Methods and apparatus for trusted application centric QoS provisioning

• US 7,774,498 B1
• Filed: 11/06/2006
• Issued: 08/10/2010
• Est. Priority Date: 11/06/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: McCowan, David James, Gladstone, Philip J. S., Kraemer, Jeffrey A., Lynn, Kerry E.
• Primary Examiner(s): Donaghue; Larry
• Assistant Examiner(s): Gillis; Brian J
• Application Number:
  US11/593,289
• Time in Patent Office: 1,373 Days
• Field of Search: 709/223, 709/224, 709/227, 709/232, 709/240, 726/13
• US Class Current: 709/240
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A security agent extends the trust barrier, or trust point, from network gateway nodes to end user devices. A security agent operable to scrutinize network traffic executes on the user device and compares QoS marking attempts with the established QoS marking policy in effect. The security agent examines network traffic attributes deterministic of connection attempts by user processes. Attempts to apply inappropriate or disallowed QoS markings, as dictated by the QoS marking policy, are detected and disallowed. Therefore, only user connections consistent with the QoS marking policy are permitted into the network. Network admission control (NAC) mechanisms ensure that the security agent is the only access point from the user device to the secure network, and the security agent communicates the establishment of the trusted access point to the network gateway, thus ensuring that the network gateway may trust service level designations emanating from the user device executing the security agent.

Claims

1. A method of identifying prioritized network traffic comprising:

establishing a trusted environment operable to scrutinize network traffic sent via a particular node;

communicating the establishment of the trusted environment to a data communications device coupled to a communications network;

establishing a connection operable to transport network traffic to the communications network on behalf of a particular application; and

selectively identifying network traffic corresponding to the particular application;

setting a service level designator in each packet of the network traffic that is sent via the particular node;

wherein the particular node is responsive to a service level in the service level designator for determining traffic priority;

selectively enabling recognition of the service level designator in predetermined attributes of packets sent via the particular node;

wherein the method is performed by one or more processors.

2. The method of claim 1 wherein the network traffic further comprises packets, each of the packets having the service level designator indicative of prioritized transport treatment according to the service level.

3. The method of claim 2 wherein establishing the trusted environment occurs on a user device, further comprising executing a security agent on the user device, the security agent operable for:

identifying connections corresponding to user applications on the user device;

scrutinizing all connections between the user device and the data communications device, the data communications device further comprising a network gateway operable to recognize and enforce the service level designator; and

marking the service level designator in packets transported over the identified connections with corresponding service level markings according to a marking policy having predetermined values for setting the service level designator.

4. The method of claim 3 wherein establishing the trusted environment further comprises:

executing the security agent on the user device, the security agent operable to scrutinize network traffic emanating from the user device, and further operable to modify the service level designator; and

establishing a trusted connection from the security agent to the network gateway, the network gateway operable to enforce the service level designation throughout the communications network.

5. The method of claim 4 further comprising determining the service level according to a quality of service (QoS) marking policy for packets corresponding to the particular application, wherein the communications network is operable to apply the QoS appropriate treatment to message packets based on the determined service level.

6. The method of claim 5 further comprising encapsulating packets according to a stack, the stack indicative of control field mapping between an end user format and a physical network format operable to transport a message payload between the communications network and a user application operable to process a payload.

7. The method of claim 6 wherein computing the service level designator further comprises:

identifying transport attributes below the stack, indicative of packet characteristics specific to physical transport protocols independent of the user application and user originating the packets; and

identifying transport attributes above the stack, indicative of packet characteristics independent of transport source, destination, and protocol employed for the message packet.

8. The method of claim 7 wherein the predetermined attributes above a stack are indicative of a particular user and application corresponding to a particular connection, and the predetermined attributes below the stack are indicative of a protocol, port and addresses corresponding to the particular connection.

9. The method of claim 2 further comprising extending a trust boundary indicative of an extent of a trusted network from the particular node to a user device, the user device operable for quality of service (QoS) operation responsive to the service level designator.

10. The method of claim 9 further comprising:

asserting, from the user device, that a security agent on the user device is operable to scrutinize packets emanating from the user device;

receiving, at a network gateway device, the assertion; and

identifying, for each connection from the user device, the service level indicative of settings operable to be stored in the service level designator.

11. The method of claim 10 wherein the service level designators define QoS markings, further comprising overriding QoS markings placed by a user application, the QoS markings replaced with markings corresponding to a security policy, the security policy based on at least one of source, destination, application, protocol, and port corresponding to the particular application.

12. The method of claim 9 wherein extending the trust boundary is performed by:

informing a network gateway of establishment of a secure environment in the user device, the network gateway defining an edge device of the trusted network;

maintaining, in response to establishment of the trusted environment, service level markings in packets emanating from the user device.

13. A data communications device for identifying prioritized network traffic comprising:

one or more processors;

a network node device operable to couple to an edge device for establishing a trusted environment operable to scrutinize network traffic sent via a particular network node;

a security agent operable to communicate the establishment of the trusted environment to a data communications device coupled to a communications network, the security agent further adapted to establish a connection operable to transport network traffic to the communications network on behalf of a particular application; and

a packet mapper in the security agent operable to selectively identifying network traffic corresponding to the particular application;

setting a service level designator in each packet of the network traffic that is sent via a particular node;

wherein the particular node is responsive to a service level in the service level designator for determining traffic priority;

selectively enabling recognition of the service level designator in predetermined attributes of packets sent via the particular node.

14. The device of claim 13 wherein the network traffic further comprises a stream of packets, each of the packets having the service level designator indicative of prioritized transport treatment according to a service level.

15. The device of claim 14 wherein the security agent is further operable to:

identify connections corresponding to user applications on a user device;

scrutinize all connections between the user device and the data communications device, the data communications device further comprising a network gateway operable to recognize and enforce the service level designator;

mark the service level designator in packets transported over the identified connections with corresponding service level markings according to a marking policy having predetermined values for setting a service level designator.

16. The device of claim 15 wherein the user device is further operable to establish the trusted environment by:

executing the security agent on the user device, the security agent operable to scrutinize network traffic emanating from the user device, and further operable to modify the service level designator, the security agent further operable to establish a trusted connection from the security agent to a network gateway, the network gateway operable to enforce the service level designation throughout the communications network.

17. The device of claim 16 further comprising a rule engine responsive to a quality of service (QoS) marking policy, the security agent operable to determine the service level according to the quality of service (QoS) marking policy for packets corresponding to the particular application, wherein the communications network is operable to apply the QoS appropriate treatment to message packets based on the determined service level.

18. The device of claim 17 wherein the user application is operable to encapsulate packets according to a stack, the stack indicative of control field mapping between an end user format and a physical network format operable to transport a message payload between the physical network and a user application operable to process a payload, the security agent operable to:

identify transport attributes below the stack, indicative of packet characteristics specific to physical transport protocols independent of the user application and user originating the packets; and

identify transport attributes above the stack, indicative of packet characteristics independent of transport source, destination, and protocol employed for the message packet.

19. The device of claim 14 further wherein the user device further comprises a trust boundary indicative of an extent of a trusted the particular node to the user device, the user device operable for quality of service (QoS) operation responsive to the service level designator.

20. The device of claim 19 wherein the security agent is operable to:

assert, from the user device, that the security agent on the user device is operable to scrutinize packets emanating from the user device, the assertion receivable at a network gateway device; and

identify, for each connection from the user device, the service level indicative of a service level settings operable to be stored in the service level designator.

21. The device of claim 20 wherein the service level designators define QoS markings, the security agent further operable to override QoS markings placed by a user application, the QoS markings replaced with markings corresponding to a security policy, the security policy based on at least one of source, destination, application, protocol, and port corresponding to the particular application.

22. A method of marking prioritized network traffic comprising:

establishing a trusted environment operable to scrutinize network traffic sent via a particular node;

communicating the establishment of the trusted environment to a data communications device coupled to a communications network;

establishing a connection operable to transport network traffic to the communications network on behalf of a particular application; and

setting a service level designator in each packet of the network traffic that is sent via the particular node;

wherein the particular node is responsive to a service level in the service level designator for determining traffic priority;

selectively enabling recognition of the service level designator in predetermined attributes of packets sent via the particular node;

selectively identifying network traffic corresponding to the particular application;

executing a security agent in the trusted environment for;

identifying connections corresponding to user applications on a user device;

scrutinizing all connections between the user device and the data communications device, the data communications device further comprising a network gateway operable to recognize and enforce the service level designator; and

marking the service level designator in packets transported over the identified connections with corresponding service level markings according to a marking policy having predetermined values for setting the service level designator;

wherein the method is performed by one or more processors.

23. A computer program product having a computer readable medium operable to store computer program logic embodied in computer program code encoded thereon as an encoded set of processor based instructions, comprising:

computer program code for establishing a trusted environment operable to scrutinize network traffic sent via a particular node;

computer program code for executing a security agent on a user device, the security agent operable to scrutinize network traffic emanating from the user device, and further operable to modify the service level designator;

computer program code for communicating the establishment of the trusted environment to a data communications device coupled to a communications network;

computer program code for setting a service level designator in each packet of the network traffic that is sent via the particular node;

wherein the particular node is responsive to a service level in the service level designator for determining traffic priority;

computer program code for selectively enabling recognition of the service level designator in predetermined attributes of packets sent via the particular node;

computer program code for establishing a trusted connection from the security agent to a network gateway, the network gateway operable to enforce the service level designation throughout the secure network, the trusted connection operable to transport the network traffic to the communications network on behalf of a particular application;

computer program code for selectively identifying the network traffic corresponding to the particular application.

24. A data communications device responsive to encoded processor based instructions for identifying prioritized network traffic comprising:

one or more processors;

means for establishing a trusted environment operable to scrutinize network traffic sent via a particular node;

means for communicating the establishment of the trusted environment to a data communications device coupled to a communications network;

means for establishing a connection operable to transport network traffic to the communications network on behalf of a particular application; and

means for setting a service level designator in each packet of the network traffic that is sent via the particular node;

wherein the particular node is responsive to a service level in the service level designator for determining traffic priority;

means for selectively enabling recognition of the service level designator in predetermined attributes of packets sent via the particular node;

means for selectively identifying network traffic corresponding to the particular application;

the means for establishing the trusted environment including means for executing a security agent on a user device, the security agent further comprising;

means for identifying connections corresponding to user applications on the user device;

means for scrutinizing all connections between the user device and the data communications device, the data communications device further comprising a network gateway operable to recognize and enforce the service level designator; and

means for marking the service level designator in packets transported over the identified connections with corresponding service level markings according to a marking policy having predetermined values for setting a service level design.