Correlating firewall and zero trust data to monitor remote and hybrid worker sessions

Patent metadata

Field	Value
Publication number	US-12580933-B2
Application number	US-202318175218-A
Country	US
Kind code	B2
Filing date	Feb 27, 2023
Priority date	Feb 27, 2023
Publication date	Mar 17, 2026
Grant date	Mar 17, 2026

Abstract

Security, access and the way organizations communicate with their employees, contractors and customers is evolving faster than ever, and as the world is becoming more hybrid, security policies, monitoring and control must become collaborative and interoperable. The techniques described herein provide meaningful correlation and analytics of data coming from multiple sources in the network, access, security and identity, thereby improving troubleshooting, optimizations, threat forensics and analysis, as well as enabling network administrators more control over network policies.

First claim

What is claimed is:

1 . A method comprising:
receiving, from a device, a request to initiate one or more sessions on behalf of a user of a network, the one or more sessions comprising a virtual private network (VPN) session or a zero-trust network access (ZTNA) session; collecting, based at least in part on the request, first data associated with the one or more sessions, the first data including one or more identifiers including one or more usernames; collecting second data associated with packets of the one or more sessions, the second data indicating network events associated with the packets occurring at different network hops over which the one or more sessions traverse; injecting a mapping value into a header of a packet of the packets of the one or more sessions; correlating, using the one or more identifiers, the first data with second data to generate a session map that represents the network events that occurred at the different network hops, wherein the first data is correlated with the second data using the mapping value; and performing, based at least in part on the session map and a policy associated with the user, an action associated with the one or more sessions.

2 . The method of claim 1 , further comprising injecting a respective digital identity of a session into one or more headers of the data packets of the one or more sessions.

3 . The method of claim 1 , wherein the second data comprises one or more of metadata associated with the one or more sessions, context data associated with the user, metadata associated with one or more previous sessions, a location of the device, an account of the user, or a time associated with each of the one or more sessions.

4 . The method of claim 1 , wherein the first data comprises metadata associated with the user or the one or more sessions.

5 . The method of claim 1 , wherein the action comprises one or more of alerting a network administrator, blocking a connection to one or more services, enabling access to one or more services, or updating one or more policies.

6 . A system comprising:
one or more processors; and one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving, from a device, a request to initiate one or more sessions on behalf of a user of a network, the one or more sessions comprising a virtual private network (VPN) session or a zero-trust network access (ZTNA) session;
collecting, based at least in part on the request, first data associated with the one or more sessions, the first data including one or more identifiers including one or more usernames;
collecting second data associated with packets of the one or more sessions, the second data indicating network events associated with the packets occurring at different network hops over which the one or more sessions traverse;
injecting a mapping value into a header of a packet of the packets of the one or more sessions;
correlating, using the one or more identifiers, the first data with second data to generate a session map that represents the network events that occurred at the different network hops, wherein the first data is correlated with the second data using the mapping value; and
performing, based at least in part on the session map and a policy associated with the user, an action associated with the one or more sessions.

7 . The system of claim 6 , wherein the one or more identifiers comprise one or more of a username, metadata, or an IP address.

8 . The system of claim 6 , wherein the second data comprises one or more of metadata associated with the one or more sessions, context data associated with the user, metadata associated with one or more previous sessions, a location of the device, an account of the user, or a time associated with each of the one or more sessions.

9 . The system of claim 6 , wherein the first data comprises metadata associated with the user or the one or more sessions.

10 . The system of claim 6 , wherein the action comprises one or more of alerting a network administrator, blocking a connection to one or more services, enabling access to one or more services, or updating one or more policies.

11 . The system of claim 6 , wherein the network event comprises identifying suspicious activity associated with the user.

12 . One or more non-transitory computer-readable media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving, from a device, a request to initiate one or more sessions on behalf of a user of a network, the one or more sessions comprising a virtual private network (VPN) session or a zero-trust network access (ZTNA) session; collecting, based at least in part on the request, first data associated with the one or more sessions, the first data including one or more identifiers including one or more usernames; collecting second data associated with packets of the one or more sessions, the second data indicating network events associated with the packets occurring at different network hops over which the one or more sessions traverse; injecting a mapping value into a header of a packet of the packets of the one or more sessions; correlating, using the one or more identifiers, the first data with second data to generate a session map that represents the network events that occurred at the different network hops, wherein the first data is correlated with the second data using the mapping value; and performing, based at least in part on the session map and a policy associated with the user, an action associated with the one or more sessions.

13 . The one or more non-transitory computer-readable media of claim 12 , further comprising injecting a respective digital identity of a session into one or more headers of the data packets of the one or more sessions.

14 . The one or more non-transitory computer-readable media of claim 12 , wherein the second data comprises one or more of metadata associated with the one or more sessions, context data associated with the user, metadata associated with one or more previous sessions, a location of the device, an account of the user, or a time associated with each of the one or more sessions.

15 . The one or more non-transitory computer-readable media of claim 12 , wherein the first data comprises metadata associated with the user or the one or more sessions.

16 . The one or more non-transitory computer-readable media of claim 12 , wherein the action comprises one or more of alerting a network administrator, blocking a connection to one or more services, enabling access to one or more services, or updating one or more policies.

Assignees

• Cisco Tech Inc

Inventors

• Levari Doron
• Parla Vincent E
• Farhan Tariq Ahmed
• Warrier Siddhu
• Perry Jason M

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title