Transparent Provisioning of Services Over a Network

• US 20090262741A1
• Filed: 06/29/2009
• Published: 10/22/2009
• Est. Priority Date: 06/23/2000
• Status: Active Grant

• Current Assignee: Lookingglass Cyber Solutions, LLC
• Original Assignee: CloudShield Technologies, Inc. (ZeroFox Holdings, Inc.)
• Inventors: Jungck, Peder J., Goller, Sean M., Drown, Matthew Donald
• Granted Patent: US 8,204,082 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/5054 Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 47/24 Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

An apparatus and method for enhancing the infrastructure of a network such as the Internet is disclosed. A packet interceptor/processor apparatus is coupled with the network so as to be able to intercept and process packets flowing over the network. Further, the apparatus provides external connectivity to other devices that wish to intercept packets as well. The apparatus applies one or more rules to the intercepted packets which execute one or more functions on a dynamically specified portion of the packet and take one or more actions with the packets. The apparatus is capable of analyzing any portion of the packet including the header and payload. Actions include releasing the packet unmodified, deleting the packet, modifying the packet, logging/storing information about the packet or forwarding the packet to an external device for subsequent processing. Further, the rules may be dynamically modified by the external devices.

Claims

1. A method of transparently provisioning first and second services to a network, the first service being provided by a first application service provider to the network via a first application and the second service being provided by a second application service provider to the network via a second application, the network carrying a plurality of packets each being transmitted by a source to at least one intended destination intended by the source, each of the plurality of packets comprising routing data operative to cause the forwarding of the packet via the network towards the at least one intended destination, the method comprising:

interfacing between the first application and an interface to the network;

interfacing between the second application and the interface to the network;

intercepting, via the interface, each of the plurality of packets prior to a forwarding thereof toward the at least one intended destination;

evaluating each intercepted packet based on a first specification of a first subset of the plurality of packets with respect to which the first application is to perform the first service and a second specification of a second subset of the plurality of packets with respect to which the second application is to perform the second service, wherein at least the first specification specifies the first subset based on criteria other than only the routing data contained in the intercepted packet; and

acting on the intercepted packet, based on the evaluating, to facilitate the performance of at least one of the first service, second service or a combination thereof with respect to the intercepted packet if the intercepted packet is included in at least one of the specified first subset, second subset, or combination thereof.

2. The method of claim 1 wherein the acting comprises at least one of providing at least a copy of at least a portion of the intercepted packet to at least one of the first and second applications, deleting the intercepted packet, modifying the intercepted packet, substituting a modified intercepted packet for the intercepted packet, substituting a new packet for the intercepted packet, allowing the intercepted packet to continue to the at least one intended destination, or combinations thereof.

3. The method of claim 1 wherein the acting further comprises:

providing the intercepted packet to the first application if the intercepted packet is one of the specified first subset to facilitate the performance of the first service with respect to the intercepted packet and generate a result based thereon; and

providing the intercepted packet to the second application if the intercepted packet is one of the specified second subset to facilitate the performance of the second service with respect to the intercepted packet and generate a result based thereon.

4. The method of claim 3 further comprising:

receiving the result of the performance of at least one of the first and second services on the intercepted packet from at least one of the first and second applications; and

wherein the result comprises at least one of an instruction to delete the intercepted packet, an instruction to modify the intercepted packet, an instruction to substitute a modified intercepted packet for the intercepted packet, an instruction to substitute a new packet for the intercepted packet, an instruction to allow the intercepted packet to continue to the at least one intended destination, an instruction to respond to the source, or combinations thereof, and further wherein

the acting further comprises executing the instruction.

5. The method of claim 1 wherein the first service is the same as the second service, the first subset being different than the second subset.

6. The method of claim 1 wherein the first subset is different from the second subset.

7. The method of claim 1 wherein the acting further comprises providing the intercepted packet only to the first application when the intercepted packet is one of the first subset and one of the second subset.

8. The method of claim 1 wherein the interfacing further comprises interfacing between the first and second applications and the interface to the network without modifying layer 2 or layer 3 protocols of the interface to the network.

9. The method of claim 1 wherein the first service comprises one of a firewall service, content control service, malicious content detection service, anti-denial-of-service service, intrusion detection service, or combinations thereof.

10. The method of claim 1 wherein at least one of the source, at least one intended destination, or a combination thereof, are unaware of the interfacing, intercepting, evaluating and acting.

11. The method of claim 1 wherein the first application service provider is unaware of the interfacing, intercepting, and evaluating.

12. The method of claim 1 further wherein the first application service provider is unaware of the interfacing, intercepting and evaluating.

13. A system for transparently provisioning first and second services to a network, the first service being provided by a first application service provider to the network via a first application and the second service being provided by a second application service provider to the network via a second application, the network carrying a plurality of packets each being transmitted by a source to at least one intended destination intended by the source, each of the plurality of packets comprising routing data operative to cause the forwarding of the packet via the network towards the at least one intended destination, the system comprising:

a packet processor coupled between the network and first and second applications and operative to intercept at least one of the plurality of packets prior to a forwarding thereof toward the at least one intended destination, evaluate the at least one intercepted packet based on a first specification of a first subset of the plurality of packets with respect to which the first application is to perform the first service and a second specification of a second subset of the plurality of packets with respect to which the second application is to perform the second service, and act on the intercepted packet to facilitate the performance of at least one of the first service, second service, or combination thereof with respect to the intercepted packet if the intercepted packet is included in at least one of the specified first subset, second subset, or combination thereof, wherein at least the first specification specifies the first subset based on criteria other than only the routing data contained in the intercepted packet.

14. The system of claim 13 wherein the act comprises at least one of provide at least a copy of at least a portion of the intercepted packet to at least one of the first and second applications, delete the intercepted packet, modify the intercepted packet, substitute a modified intercepted packet for the intercepted packet, substitute a new packet for the intercepted packet, allow the intercepted packet to continue to the at least one intended destination, or combinations thereof.

15. The system of claim 13 wherein the packet processor is further operative to provide the at least one intercepted packet to the first application if the intercepted packet is one of the specified first subset to facilitate the performance of the first service with respect to the intercepted packet and generate a result based thereon;

and provide the at least one intercepted packet to the second application if the intercepted packet is one of the specified second subset to facilitate the performance of the second service with respect to the intercepted packet and generate a result based thereon.

16. The system of claim 15 wherein the packet processor is further operative to receive the result of the performance of at least one of the first and second services on the intercepted packet from at least one of the first and second applications;

and, wherein the result comprises at least one of an instruction to delete the intercepted packet, an instruction to modify the intercepted packet, an instruction to substitute a modified intercepted packet for the intercepted packet, an instruction to substitute a new packet for the intercepted packet, an instruction to allow the intercepted packet to continue to the at least one intended destination, an instruction to respond to the source, or combinations thereof, the packet processor being further operative to execute the instruction.

17. The system of claim 13 wherein the first service is the same as the second service, the first subset being different than the second subset.

18. The system of claim 13 wherein the first subset is different from the second subset.

19. The system of claim 13 wherein the packet processor is further operative to provide the intercepted packet only to the first application when the intercepted packet is one of the first subset and one of the second subset.

20. The system of claim 13 wherein the packet processor is capable of interacting with the first and second applications with the network without modifying layer 2 or layer 3 protocols of the network.

21. The system of claim 13 wherein the first service comprises one of a firewall service, content control service, malicious content detection service, anti-denial-of-service service, intrusion detection service, or combinations thereof.

22. The system of claim 13 wherein at least one of the source, at least one intended destination, or a combination thereof, are unaware of the operations of the packet processor.

23. A system for transparently provisioning first and second services to a network, the first service being provided by a first application service provider to the network via a first application and the second service being provided by a second application service provider to the network via a second application, the network carrying a plurality of packets each being transmitted by a source to at least one intended destination intended by the source, each of the plurality of packets comprising routing data operative to cause the forwarding of the packet via the network towards the at least one intended destination, the method comprising:

means for interfacing between the first application and an interface to the network;

means for interfacing between the second application and the interface to the network;

means for intercepting, via the interface, each of the plurality of packets prior to a forwarding thereof toward the at least one intended destination;

means for evaluating each intercepted packet based on a first specification of a first subset of the plurality of packets with respect to which the first application is to perform the first service and a second specification of a second subset of the plurality of packets with respect to which the second application is to perform the second service, wherein at least the first specification specifies the first subset based on criteria other than only the routing data contained in the intercepted packet; and

means for acting on the intercepted packet, based on the evaluating, to facilitate the performance of at least one of the first service, second service, or combination thereof with respect to the intercepted packet if the intercepted packet is included in at least one of the specified first subset, second subset, or combination thereof.

24. A system for transparently provisioning first and second services to a network, the first service being provided by a first application service provider to the network via a first application and the second service being provided by a second application service provider to the network via a second application, the network carrying a plurality of packets each being transmitted by a source to at least one intended destination intended by the source, each of the plurality of packets comprising routing data operative to cause the forwarding of the packet via the network towards the at least one intended destination, the system comprising processor, a memory coupled with the processor, a network interface operative to couple the processor with the network, and an application interface operative to couple the processor with the first and second applications, the system further comprising:

first logic stored in the memory and executable by the processor cause the processor to intercept at least one of the plurality of packets prior to a forwarding thereof toward the at least one intended destination;

second logic, coupled with the first logic, stored in the memory and executable by the processor to cause the processor to evaluate the at least one intercepted packet based on a first specification of a first subset of the plurality of packets with respect to which the first application is to perform the first service and a second specification of a second subset of the plurality of packets with respect to which the second application is to perform the second service, wherein at least the first specification specifies the first subset based on criteria other than only the routing data contained in the intercepted packet; and

third logic, coupled with the second logic, stored in the memory and executable by the processor to cause the processor to act on the intercepted packet to facilitate the performance of at least one of the first service, second service, or combination thereof with respect to the intercepted packet if the intercepted packet is included in at least one of the specified first subset, second subset, or combination thereof.