherein analyzing of the data packet includes analyzing of unsecure data associated with the data packet.

12. The method of claim 11, further comprising relaying the unsecure data to a network controller for behavioral analysis.

13. The method of claim 11, wherein the unsecure data includes at least one of the following:

a MAC address, a source network (IP/port) address prior to NAT, a source network (IP/port) address after the NAT, a DNA, a data packet size, a flow direction, a data packet sequence, an interpacket gap, a certificate, a security key, and an SSL certificate common name.

14. The method of claim 7, wherein classifying the secure data flow associated with the data packet is further based on third-party data.

15. The method of claim 7, wherein the subscriber data is acquired during a subscriber discovery process.

16. The method of claim 7, wherein the analyzing of the data packet is based on Domain Name System data and Dynamic Host Configuration Protocol data.

17. A system for processing a secure data flow, the system comprising:

a servicing node comprising at least one processor, wherein the servicing node is operable to;

receive a data packet;

determine that the data packet is associated with the secure data flow, wherein the determining that the data packet is associated with the secure data flow includes determining that a payload associated with the data packet is encrypted;

obtain subscriber data associated with the data packet, wherein the obtaining of the subscriber data includes;

obtaining host data associated with the data packet; and

matching the host data to a subscriber in a database; and

relay unsecure data to a network controller for behavioral analysis; and

an analyzing unit comprising at least one processor, wherein the analyzing unit is operable to;

analyze the data packet, wherein the analyzing of the data packet includes analyzing of the unsecure data associated with the data packet;

based on the analyzing, classify the secure data flow; and

process the secure data flow based on the subscriber data and based on the classifying of the secure data flow.

18. The system of claim 17, wherein the host data includes at least one of the following:

a session start indication, a session end indication, a host Internet Protocol (IP) address, and a subscriber identifier (ID).

19. The system of claim 17, wherein the unsecure data includes at least one of the following:

a Media Access Control (MAC) address, a source network (IP/port) address prior to network address translation (NAT), a source network (IP/port) address after the NAT, a destination network address (DNA), a data packet size, a flow direction, a data packet sequence, an interpacket gap, a certificate, a security key, and a secure sockets layer (SSL) certificate common name.

20. The system of claim 17, wherein the subscriber data is acquired during a subscriber discovery process.