Applying a Network Traffic Policy to an Application Session

• US 20160261642A1
• Filed: 05/17/2016
• Published: 09/08/2016
• Est. Priority Date: 10/17/2006
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Chen, Lee, Oshiba, Dennis, Chiong, John
• Granted Patent: US 9,954,899 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: H04L 2101/365 Application layer names, e.g. buddy names, unstructured names chosen by a user or home appliance name
• CPC Class Codes: H04L 45/308 Route determination based on user's profile, e.g. premium users
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 61/2596 Translation of addresses of the same type other than IP, e.g. translation from MAC to MAC addresses
• CPC Class Codes: H04L 61/50 Address allocation
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/1026 at the edge
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 69/22 : Parsing or analysis of headers
• CPC Class Codes: H04M 1/7243 : with interactive means for internal management of messages
• CPC Class Codes: H04W 12/082 : using revocation of authorisation
• CPC Class Codes: H04W 12/088 : using filters or firewalls
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/45 : using multiple identity modules
• CPC Class Codes: H04W 12/61 : Time-dependent
• CPC Class Codes: H04W 12/72 : Subscriber identity
• CPC Class Codes: H04W 12/76 : Group identity

Abstract

Embodiments of the present technology relate to a method for applying a security policy to an application session, comprising: determining, by a security gateway, a first user identity and a second user identity from a data packet for an application session; obtaining, by the security gateway, a security policy for the application session; and applying the security policy to the application session by the security gateway. The user identity may be a network user identity or an application user identity recognized from packets of the application session. The security policy may comprise a network traffic policy mapped and/or a document access policy mapped to the user identity, where the network traffic policy is applied to the application session. The security gateway may further generate a security report concerning the application of the security policy to the application session.

Claims

1. A method for applying a security policy to an application session, comprising:

determining, by a security gateway, a first user identity and a second user identity from a data packet for an application session;

obtaining, by the security gateway, a security policy for the application session based on the first user identity or the second user identity; and

applying the security policy to the application session by the security gateway.

2. The method of claim 1, wherein the determining a first user identity and a second user identity comprises:

inspecting, by the security gateway, the data packet for the application session and storing a host identity and an application session time in an application session record;

determining, by the security gateway, from the data packet for the application session a user identity and storing the user identity in the application session record;

determining, by the security gateway, a second user identity by matching an access session record of an access session accessed during the application session that comprises the second user identity, a second host identity, and an access session time, wherein the second host identity, and the access session time match the host identity and the application session time of the application session record; and

storing the second user identity in the application session record.

3. The method of claim 1, wherein the obtaining a security policy for the application session comprises:

querying, by the security gateway, a corporate directory comprising a plurality of security policies, the query including a user identity;

matching, by the corporate directory, the user identity of the query against the plurality of security policies to determine whether one of the plurality of security policies is applicable to the user identity of the query; and

in response to finding a match, sending, by the corporate directory, the security policy to the security gateway.

4. The method of claim 3, wherein the user identity of the query comprises at least one of the first user identity and the second user identity.

5. The method of claim 3, wherein the matching the user identity of the query against the plurality of security policies comprises:

mapping, by the security policy, network parameters of one of the plurality of security policies to the user identity of the query; and

determining whether there is a match between the user identity of the query and the user identity in the security policy.

6. The method of claim 1, wherein at least one of the plurality of security policies comprises a network traffic policy.

7. The method of claim 6, wherein the network traffic policy comprises one or more of the following:

packet modification control for the application session;

traffic shaping control;

application session access control indicating whether the user identity of the query is denied or allowed to continue to the application session; and

a bandwidth control.

8. The method of claim 7, wherein the packet modification control for the application session comprises one or more of the following:

performing network address translation to the application session;

performing port address translation to the application session using a pre-determined port number;

performing content substitution, if the application session is an Hypertext Transfer Protocol (HTTP) session and if a Universal Resource Locator (URL) in data packets of the application session matches a predetermined URL;

performing filename substitution, if the application session is a file transfer session and if a filename matching a pre-determined filename is found in data packets of the application session; and

inserting a cookie for the user of the user identity, if the application session is an HTTP session.

9. The method of claim 1, further comprising generating a security report concerning the application of the security policy to the application session.

10. A system, comprising:

a corporate directory comprising a plurality of security policies; and

a security gateway, wherein the security gateway;

determines a first user identity and a second user identity from a data packet for an application session;

obtains a security policy for the application session, the security policy based on the first user identity or the second user identity; and

applies the security policy to the application session.

11. The system of claim 10, wherein the determines a first user identity and a second user identity comprises:

inspecting the data packet for the application session and storing a host identity and an application session time in an application session record;

determining from the data packet for the application session a user identity and storing the user identity in the application session record;

determining a second user identity by matching an access session record of an access session accessed during the application session that comprises the second user identity, a second host identity, and an access session time, wherein the second host identity, and the access session time match the host identity and the application session time of the application session record; and

storing the second user identity in the application session record.

12. The system of claim 10, wherein the obtains a security policy for the application session comprises:

querying, by the security gateway, the corporate directory, the query including a user identity;

matching, by the corporate directory, the user identity of the query against the plurality of security policies to determine whether one of the plurality of security policies is applicable to the user identity of the query; and

in response to finding a match, sending, by the corporate directory, the security policy to the security gateway.

13. The system of claim 12, wherein the user identity of the query comprises at least one of the first user identity and the second user identity.

14. The system of claim 12, wherein the matching the user identity of the query against the plurality of security policies comprises:

mapping, by one of the plurality of security policies, network parameters of the security policy to the user identity of the query; and

determining whether there is a match between the user identity of the query and the user identity in the security policy.

15. The system of claim 10, wherein at least one of the plurality of security policies comprises a network traffic policy.

16. The system of claim 15, wherein the network traffic policy comprises one or more of the following:

packet modification control for the application session;

traffic shaping control;

application session access control indicating whether the user identity of the query is denied or allowed to continue to the application session; and

a bandwidth control.

17. The system of claim 16, wherein the packet modification control for the application session comprises one or more of the following:

performing network address translation to the application session;

performing port address translation to the application session using a pre-determined port number;

performing content substitution, if the application session is an Hypertext Transfer Protocol (HTTP) session and if a Universal Resource Locator (URL) in data packets of the application session matches a predetermined URL;

performing filename substitution, if the application session is a file transfer session and if a filename matching a pre-determined filename is found in data packets of the application session; and

inserting a cookie for the user of the user identity, if the application session is an HTTP session.

18. The system of claim 10, wherein the security gateway further generates a security report concerning the application of the security policy to the application session.

19. A non-transitory computer readable storage medium having computer readable program code embodied therewith for routing data packets of an application session, the computer readable program code configured to:

determine, by a security gateway, a first user identity and a second user identity from a data packet for an application session;

obtain, by the security gateway, a security policy for the application session based on the first user identity or the second user identity; and

apply the security policy to the application session by the security gateway.

20. The medium of claim 19, wherein the determine a first user identity and a second user identity comprises:

inspecting, by the security gateway, the data packet for the application session and storing a host identity and an application session time in an application session record;

determining, by the security gateway, from the data packet for the application session a user identity and storing the user identity in the application session record;

determining, by the security gateway, a second user identity by matching an access session record of an access session accessed during the application session that comprises the second user identity, a second host identity, and an access session time, wherein the second host identity, and the access session time match the host identity and the application session time of the application session record; and

storing the second user identity in the application session record.