SYSTEM AND METHOD FOR LIMITING DATA LEAKAGE

• US 20120324526A1
• Filed: 06/15/2011
• Published: 12/20/2012
• Est. Priority Date: 06/15/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Diehl, David, Minear, Spencer, Meyer, Paul
• Granted Patent: US 9,210,127 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

System and methods for connection processing with limited data leakage. The system records state associated with a connection request in a connection state engine, records state associated with a connection acknowledgement in the connection state engine, stores data sent after the connection acknowledgement in a buffer and determines, without a proxy, whether to allow or deny a connection as a function of the data stored in the buffer.

Claims

1. A system for applying a security policy to connections between a computer on a first network and a computer on a second network, comprising:

a buffer, wherein the buffer is sized to receive and buffer data associated with a connection request; and

a connection state engine connected to the buffer;

wherein the connection state engine receives a connection request from one of the computers for a connection to the other computer and records state associated with the connection request;

wherein the connection state engine receives an acknowledgement from the other computer and records state associated with the acknowledgement;

wherein the buffer receives data from one of the computers, wherein the data is associated with the connection request; and

wherein the connection state engine reads the data from the buffer and denies the connection based on an application of a security policy to the data without forwarding the data.

2. The system of claim 1, wherein the security policy is expressed as a hierarchical set of rules.

3. The system of claim 2, wherein the hierarchical set of rules include rules based on reputation information assigned dynamically to sites, senders and locations.

4. The system of claim 1, wherein the connection state engine is capable of identifying and controlling access to applications.

5. A system for applying a security policy to connections between a computer on a first network and a computer on a second network, comprising:

a buffer, wherein the buffer is sized to receive and buffer data associated with a connection request;

one or more proxies connected to the buffer; and

a connection state engine connected to the buffer and the proxies;

wherein the connection state engine receives a connection request from one of the computers for a connection to the other computer and records state associated with the connection request;

wherein the connection state engine receives an acknowledgement from the other computer and records state associated with the acknowledgement;

wherein the buffer receives data from one of the computers, wherein the data is associated with the connection request; and

wherein the connection state engine reads the data from the buffer, determines whether the connection should be promoted to one of the proxies based on an application of a security policy to the data; and

promotes the connection to a selected one of the proxies when it determines the connection should be promoted; and

wherein the selected proxy reads state associated with the connection request and the connection acknowledgement and establishes socket connections to the two computers as a function of the recorded state such that the connection changes into a proxy connection.

6. The system of claim 5, wherein the security policy is expressed as a hierarchical set of rules.

7. The system of claim 6, wherein the hierarchical set of rules include rules based on reputation information assigned dynamically to sites, senders and locations.

8. The system of claim 6, wherein the connections and rules are based on named sockets.

9. The system of claim 6, wherein the connection state engine is capable of identifying and controlling access to applications.

10. In a system for applying a security policy to connections between a computer on a first network and a computer on a second network, a method of determining whether to deny the connection, comprising:

receiving a connection request from the computer on the first network;

recording state associated with the connection request;

receiving a request acknowledgement from the computer on the second network;

recording state associated with the connection acknowledgement;

storing in a buffer data received from one of the computers after the request acknowledgement; and

determining, without a proxy and as a function of the data stored in the buffer, whether to deny the connection;

wherein, when the connection is denied, no data is forwarded to the other computer.

11. The method of claim 11, wherein determining includes determining to deny the connection if the connection request is for an HTTP message.

12. In a system for applying a security policy to connections between a computer on a first network and a computer on a second network, a method of determining whether to deny the connection, comprising:

receiving a connection request from the computer on the first network;

recording state associated with the connection request;

receiving a request acknowledgement from the computer on the second network;

recording state associated with the connection acknowledgement;

storing in a buffer data associated with the connection request, wherein the data is received from one of the computers after the request acknowledgement;

determining, as a function of the data stored in the buffer, whether to promote the message to a proxy;

receiving, at the proxy, information corresponding to the message; and

establishing socket connections to the two computers as a function of the recorded state such that the connection changes into a proxy connection.

13. The method of claim 12, wherein determining includes determining to promote the connection if the connection request is for an HTTP message and there is a named socket for HTTP messages.