Distributed application awareness

Patent metadata

Field	Value
Publication number	US-9774633-B2
Application number	US-201615014611-A
Country	US
Kind code	B2
Filing date	Feb 3, 2016
Priority date	Sep 28, 2012
Publication date	Sep 26, 2017
Grant date	Sep 26, 2017

Abstract

A network device is configured to receive network traffic associated with an application executing on a user device; identify, based on the network traffic, an application identifier associated with the application; determine whether the application identifier matches one of a set of application identifiers stored by the network device; identify a policy based on the application identifier when the application identifier matches one of the set of application identifiers; and apply the policy to the network traffic associated with the application. The policy may be obtained from another network device, in communication with the network device, when the application identifier does not match one of the set of application identifiers.

First claim

What is claimed:

1. A security device, comprising:
a memory to store a first plurality of application identifiers; and
one or more processors to:
provide a second plurality of application identifiers to an edge device, of a plurality of edge devices, in a network,
the first plurality of application identifiers including one or more application identifiers that are not included in the second plurality of application identifiers and are not included in a third plurality of application identifiers stored by another edge device of the plurality of edge devices,
the edge device communicating with the security device,
the edge device being provided at an edge of the network between the security device and a user device attempting to access the network via the edge device;

receive information associated with network traffic generated by an application executing on the user device,
the network traffic being received from the user device and via the edge device,
the information associated with the network traffic being provided to the security device when an application identifier, associated with the network traffic, does not match one of the second plurality of application identifiers;

determine, based on the information associated with the network traffic, the application identifier associated with the network traffic,
the application identifier identifying the application;

determine whether the application identifier matches one of the first plurality of application identifiers stored in the memory;
identify a policy associated with the one of the first plurality of application identifiers when the application identifier matches the one of the first plurality of application identifiers; and
provide the policy to the edge device to permit the edge device to apply the policy to the network traffic.

2. The security device of claim 1 , where the policy indicates one or more of:
whether the application is allowed or denied access to the network,
whether the application is to receive a priority relative to other applications,
an amount of bandwidth that the application is to receive,
a quality of service that the application is to receive, or
whether the application is permitted to use a resource of the network.

3. The security device of claim 1 , where the one or more processors are further to:
determine a frequency of occurrence of a first application; and
selectively identify the frequency of occurrence of the first application based on a threshold,
the frequency of occurrence of the first application being identified as frequently occurring when the threshold is satisfied; and
the frequency of occurrence of the first application being identified as infrequently occurring when the threshold is not satisfied.

4. The security device of claim 1 , where the one or more processors are further to:
identify another policy, associated with another one of the first plurality of application identifiers; and
provide the other policy to one or more other edge devices of the plurality of edge devices.

5. The security device of claim 1 , where the one or more processors are further to:
receive first information associated with a first application,
the first application being associated with the first plurality of application identifiers;

determine, based on the first information, a frequency of occurrence of the first application; and
identify the first application as frequently occurring or infrequently occurring based on the frequency of occurrence of the first application.

6. The security device of claim 5 , where the one or more processors are further to:
create a policy record for the first application based on identifying the first application as frequently occurring; and
provide the policy record to the edge device of the plurality of edge devices.

7. The security device of claim 1 , where the one or more processors are further to:
receive a flow identifier from the edge device; and
identify the policy based on the flow identifier and the application identifier.

8. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the one or more processors to:
store first information associated with a first plurality of applications;
provide second information, associated with a second plurality of applications, to an edge device, of a plurality of edge devices, in a network,
the first information including one or more application identifiers that are not included in the second information and are not included in third information, associated with a third plurality of application, stored by another edge device of the plurality of edge devices,
the edge device communicating with the device,
the edge device being provided at an edge of the network between the device and a user device attempting to access the network via the edge device;

receive information associated with network traffic generated by an application executing on the user device,
the network traffic being received from the user device and via the edge device,
the information associated with the network traffic being provided to the device when an application identifier, associated with the network traffic, is not included in the second information;

determine, based on the information associated with the network traffic, the application identifier associated with the network traffic,
the application identifier identifying the application;

determine that the application identifier is included in the first information;
identify a policy to be applied to the application identified by the application identifier; and
provide the policy to the edge device to permit the edge device to apply the policy to the network traffic.

9. The non-transitory computer-readable medium of claim 8 , where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
generate a first policy data structure;
store the first policy data structure;
generate a second policy data structure; and
provide the second policy data structure to the edge device.

10. The non-transitory computer-readable medium of claim 8 , where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
determine a frequency of use of the application;
generate a policy data structure associated with the application; and
provide the policy data structure to the edge device based on the frequency of use of the application.

11. The non-transitory computer-readable medium of claim 8 , where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
determine a frequency of use of the application;
generate a policy data structure associated with the application; and
store the policy data structure based on the frequency of use of the application.

12. The non-transitory computer-readable medium of claim 8 , where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
receive flow information from the edge device,
the flow information indicating a source of the network traffic and a destination of the network traffic; and

identify the policy based on the flow information.

13. The non-transitory computer-readable medium of claim 8 , where:
the first information includes a first plurality of application identifiers, and
the second information includes a second plurality of application identifiers,
the firs

Assignees

• Juniper Networks Inc

Inventors

• Knappe Michael E
• Tomasello Joe
• Narayanaswamy Krishna
• Waterman Alexander S

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0236 Primary

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title