Applying security policy to an application session

• US 9,497,201 B2
• Filed: 01/04/2016
• Issued: 11/15/2016
• Est. Priority Date: 10/17/2006
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Chen, Lee, Oshiba, Dennis, Chiong, John
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): LAVELLE, GARY E
• Application Number:
  US14/987,076
• Publication Number:
  US 20160119382A1
• Time in Patent Office: 316 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 65/1026 : at the edge
• CPC Class Codes: H04L 67/01 : Protocols
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1004 : Server selection for load balancing
• CPC Class Codes: H04L 67/104 : Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 69/28 : Timers or timing mechanisms used in protocols
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04M 1/7243 : with interactive means for internal management of messages
• CPC Class Codes: H04W 12/084 : using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/61 : Time-dependent

Abstract

Applying a security policy to an application session, includes: recognizing the application session between a network and an application via a security gateway; determining by the security gateway a user identity of the application session using information about the application session; obtaining by the security gateway the security policy comprising network parameters mapped to the user identity; and applying the security policy to the application session by the security gateway. The user identity may be a network user identity or an application user identity recognized from packets of the application session. The security policy may comprise a network traffic policy mapped and/or a document access policy mapped to the user identity, where the network traffic policy is applied to the application session. The security gateway may further generate a security report concerning the application of the security policy to the application session.

Claims

1. A method for applying a security policy to an application session, comprising:

inspecting, by a security gateway, a data packet for an application session and storing a host identity and application session time in an application session record;

determining, by the security gateway, from the data packet for the application session a user identity and storing the user identity in the application session record;

determining, by the security gateway, a second user identity by matching an access session record of an access session accessed during the application session that comprises the second user identity, a second host identity, and an access session time, wherein the second host identity and the access session time match the host identity and the application session time of the application session record;

storing the second user identity as a network user identity in the application session record;

determining, by the security gateway, at least one security policy applicable to the application session based on a group identity; and

applying the at least one security policy to the application session, by the security gateway, if the network user identity is a member of the group identity.

2. The method of claim 1, wherein the determining, by the security gateway, at least one security policy applicable to the application session further comprises determining that the at least one security policy is applicable for a time period.

3. The method of claim 1, wherein the at least one security policy comprises a network traffic policy.

4. The method of claim 3, wherein the network traffic policy comprises a bandwidth rate capacity for a network.

5. The method of claim 3, wherein the network traffic policy comprises a quality of service mapped to the network user identity for the application session.

6. The method of claim 3, wherein the network traffic policy comprises one or more of:

a queuing delay, a queuing priority, a packet forwarding path, a link interface preference, a server load balancing preference, and a packet routing policy.

7. The method of claim 3, wherein the network traffic policy comprises a traffic shaping control.

8. The method of claim 7, wherein the traffic shaping control comprises a TCP profile.

9. The method of claim 3, wherein the network traffic policy comprises an application session modification control based on the network user identity.

10. A computer program product for applying a security policy to an application session, the computer program product comprising:

a non-transitory computer readable storage medium having computer readable program code embodied thereon, the computer readable program code configured to;

inspect, by a security gateway, a data packet for an application session and storing a host identity and application session time in an application session record;

determine, by the security gateway, from the data packet for the application session a user identity and store the user identity in the application session record;

determine, by the security gateway, a second user identity by matching an access session record of an access session accessed during the application session that comprises the second user identity, a second host identity, and an access session time, wherein the second host identity and the access session time match the host identity and the application session time of the application session record;

store the second user identity as a network user identity in the application session record;

determine, by the security gateway, at least one security policy applicable to the application session based on a group identity; and

apply the at least one security policy to the application session, by the security gateway, if the network user identity is a member of the group identity.

11. The computer program product of claim 10, wherein the computer readable program code configured to determine, by the security gateway, at least one security policy applicable to the application session is further configured to determine that the at least one security policy is applicable for a time period.

12. The computer program product of claim 10, wherein the at least one security policy comprises a network traffic policy.

13. The computer program product of claim 12, wherein the network traffic policy comprises a bandwidth rate capacity for a network.

14. The computer program product of claim 12, wherein the network traffic policy comprises a quality of service mapped to the network user identity for the application session.

15. The computer program product of claim 12, wherein the network traffic policy comprises one or more of:

a queuing delay, a queuing priority, a packet forwarding path, a link interface preference, a server load balancing preference, and a packet routing policy.

16. The computer program product of claim 12, wherein the network traffic policy comprises a traffic shaping control.

17. The computer program product of claim 16, wherein the traffic shaping control comprises a TCP profile.

18. The computer program product of claim 12, wherein the network traffic policy comprises an application session modification control based on the network user identity.

19. A system, comprising:

a corporate directory comprising at least one security policy; and

a security gateway, wherein the security gateway;

inspects a data packet for an application session and stores a host identity and application session time in an application session record;

determines from the data packet for the application session a user identity and stores the user identity in the application session record;

determines a second user identity by matching an access session record of an access session accessed during the application session that comprises the second user identity, a second host identity, and an access session time, wherein the second host identity and the access session time match the host identity and the application session time of the application session record;

stores the second user identity as a network user identity in the application session record;

determines at least one security policy applicable to the application session based on a group identity; and

applies the at least one security policy to the application session if the network user identity is a member of the group identity.

20. The system of claim 19, wherein the determines at least one security policy applicable to the application session further comprises determines that the at least one security policy is applicable for a time period.

21. The system of claim 19, wherein the at least one security policy comprises a network traffic policy.

22. The system of claim 21, wherein the network traffic policy comprises a bandwidth rate capacity for a network.

23. The system of claim 21, wherein the network traffic policy comprises a quality of service mapped to the network user identity for the application session.

24. The system of claim 21, wherein the network traffic policy comprises one or more of:

a queuing delay, a queuing priority, a packet forwarding path, a link interface preference, a server load balancing preference, and a packet routing policy.

25. The system of claim 21, wherein the network traffic policy comprises a traffic shaping control.

26. The system of claim 25, wherein the traffic shaping control comprises a TCP profile.

27. The system of claim 21, wherein the network traffic policy comprises an application session modification control based on the network user identity.