Credentials enforcement using a firewall

• US 9,967,236 B1
• Filed: 07/31/2015
• Issued: 05/08/2018
• Est. Priority Date: 07/31/2015
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Ashley, Robert Earle, Lam, Ho Yu, Jin, Xuanyu, Deng, Suiqiang, Ettema, Taylor, Tesh, Robert
• Primary Examiner(s): Brown, Christopher
• Application Number:
  US14/815,331
• Time in Patent Office: 1,012 Days
• Field of Search: 726 1, 726 11
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques for credentials enforcement using a firewall are disclosed. In some embodiments, a system, process, and/or computer program product for enforcement using a firewall includes storing a plurality of user credentials at a network device; monitoring network traffic at the network device to determine if there is a match with one or more of the plurality of user credentials; and performing an action if the match is determined.

Claims

1. A system for credentials enforcement using a firewall, comprising:

a processor of a network device configured to;

store a plurality of user credentials at the network device;

monitor network traffic at the network device to determine if there is a match between the plurality of user credentials and one or more of the plurality of user credentials for external site authentication, comprising to;

monitor network communications between a client and an external site; and

determine if the client sends a request that includes user credentials for authentication at the external site, comprising to;

determine whether a bloom filter accepts the user credentials included in the request, wherein the bloom filter is generated based at least in part on the stored plurality of user credentials, the bloom filter being located in the network device, the bloom filter being configured to have a false positive rate set to a predetermined threshold, the predetermined threshold being non-zero, wherein the determining of whether the bloom filter accepts the user credentials comprises to;

 

determine whether a first hash of a first portion and a second portion of a first user credential of the user credentials included in the request corresponds to a second hash of a third portion and a fourth portion of a second user credential of the stored plurality of user credentials, the first portion and the second portion being non-overlapping and non-adjacent portions of the first user credential, the third portion and the fourth portion being non-overlapping and non-adjacent portions of the second user credential; and

 

in response to a determination that the first hash corresponds to the second hash, determine that the bloom filter accepts the user credentials included in the request; and

in response to a determination that the bloom filter accepts the user credentials included in the request;

 

send the user credentials included in the request to an enterprise data store to query the enterprise data store whether the user credentials included in the request are enterprise user credentials, the external site being separate from the enterprise data store, the enterprise data store being separate from the network device; and

 

receive, from the enterprise data store, query results indicating whether or not the user credentials match the enterprise user credentials; and

perform an action if the match between the plurality of user credentials and the one or more of the plurality of user credentials for external site authentication is determined, wherein the action corresponds to blocking the network traffic, generating an alert, sending a block page that notifies the user that using enterprise credentials on this external site is not recommended or is prohibited, logging network activity, or any combination thereof; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1, wherein one or more of the plurality of user credentials includes a password.

3. The system recited in claim 1, wherein one or more of the plurality of user credentials includes a username and a password.

4. The system recited in claim 1, wherein the plurality of user credentials is stored in a cache on the network device.

5. The system recited in claim 1, wherein the processor is further configured to:

receive the plurality of user credentials from an agent executed on an authentication server; and

store the plurality of user credentials in a cache on the network device.

6. The system recited in claim 1, wherein the processor is further configured to:

perform the action in response to determining that the client sent the request that includes user credentials for authentication at the external site that match one or more of the plurality of user credentials stored at the network device.

7. The system recited in claim 1, wherein the processor is further configured to:

monitor encrypted network communications between the client and the external site, wherein the encrypted network communications are encrypted using a first protocol.

8. The system recited in claim 1, wherein the processor is further configured to:

monitor encrypted network communications between the client and the external site, wherein the encrypted network communications are encrypted using a first protocol; and

perform the action in response to determining that the client sent the request that includes user credentials for authentication at the external site that match one or more of the plurality of user credentials stored at the network device.

9. The system recited in claim 1, wherein the processor is further configured to:

monitor encrypted network communications between the client and the external site, wherein the encrypted network communications are encrypted using a first protocol;

decrypt the monitored encrypted network communications between the client and the external site to determine if the client sends a request that includes user credentials for authentication at the external site; and

perform the action in response to determining that the client sent the request that includes user credentials for authentication at the external site that match one or more of the plurality of user credentials stored at the network device.

10. The system recited in claim 1, wherein the processor is further configured to:

intercept a request to establish an encrypted session from the client to the external site; and

send a request to establish the encrypted session on behalf of the client to the external site.

11. The system recited in claim 1, wherein the network device includes a firewall device, and wherein the processor is further configured to:

intercept a request to establish an encrypted session from the client to the external site;

send a request to establish the encrypted session on behalf of the client to the external site; and

send an encrypted session response to the client on behalf of the external site using a session key associated with the firewall device.

12. The system recited in claim 1, wherein the network device includes a firewall device, and wherein the processor is further configured to:

intercept a request to establish an encrypted session from the client to the external site;

send a request to establish the encrypted session on behalf of the client to the external site;

send an encrypted session response to the client on behalf of the external site using a session key associated with the firewall device; and

decrypt encrypted session traffic between the client and the external site to monitor for a request from the client to create a tunnel using a first protocol with the external site.

13. The system recited in claim 1, wherein the network device includes a firewall device, and wherein the processor is further configured to:

intercept a request to establish an encrypted session from the client to the external site;

send a request to establish the encrypted session on behalf of the client to the external site;

send an encrypted session response to the client on behalf of the external site using a session key associated with the firewall device;

decrypt encrypted session traffic between the client and the external site to monitor for a request from the client to create a tunnel using a first protocol with the external site;

allow the request to create the tunnel; and

monitor decrypted session traffic between the client and the external site over the tunnel based on a firewall policy for credentials enforcement used in the external site authentication.

14. The system recited in claim 1, wherein the network device includes a firewall device, and wherein the processor is further configured to:

intercept a request to establish an encrypted session from the client to the external site;

send a request to establish the encrypted session on behalf of the client to the external site;

send an encrypted session response to the client on behalf of the external site using a session key associated with the firewall device;

decrypt encrypted session traffic between the client and the external site to monitor for a request from the client to create a tunnel using a first protocol with the external site;

allow the request to create the tunnel;

monitor decrypted session traffic between the client and the external site over the tunnel based on one or more firewall policies; and

block the session traffic if a violation of a firewall policy is determined, wherein the firewall policy includes a policy for credentials enforcement used in the external site authentication.

15. The system recited in claim 1, wherein the network device includes a firewall device, and wherein the processor is further configured to:

intercept a request to establish an encrypted session from the client to the external site;

send a request to establish the encrypted session on behalf of the client to the external site;

send an encrypted session response to the client on behalf of the external site using a session key associated with the firewall device;

decrypt encrypted session traffic between the client and the external site to monitor for a request from the client to create a tunnel using a first protocol with the external site;

allow the request to create the tunnel;

monitor decrypted session traffic between the client and the external site over the tunnel based on one or more firewall policies; and

generate an alert if a violation of a firewall policy is determined, wherein the firewall policy includes a policy for credentials enforcement used in the external site authentication.

16. The system recited in claim 1, wherein the network device includes a firewall device, and wherein the processor is further configured to:

intercept a request to establish an encrypted session from the client to the external site;

send a request to establish the encrypted session on behalf of the client to the external site;

send an encrypted session response to the client on behalf of the external site using a session key associated with the firewall device;

decrypt encrypted session traffic between the client and the external site to monitor for a request from the client to create a tunnel using a first protocol with the external site;

allow the request to create the tunnel;

monitor decrypted session traffic between the client and the external site over the tunnel based on one or more firewall policies; and

block the client from accessing the external site if a violation of a firewall policy is determined, wherein the firewall policy includes a policy for credentials enforcement used in the external site authentication.

17. The system recited in claim 1, wherein the network device includes a firewall device, and wherein the processor is further configured to:

intercept a request to establish an encrypted session from the client to the external site;

send a request to establish the encrypted session on behalf of the client to the external site;

send an encrypted session response to the client on behalf of the external site using a session key associated with the firewall device;

decrypt encrypted session traffic between the client and the external site to monitor for a request from the client to create a tunnel using a first protocol with the external site;

allow the request to create the tunnel;

monitor decrypted session traffic between the client and the external site over the tunnel based on one or more firewall policies; and

send a message to the client if a violation of a firewall policy is determined, wherein the firewall policy includes a policy for credentials enforcement used in the external site authentication.

18. The system recited in claim 1, wherein the determining of if the client sends the request that includes user credentials for authentication at the external site comprises to:

in response to a determination that the bloom filter rejects the user credentials included in the request, omit sending the user credentials included in the request to the enterprise data store to query the enterprise data store.

19. The system recited in claim 1, wherein the sending of the user credentials included in the request to the enterprise data store to query the enterprise data store comprises to:

in response to a determination that the query of the enterprise data store fails, respond to the query by indicating that the match of the user credentials included in the request does not exist in the enterprise data store.

20. A method for credentials enforcement using a firewall, comprising:

storing a plurality of user credentials at a network device;

monitoring network traffic at the network device to determine if there is a match between the plurality of user credentials and one or more of the plurality of user credentials, comprising;

monitoring network communications between a client and an external site; and

determining if the client sends a request that includes user credentials for authentication at the external site, comprising;

determining whether a bloom filter accepts the user credentials included in the request, wherein the bloom filter is generated based at least in part on the stored plurality of user credentials, the bloom filter being located in the network device, the bloom filter being configured to have a false positive rate set to a predetermined threshold, the predetermined threshold being non-zero, wherein the determining of whether the bloom filter accepts the user credentials comprises;

determining whether a first hash of a first portion and a second portion of a first user credential of the user credentials included in the request corresponds to a second hash of a third portion and a fourth portion of a second user credential of the stored plurality of user credentials, the first portion and the second portion being non-overlapping and non-adjacent portions of the first user credential, the third portion and the fourth portion being non-overlapping and non-adjacent portions of the second user credential; and

in response to a determination that the first hash corresponds to the second hash, determining that the bloom filter accepts the user credentials included in the request; and

in response to a determination that the bloom filter accepts the user credentials included in the request;

sending the user credentials included in the request to an enterprise data store to query the enterprise data store whether the user credentials included in the request are enterprise user credentials, the external site being separate from the enterprise data store, the enterprise data store being separate from the network device; and

receiving, from the enterprise data store, query results indicating whether or not the user credentials match the enterprise user credentials; and

performing an action if the match between the plurality of user credentials and the one or more of the plurality of user credentials for external site authentication is determined, wherein the action corresponds to blocking the network traffic, generating an alert, sending a block page that notifies the user that using enterprise credentials on this external site is not recommended or is prohibited, logging network activity, or any combination thereof.

21. A computer program product for credentials enforcement using a firewall, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

storing a plurality of user credentials at a network device;

monitoring network traffic at the network device to determine if there is a match between the plurality of user credentials and one or more of the plurality of user credentials, comprising;

monitoring network communications between a client and an external site; and

determining if the client sends a request that includes user credentials for authentication at the external site, comprising;

determining whether a bloom filter accepts the user credentials included in the request, wherein the bloom filter is generated based at least in part on the stored plurality of user credentials, the bloom filter being located in the network device, the bloom filter being configured to have a false positive rate set to a predetermined threshold, the predetermined threshold being non-zero, wherein the determining of whether the bloom filter accepts the user credentials comprises;

determining whether a first hash of a first portion and a second portion of a first user credential of the user credentials included in the request corresponds to a second hash of a third portion and a fourth portion of a second user credential of the stored plurality of user credentials, the first portion and the second portion being non-overlapping and non-adjacent portions of the first user credential, the third portion and the fourth portion being non-overlapping and non-adjacent portions of the second user credential; and

in response to a determination that the first hash corresponds to the second hash, determining that the bloom filter accepts the user credentials included in the request; and

in response to a determination that the bloom filter accepts the user credentials included in the request;

sending the user credentials included in the request to an enterprise data store to query the enterprise data store whether the user credentials included in the request are enterprise user credentials, the external site being separate from the enterprise data store, the enterprise data store being separate from the network device; and

receiving, from the enterprise data store, query results indicating whether or not the user credentials match the enterprise user credentials; and

performing an action if the match between the plurality of user credentials and the one or more of the plurality of user credentials for external site authentication is determined, wherein the action corresponds to blocking the network traffic, generating an alert, sending a block page that notifies the user that using enterprise credentials on this external site is not recommended or is prohibited, logging network activity, or any combination thereof.