Dynamic access control policy with port restrictions for a network security appliance

Patent metadata

Field	Value
Publication number	US-9258329-B2
Application number	US-201314065097-A
Country	US
Kind code	B2
Filing date	Oct 28, 2013
Priority date	Oct 9, 2008
Publication date	Feb 9, 2016
Grant date	Feb 9, 2016

Abstract

A network security appliance supports definition of a security policy to control access to a network. The security policy is defined by match criteria including a layer seven network application, a static port list of layer four ports for a transport-layer protocol, and actions to be applied to packet flows that match the match criteria. A rules engine dynamically identifies a type of layer seven network application associated with the received packet flow based on inspection of application-layer data within payloads of packets of the packet flow without basing the identification solely on a layer four port specified by headers within the packets. The rules engine is configured to apply the security policy to determine whether the packet flow matches the static port lists specified by the match criteria. The network security appliance applies the actions specified by the security policy to the packet flow.

First claim

What is claimed is:

1. A network security device comprising:
an interface configured to receive a packet flow;
a control unit configured to receive a security policy to control access by the packet flow to a network, wherein the security policy includes:
(a) match criteria that include a static port list of one or more layer four ports for a transport-layer protocol and a type of layer seven application, and
(b) actions to be applied to packet flows that match the match criteria; and

a rules engine of the control unit configured to dynamically identify a type of layer seven application associated with the packet flow by inspecting application-layer data within payloads of packets of the packet flow and without basing the identification solely on a layer four port specified by headers within the packets,
wherein the rules engine is further configured to determine whether the dynamically identified type of layer seven application associated with the packet flow matches the type of layer seven application of the security policy,
wherein the rules engine is further configured to apply the security policy to determine whether the packet flow matches a layer four port in the static port list of the match criteria of the security policy, and
wherein the rules engine is further configured to, upon determining that the packet flow matches a layer four port of the static port list and upon determining the dynamically identified type of layer seven application associated with the packet flow matches the type of layer seven application of the security policy, applies the actions of the security policy to the packet flow.

2. The network security device of claim 1 , wherein the rules engine is further configured to dynamically identify the type of layer seven application associated with the packet flow by performing deep packet inspection and signature-based application identification.

3. The network security device of claim 2 , wherein the rules engine is further configured to dynamically identify the type of layer seven application using the layer four port specified by the headers within the packets to select a set of patterns to apply for the signature-based application identification.

4. The network security device of claim 1 , further comprising:
a flow analysis module configured to analyze packet headers of packets in the packet flow to identify the layer four ports for a transport layer protocol associated with the packet flow; and
a flow table, wherein the flow analysis module and the rules engine are further configured to modify the flow table to store the identified layer seven application associated with the packet flow and the layer four ports for the transport layer protocol associated with the packet flow.

5. The network security device of claim 1 , further comprising a management module that presents a user interface to receive configuration information that defines the security policy.

6. The network security device of claim 1 , wherein the match criteria further includes a network source, and further comprising:
a query module configured to identify a network source associated with a received packet flow by querying a domain controller with a source Internet Protocol (IP) address associated with the packet flow to obtain one of a user or a user role associated with the source IP address,
wherein the rules engine applies the actions of the security policy to the packet flow by applying the actions of the security policy to the packet flow upon determining the user or user role associated with the source IP address matches the network source defined by the security policy.

7. The network security device of claim 1 , wherein the match criteria of the security policy further includes a network destination, wherein the network destination is defined as one or more Internet Protocol (IP) addresses and an output zone that defines one or more output interfaces of the network security device.

8. The network security device of claim 1 , wherein the match criteria of the security policy further includes a network source defined by the security policy in terms of one of a user and a user role.

9. The network security device of claim 1 , wherein the match criteria of the security policy further includes a network destination, wherein the network destination is defined as one or more Internet Protocol (IP) addresses and an output zone that defines one or more output interfaces of the network security device.

10. The network security device of claim 1 , wherein the security policy defines the one or more layer four ports for the transport-layer protocol as a range of layer four ports.

11. The network security device of claim 1 , wherein the rules engine dynamically creates a new security policy that includes:
(a) match criteria that include a layer four port for the transport-layer protocol that is not one of the one or more layer four ports of the static port list of the match criteria of the security policy and that also include the type of layer seven application, and
(b) actions to be applied to packet flows that match the match criteria, wherein the actions allow access to the network by a matching packet flow within a defined time period on a different layer four port than any of the one or more layer four ports of the static port list of the match criteria of the security policy,
wherein the rules engine is further configured to, upon determining that the packet flow matches the layer four port of the new security policy, apply the actions of the new security policy to the packet flow.

12. The network security device of claim 1 , wherein the actions to be applied include logging one or more of: whether a matching packet flow was allowed or denied, the identity of the user that was allowed or denied, the type of layer seven application associated with the packet flow, a layer four port associated with the packet flow, and a timestamp indicating when a matching packet flow was detected.

13. A method comprising:
by a network security device configured to control access to a network, receiving a security policy that includes:
(a) match criteria that include a static port list of one or more layer four ports for a transport-layer protocol and a type of layer seven application, and
(b) actions to be applied to packet flows that match the match criteria;

by the network security device, receiving a packet flow;
by the network security device, dynamically identifying a type of layer seven application associated with the packet flow by inspecting application-layer data within payloads of packets of the packet flow and without basing the identification solely on a layer four port specified by headers within the packets;
by the network security device, determining whether the dynamically identified type of layer seven application associated with the packet flow matches the type of layer seven application of the security policy;
by the network security device, applying the security policy to determine whether the packet flow matches a layer four port in the static port list of the match criteria of the security policy; and
by the network security device and upon determining that the packet flow matches a layer four port of the static port list and upon determining the dynamically identified type of layer seven application associated with the packet flow matches the type of layer seven application of the security policy, applying the actions of the security policy to the packet flow.

14. The method of claim 13 , wherein dynamically identifying the type of layer seven application associated with the received packet flow by inspecting

Assignees

• Juniper Networks Inc

Inventors

• Narayanaswamy Krishna

Classifications

• H04L63/0263

  Rule management · CPC title

• H04L63/0245 Primary

  Filtering by information in the payload · CPC title

• H04L63/0254

  Stateful filtering · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title