Methods and systems for protecting a secured network

Patent metadata

Field	Value
Publication number	US-10951660-B2
Application number	US-202016909327-A
Country	US
Kind code	B2
Filing date	Jun 23, 2020
Priority date	Apr 16, 2014
Publication date	Mar 16, 2021
Grant date	Mar 16, 2021

Abstract

Methods and systems for protecting a secured network are presented. For example, one or more packet security gateways may be associated with a security policy management server. At each packet security gateway, a dynamic security policy may be received from the security policy management server, packets associated with a network protected by the packet security gateway may be received, and at least one of multiple packet transformation functions specified by the dynamic security policy may be performed on the packets.

First claim

What is claimed is:

1. A method of filtering packets at a packet security gateway that provides an interface across a boundary of a network protected by the packet security gateway and one or more networks other than the network protected by the packet security gateway, the method comprising:
receiving, by the packet security gateway and from a security policy management server located in the one or more networks other than the network protected by the packet security gateway, a dynamic security policy comprising a first set of packet filtering rules to be applied to all network traffic traversing the boundary via the packet security gateway, wherein one or more first packet filtering rules of the first set of packet filtering rules were automatically created by the security policy management server based on malicious traffic information received from one or more malicious host tracker services, and wherein each packet filtering rule of the first set of packet filtering rules comprises:
at least one packet matching criterion,
one or more corresponding packet transformation functions, and
metadata indicating at least one malicious host tracker service, of the one or more malicious host tracker services, corresponding to the respective packet filtering rule, wherein the metadata comprises an identification of a feed managed by the at least one malicious host tracker service that provides network addresses of malicious hosts;

configuring, based on the first set of packet filtering rules, the packet security gateway;
performing packet filtering on a first portion of packets associated with the network protected by the packet security gateway based on the first set of packet filtering rules by performing at least one of multiple packet transformation functions specified by one or more packet filtering rules of the first set of packet filtering rules on the first portion of packets, wherein the at least one of the multiple packet transformation functions specified by the one or more packet filtering rules of the first set of packet filtering rules corresponds to a packet digest logging function that supports a network communications awareness service and comprises generating a record comprising:
first data, from a packet, that matches first packet matching criterion of a packet filtering rule, wherein the packet filtering rule corresponds to the packet digest logging function; and
second data that comprises:
the first packet matching criterion,
the one or more corresponding packet transformation functions, and
the metadata indicating the at least one malicious host tracker service corresponding to the respective packet filtering rule,

wherein the network communications awareness service is provided based on one or more criteria that are indicative of packet communications that are of interest to an organization that operates the network;

reformatting, in accordance with a logging system standard, the record; and
forwarding, by the packet security gateway and to the network communications awareness service, the reformatted record.

2. The method of claim 1 , wherein the at least one packet matching criterion comprises one or more network addresses associated with malicious network traffic.

3. The method of claim 1 , wherein at least one of the one or more packet transformation functions comprises a network protective action.

4. The method of claim 1 , wherein the metadata indicates which of the malicious host tracker services provided first malicious traffic information used to automatically create the respective packet filtering rule.

5. The method of claim 1 , further comprising:
receiving, by the packet security gateway, packets in a network layer transparent manner using a second interface that is not addressed at the network layer; and
performing the at least one of the multiple packet transformation functions at the network layer.

6. A packet security gateway that provides an interface across a boundary of a network protected by the packet security gateway and one or more networks other than the network protected by the packet security gateway, the packet security gateway comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the packet security gateway to:
receive, from a security policy management server located in the one or more networks other than the network protected by the packet security gateway, a dynamic security policy comprising a first set of packet filtering rules to be applied to all network traffic traversing the boundary via the packet security gateway, wherein one or more first packet filtering rules of the first set of packet filtering rules were automatically created by the security policy management server based on malicious traffic information received from one or more malicious host tracker services, and wherein each packet filtering rule of the first set of packet filtering rules comprises:
at least one packet matching criterion,
one or more corresponding packet transformation functions, and
metadata indicating at least one malicious host tracker service, of the one or more malicious host tracker services, corresponding to the respective packet filtering rule, wherein the metadata comprises an identification of a feed managed by the at least one malicious host tracker service that provides network addresses of malicious hosts;

perform packet filtering on a first portion of packets associated with the network protected by the packet security gateway based on the first set of packet filtering rules by performing at least one of multiple packet transformation functions specified by one or more packet filtering rules of the first set of packet filtering rules on the first portion of packets, wherein the at least one of the multiple packet transformation functions specified by the one or more packet filtering rules of the first set of packet filtering rules corresponds to a packet digest logging function that supports a network communications awareness service and comprises generating a record comprising:
first data, from a packet, that matches first packet matching criterion of a packet filtering rule, wherein the packet filtering rule corresponds to the packet digest logging function; and
second data that comprises:
the first packet matching criterion,
the one or more corresponding packet transformation functions, and
the metadata indicating the at least one malicious host tracker service corresponding to the respective packet filtering rule,

wherein the network communications awareness service is provided based on one or more criteria that are indicative of packet communications that are of interest to an organization that operates the network;

reformat, in accordance with a logging system standard, the record; and
forward, to the network communications awareness service, the reformatted record.

7. The packet security gateway of claim 6 , wherein the at least one packet matching criterion comprises one or more network addresses associated with malicious network traffic.

8. The packet security gateway of claim 6 , wherein at least one of the one or more packet transformation functions comprises a network protective action.

9. The packet security gateway of claim 6 , wherein the metadata indicates which of the malicious host tracker services provided first malicious traffic information used to automatically create the respective packet filtering rule.

10. The packet security gateway of claim 6 , wherein the instructions, when executed by the one or more processors, further cause the packet security gateway to:
receive packets in a network layer transparent manner using a second interface tha

Assignees

• Centripetal Networks Inc

Inventors

• Rogers Steven
• Moore Sean
• Ahn David K
• Geremia Peter P

Classifications

• H04L65/1069

  Session establishment or de-establishment · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/168

  above the transport layer · CPC title