SYSTEM AND METHOD FOR INTERLOCKING A HOST AND A GATEWAY

• US 20120216271A1
• Filed: 02/23/2011
• Published: 08/23/2012
• Est. Priority Date: 02/23/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Cooper, Geoffrey Howard, Venugopalan, Ramnath, Diehl, David Frederick, Mahadik, Vinay A.
• Granted Patent: US 9,112,830 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Abstract

A method is provided in one example embodiment and includes exchanging a session descriptor associated with a network connection and an application on a host, correlating the session descriptor with a network policy, and applying the network policy to the network connection. In alternative embodiments, the session descriptor may be exchanged through an out-of-band communication channel or an in-band communication channel.

Claims

1. A method, comprising:

exchanging a session descriptor between a host and a network gateway, wherein the session descriptor is associated with a network connection and an application on the host;

correlating the session descriptor with a network policy; and

applying the network policy to the network connection.

2. The method of claim 1, wherein the session descriptor is exchanged through an out-of-band communication channel.

3. The method of claim 1, wherein the session descriptor is exchanged through an in-band communication channel.

4. The method of claim 1, wherein the session descriptor is stegonographically embedded in an in-band communication channel.

5. The method of claim 1, wherein the network policy is applied to restrict communication over the network connection based on an identification of the application in the session descriptor.

6. The method of claim 1, wherein the network policy is applied to rate-limit communication over the network connection based on an identification of the application in the session descriptor.

7. The method of claim 1, wherein the network policy is applied to restrict protocols that may be used by the application.

8. The method of claim 1, wherein the network policy is associated with a whitelist that restricts protocols that may be used by the application.

9. The method of claim 1, further comprising alerting a user of the network policy if communication through the network connection is restricted.

10. The method of claim 1, wherein the session descriptor includes a universally unique identifier associated with the host.

11. The method of claim 1, wherein the host communicates through a network address translator and the session descriptor includes a universally unique identifier associated with the host.

12. The method of claim 1, wherein the session descriptor comprises information about a user executing the application and a filename associated with the application.

13. The method of claim 1, wherein the session descriptor identifies a user executing the application and network policy is applied based on the user.

14. Logic encoded in one or more tangible media that includes code for execution and when executed by one or more processors is operable to perform operations comprising:

exchanging a session descriptor between a host and a network gateway, wherein the session descriptor is associated with a network connection and an application on the host;

correlating the session descriptor with a network policy; and

applying the network policy to the network connection.

15. The logic of claim 14, wherein the session descriptor is exchanged through an out-of-band communication channel.

16. The logic of claim 14, wherein the session descriptor is exchanged through an in-band communication channel.

17. The logic of claim 14, wherein the session descriptor is stegonographically embedded in an in-band communication channel.

18. The logic of claim 14, wherein the network policy is applied to restrict communication over the network connection based on an identification of the application in the session descriptor.

19. The logic of claim 14, wherein the network policy is applied to rate-limit communication over the network connection based on an identification of the application in the session descriptor.

20. The logic of claim 14, wherein the network policy is applied to restrict protocols that may be used by the application.

21. The logic of claim 14, wherein the network policy is associated with a whitelist that restricts protocols that may be used by the application.

22. The logic of claim 14, further comprising alerting a user of the network policy if communication through the network connection is restricted.

23. The logic of claim 14, wherein the session descriptor includes a universally unique identifier associated with the host.

24. The logic of claim 14, wherein the host communicates through a network address translator and the session descriptor includes a universally unique identifier associated with the host.

25. The logic of claim 14, wherein the session descriptor comprises information about a user executing the application and a filename associated with the application.

26. The logic of claim 14, wherein the session descriptor identifies a user executing the application and network policy is applied based on the user.

27. An apparatus, comprising:

a firewall module;

one or more processors operable to execute instructions associated with the firewall module, the one or more processors being operable to perform operations comprising;

exchanging a session descriptor with a host, wherein the session descriptor is associated with a network connection and an application on the host;

correlating the session descriptor with a network policy; and

applying the network policy to the network connection.

28. The apparatus of claim 27, wherein the session descriptor is exchanged through an out-of-band communication channel.

29. The apparatus of claim 27, wherein the session descriptor is exchanged through an in-band communication channel.

30. The apparatus of claim 27, wherein the session descriptor is stegonographically embedded in an in-band communication channel.

31. The apparatus of claim 27, wherein the network policy is applied to restrict communication over the network connection based on an identification of the application in the session descriptor.

32. The apparatus of claim 27, wherein the network policy is applied to rate-limit communication over the network connection based on an identification of the application in the session descriptor.

33. The apparatus of claim 27, wherein the network policy is applied to restrict protocols that may be used by the application.

34. The apparatus of claim 27, wherein the network policy is associated with a whitelist that restricts protocols that may be used by the application.

35. The apparatus of claim 27, further comprising alerting a user of the network policy if communication through the network connection is restricted.

36. The apparatus of claim 27, wherein the session descriptor includes a universally unique identifier associated with the host.

37. The apparatus of claim 27, wherein the host communicates through a network address translator and the session descriptor includes a universally unique identifier associated with the host.

38. The apparatus of claim 27, wherein the session descriptor comprises information about a user executing the application and a filename associated with the application.

39. The apparatus of claim 27, wherein the session descriptor identifies a user executing the application and network policy is applied based on the user.

40. The apparatus of claim 27, wherein more than one network address is associated with the host, the session descriptor comprises information about a user associated with one of the network addresses, and network policy is applied based on the user.

41. The apparatus of claim 27, wherein the session descriptor identifies a user executing the application and includes a hash of an executable file associated with the application.

42. The apparatus of claim 27, wherein the session descriptor comprises information about the configuration and state of software installed on the host.

43. The apparatus of claim 27, wherein the session descriptor identifies network addresses associated with the host and network policy is applied based on the network addresses.

44. A method, comprising:

applying network policy to restrict communication through a network connection; and

sending an alert to a user notifying the user of the network policy that restricted communication.