CONTEXT SHARING BETWEEN ENDPOINT DEVICE AND NETWORK SECURITY DEVICE USING IN-BAND COMMUNICATIONS

• US 20170104722A1
• Filed: 10/07/2015
• Published: 04/13/2017
• Est. Priority Date: 10/07/2015
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Kleopa, Constantinos, Gautam, Venkatesh N., Selvam, Gerald N.A., Parla, Vincent E., Shankar, Hari
• Granted Patent: US 10,027,627 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A network security device (NSD) is connected between a network and an endpoint device configured to host a client application. The client application communicates with the network through the network security device using a request-response protocol. The NSD receives from the client application a request destined for the network and that seeks a response from the network. The request has a context header including context information about the client application. The NSD determines whether the client application or a file accessed thereby has a suspicious nature based on the context information. If it is determined that the client application or the file accessed thereby has a suspicious nature, the NSD blocks the request from the network, and sends to the client application a response indicating the block.

Claims

1. A method comprising:

at a network security device connected between a network and an endpoint device that is configured to host a client application, the client application configured to communicate with the network through the network security device using a request-response protocol;

receiving from the client application a request that is destined for the network and that seeks a response from the network, the request having a context header including context information about the client application;

determining whether the client application or a file accessed by the client application has a suspicious nature based on the context information; and

if it is determined that the client application or the file accessed by the client application has the suspicious nature;

blocking the request from the network; and

sending to the client application a response indicating the blocking.

2. The method of claim 1, further comprising, if it is determined that the client application or the file accessed by the client application does not have the suspicious nature, forwarding the request without the context header to the network.

3. The method of claim 1, wherein if it is determined that the client application or the file accessed by the client application has the suspicious nature, the sending includes sending the response with a context header therein, the context header in the response including a query for further information about the client application or the file accessed by the client application that is useable to confirm the suspicious nature of the client application or the file accessed by the client application.

4. The method of claim 3, further comprising, at the network security device:

receiving from the endpoint device a second request including a context header that includes the further information;

confirming the suspicious nature of the client application or the file accessed thereby based on the further information; and

if the suspicious nature is confirmed, sending to the endpoint device a second response having a context header that includes a request to perform remediation with respect to the client application or the file accessed by the client application.

5. The method of claim 4, wherein:

the context information in the context header of the request includes a hash value of the client application or the file accessed by the client application, and the determining includes determining the suspicious nature based on the hash value;

the query in the context header of the response includes a query for operating system registry information of the client application; and

the further information in the context header of the second request includes the operating system registry information, and the confirming includes confirming the suspicious nature based on the operating system registry information.

6. The method of claim 4, wherein the context header in the request and the context header in the response each includes a same request identifier.

7. The method of claim 4, wherein:

the request-response protocol includes the Hypertext Transfer Protocol (HTTP);

the request and the second request include HTTP requests; and

the response and the second response include HTTP responses.

8. An apparatus comprising:

a network interface unit including network ports to connect with a network and an endpoint device that is configured to host a client application, the client application configured to communicate with the network through the apparatus using a request-response protocol; and

a processor coupled to the network interface and configured to;

receive from the client application a request that is destined for the network and that seeks a response from the network, the request having a context header including context information about the client application;

determine whether the client application or a file accessed by the client application has a suspicious nature based on the context information; and

if it is determined that the client application or the file accessed by the client application has the suspicious nature;

block the request from the network; and

send to the client application a response indicating the blocking.

9. The apparatus of claim 8, wherein the processor is further configured to, if it is determined that the client application or the file accessed by the client application does not have the suspicious nature, forward the request without the context header to the network.

10. The apparatus of claim 8, wherein the processor is further configured to, if it is determined that the client application or the file accessed by the client application has the suspicious nature, send by sending the response with a context header therein, the context header in the response including a query for further information about the client application or the file accessed by the client application that is useable to confirm the suspicious nature of the client application or the file accessed by the client application.

11. The apparatus of claim 10, wherein the processor is further configured to:

receive from the endpoint device a second request including a context header that includes the further information;

confirm the suspicious nature of the client application or the file accessed thereby based on the further information; and

if the suspicious nature is confirmed, send to the endpoint device a second response having a context header that includes a request to perform remediation with respect to the client application or the file accessed by the client application.

12. The apparatus of claim 11, wherein:

the context information in the context header of the request includes a hash value of the client application or the file accessed by the client application, and the processor is configured to determine by determining the suspicious nature based on the hash value;

the query in the context header of the response includes a query for operating system registry information of the client application; and

the further information in the context header of the second request includes the operating system registry information, and the processor is configured to confirm by confirming the suspicious nature based on the operating system registry information.

13. The apparatus of claim 11, wherein:

the context header in the request and the context header in the response each includes a same request identifier.

14. A method comprising:

at a context agent hosted on an endpoint device that is connected with a network security device, the network security device connected with a network, the endpoint point device configured to host a client application configured to communicate with the network through the endpoint context agent and the network security device, using a request-response protocol;

receiving from the client application a request destined for the network that seeks a response from the network;

collecting context information about the client application;

adding to the request a context header that includes the collected context information;

sending to the network security device the request with the context header; and

receiving from the network security device a response indicating whether the request has been blocked from the network.

15. The method of claim 14, wherein the receiving the response includes receiving the response with a context header added thereto by the network security device, the context header having a query therein for further context information about the client application

16. The method of claim 15, further comprising, at the context agent:

removing the context header from the response and sending the response without the context header to the client application.

17. The method of claim 16, further comprising, at the context agent:

responsive to the query for the further context information, collecting the further context information about the client application;

adding the further context information about the client application to a context header of a second request;

sending to the network security device the second request with the context header including the further context information therein; and

receiving from the network security device a second response that is responsive to the second request.

18. The method of claim 16, wherein the second response includes a context header having a command to initiate remediation on the endpoint device with respect to the client application, the method further comprising:

responsive to the command to initiate remediation, initiating the remediation on the endpoint device with respect to the client application.

19. The method of claim 16, wherein:

the request-response protocol includes the Hypertext Transfer Protocol (HTTP);

the request and the second request include HTTP requests; and

the response and the second response include HTTP responses.

20. The method of claim 16, wherein:

the context header in the request and the context header in the response each includes a same request identifier.

21. The method of claim 16, wherein;

the collecting the context information includes collecting a hash value of the client application or a file accessed thereby, and the adding includes adding the collected hash value to the context header of the request; and

the collecting the further context information includes collecting operating system registry information related to the client application, and the adding the further context information includes adding the operating system registry information to the context header of the second request.

22. The method of claim 16, further comprising, at the context agent:

receiving the second request without any context header therein from the client application,

wherein the adding the further context information includes adding the further context information to the second request received from the client application.

23. The method of claim 16, further comprising, at the context agent:

originating the second request as a mock request that does not originate at the client application,

wherein the adding includes adding the collected further context information to the context header of the mock request originated at the context agent.