Method for providing authoritative application-based routing and an improved application firewall

Patent metadata

Field	Value
Publication number	US-10027626-B2
Application number	US-201615156646-A
Country	US
Kind code	B2
Filing date	May 17, 2016
Priority date	Sep 30, 2013
Publication date	Jul 17, 2018
Grant date	Jul 17, 2018

Abstract

A method for providing authoritative application-based routing and an improved application firewall, as well as a method for application classification, is described. The first embodiment, which provides a method for authoritative application-based routing, comprises tagging packets with an application identifier, and pushing the tagged packets to the network to enable the application identifier to be used in routing and priority decisions. In the second embodiment, a method for improving application firewall comprises using the application identifier to minimize the amount of processing required by the firewall when analyzing packet information.

First claim

What is claimed is:

1. A method of providing authoritative application-based routing, the method comprising the steps of:
generating, by a computing device configured with a network interface, a hash of one or more associated application information associated with an identity of an application executing on the computing device, wherein the application is configured to generate one or more packets, and wherein the one or more associated application information is selected from the group consisting of an application name, an application size, a file path associated with the application, an application run time information, one or more code sections associated with the application, an application source address and/or application destination IP address, one or more ports associated with the application, one or more protocols associated with the application, and a hash generated from an executable associated with the application;
transmitting, by the computing device, over the network interface, the hash of the one or more associated application information to a network-based policy engine, wherein the transmitted hash of the one or more associated application information is logged by the network-based policy engine into an application information log and is used to determine an application identifier;
receiving, by the computing device, over the network interface, the application identifier, wherein the application identifier has been verified by the network-based policy engine;
tagging, by the computing device, or a firewall device associated with the computing device, the application identifier, or an application policy value derived from the application identifier, onto all packets, or a substantial portion thereof, generated from the application prior to transmission to a network; and,
pushing the tagged packets to other devices in the network, wherein the application identifier of a given tagged packet of the tagged packet is used by the other devices to enforce one or more routing-based policies for the application.

2. The method of claim 1 , wherein the one or more routing-based policies include granting a given packet tagged with the application identifier or the application policy value access to a network trusted zone.

3. The method of claim 1 , wherein the one or more routing-based policies include restricting routing of a given packet tagged with the application identifier or the application policy value access to only Internet addresses.

4. The method of claim 1 , wherein the one or more routing-based policies include dropping a given packet tagged with the application identifier or the application policy value.

5. The method of claim 1 , wherein the one or more routing-based policies include routing a given packet tagged with the application identifier or the application policy value to a network device configured to perform deep packet inspection of the given packet.

6. The method of claim 1 , wherein the one or more routing-based policies include routing a given packet tagged with the application identifier or the application policy value to an inspection engine.

7. The method of claim 1 , wherein the application policy value comprises a QoS metric value.

8. The method of claim 1 , wherein one or more network devices in the network is configured to place a given packet tagged with a pre-defined application identifier or the application policy value in a different priority routing queue maintained by the one or more network devices.

9. The method of claim 1 , the application identifier is used in dynamic routing decision operations performed by a software-defined network.

10. The method of claim 1 , wherein the tagged packet comprises an ACK packet or SYN packet.

11. The method of claim 1 , wherein the application identifier or the application policy value is inserted in a http header portion of the tagged packet.

12. The method of claim 1 , wherein the application identifier or the application policy value is included at a position in the tagged packet associated with a MAC layer tag or an L2 security group tag.

13. The method of claim 1 , wherein the computing device comprises a virtual machine hypervisor, and wherein the associated application information is/are generated by the virtual machine hypervisor.

14. The method of claim 1 , wherein the application is a JAVA application.

15. The method of claim 1 , wherein the network-based policy engine is implemented in a cloud-based service.

16. The method of claim 1 , wherein the network-based policy engine is located in the firewall device associated with the computing device.

17. A system comprising:
a network interface;
one or more processors; and
a memory having instructions stored thereon, wherein execution of the instructions by the one or more processors cause the one or more processors to:
generate a hash of one or more associated application information associated with an identity of an application executing on the system, wherein the application is configured to generate one or more packets, and wherein the one or more associated application information is selected from the group consisting of an application name, an application size, a file path associated with the application, an application run time information, one or more code sections associated with the application, an application source address and/or application destination IP address, one or more ports associated with the application, and one or more protocols associated with the application;
transmit, over the network interface, the hash of the one or more associated application information to a network-based policy engine, wherein the transmitted hash of the one or more associated application information is logged by the network-based policy engine into an application information log and is used to determine an application identifier;
receive, over the network interface, the application identifier, wherein the application identifier has been verified by the network-based policy engine;
tag the application identifier, or an application policy value derived from the application identifier, onto all packets, or a substantial portion thereof, generated from the application prior to transmission to a network; and
push the tagged packets to other devices in the network, wherein the application identifier of a given tagged packet of the tagged packet is used by the other devices to enforce one or more routing-based policies for the application.

18. The system of claim 17 , wherein the instructions are executed by a virtual machine hypervisor operating on the system, and wherein the associated application information is generated by the virtual machine hypervisor.

19. A non-transitory computer readable medium having instructions stored thereon, wherein execution of the instructions by one or more processors of a computing device cause the one or more processors to:
generate a hash of one or more associated application information associated with an identity of an application executing on the computing device, wherein the application is used to generate one or more packets, and wherein the one or more associated application information is selected from the group consisting of an application name, an application size, a file path associated with the application, an application run time information, one or more code sections associated with the application, an application source address and/or application destination IP address, one or more ports associated with the application, and one or more protocols associated

Assignees

• Cisco Tech Inc

Inventors

• Short Todd
• Zawadowskiy Andrew
• Martin Antonio
• Parla Vincent E

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/0227 Primary

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/0245 Primary

  Filtering by information in the payload · CPC title

• H04L45/306

  Route determination based on the nature of the carried application · CPC title

• H04L45/566

  Routing instructions carried by the data packet, e.g. active networks · CPC title