Dynamic detection and application-based policy enforcement of proxy connections

Patent metadata

Field	Value
Publication number	US-9825909-B2
Application number	US-201514610637-A
Country	US
Kind code	B2
Filing date	Jan 30, 2015
Priority date	Jan 30, 2015
Publication date	Nov 21, 2017
Grant date	Nov 21, 2017

Abstract

The present disclosure discloses a method and a network device for performing dynamic detection and application-based policy enforcement of proxy connections in a network. Specifically, a network device receives, from a client device, a packet in a session. The network device then determines whether the packet is transmitted to a proxy. In response to determining that the packet is associated with a different application classification or web content category during the same session, the network device re-applies network firewall policies to determine whether to allow or deny transmission of the packet to the proxy.

First claim

What is claimed is:

1. A non-transitory computer readable medium comprising instructions which, when executed cause a network system to:
receive, from a client device, a packet in a session;
determine whether the packet is transmitted to a proxy;
in response to determining that the packet is transmitted to the proxy, determine whether the packet is associated with a new application classification or web content category different than an application classification or web content category that was previously determined during the same session; and
in response to determining that the packet is associated with the new application classification or web content category, apply a network firewall policy to determine whether to allow or deny transmission of the packet to the proxy.

2. The non-transitory computer readable medium of claim 1 , wherein the instructions when executed cause the network system to:
receive another packet destined to the proxy in the same session subsequent to receiving the packet from the client device;
filter the other packet based on a packet type; and
perform deep packet inspection and apply the network firewall policy on the other packet.

3. The non-transitory computer readable medium of claim 1 , wherein the packet is associated with the new application classification, and the instructions when executed cause the network system to apply the network firewall policy based on the new application classification.

4. The non-transitory computer readable medium of claim 3 , wherein the packet was previously associated with a different application classification.

5. The non-transitory computer readable medium of claim 3 , wherein the packet was previously associated with a web content category.

6. The non-transitory computer readable medium of claim 1 , wherein the packet is associated with the new web content category, and the instructions when executed cause the network system to apply the network firewall policy based on the new web content category.

7. The non-transitory computer readable medium of claim 2 , wherein the instructions when executed cause the network system to:
determine that the other packet is associated with a new uniform resource locator (URL) different from a URL of the packet received from the client device; and
determine whether the other packet is associated with the same web content category as the packet received from the client device.

8. The non-transitory computer readable medium of claim 7 , wherein the instructions when executed cause the network system to:
in response to the other packet being associated with the same web content category as the packet received from the client device, refrain from network policy enforcement on traffic associated with the new URL; and
in response to the other packet being associated with a different web content category as the packet received from the client device, perform network policy enforcement on the traffic associated with the new URL.

9. The non-transitory computer readable medium of claim 1 , wherein determining whether the packet is transmitted to the proxy comprises:
determining whether a request Uniform Resource Identifier (URI) field in a header of a Hypertext Transfer Protocol (HTTP) GET message includes an absolute URI;
in response to the request URI field including an absolute URI, determining that the packet is transmitted to the proxy; and
in response to the request URI field not including an absolute URI, determining that the packet is transmitted to a non-proxy destination.

10. The non-transitory computer readable medium of claim 1 , wherein determining whether the packet is transmitted to the proxy comprises:
determining whether an HTTP CONNECT message is received from the client device subsequent to establishing a Transmission Control Protocol (TCP) connection;
in response to the HTTP CONNECT message being received from the client device, determining that the packet is transmitted to the proxy; and
in response to the HTTP CONNECT message not being received from the client device, determining that the packet is transmitted to a non-proxy destination.

11. The non-transitory computer readable medium of claim 1 , wherein determining whether the packet is transmitted to the proxy comprises:
retrieving a time-to-live (TTL) value from a SYN ACK message received from a server; and
determining whether the retrieved TTL value is associated with the proxy.

12. The non-transitory computer readable medium of claim 1 , wherein determining whether the packet is transmitted to the proxy comprises:
retrieving destination Internet Protocol (IP) addresses from a set of packets;
determining whether the destination IP addresses are same in the set of packets;
in response to the destination IP addresses being same in the set of packets, determining that the packet is transmitted to the proxy; and
in response to the destination IP addresses being different in the set of packets, determining that the packet is transmitted to a non-proxy destination.

13. A system comprising:
a network interface to communicate over a network; and
a hardware processor to:
receive, from a client device, a packet in a session;
determine whether the packet is transmitted to a proxy;
in response to determining that the packet is transmitted to the proxy, determine whether the packet is associated with a new application classification or web content category different than an application classification or web content category that was previously determined during the same session; and
in response to determining that the packet is associated with the new application classification or web content category, apply a network firewall policy to determine whether to allow or deny transmission of the packet to the proxy.

14. The system of claim 13 , wherein the hardware processor is to:
receive another packet destined to the proxy in the same session subsequent to receiving the packet from the client device;
filter the other packet based on a packet type; and
perform deep packet inspection and apply the network firewall policy on the other packet.

15. The system of claim 13 , wherein the packet is associated with the new application classification, and the hardware processor is to apply the network firewall policy based on the new application classification.

16. The system of claim 13 , wherein the packet is associated with the new web content category, and the hardware processor is to apply the network firewall policy based on the new web content category.

17. The system of claim 14 , wherein the hardware processor is to:
determine that the other packet is associated with a new uniform resource locator (URL) different from a URL of the packet received from the client device;
determine whether the other packet is associated with the same web content category as the packet received from the client device;
in response to the other packet being associated with the same web content category as the packet received from the client device, refrain from network policy enforcement on traffic associated with the new URL; and
in response to the other packet being associated with a different web content category as the packet received from the client device, perform network policy enforcement on the traffic associated with the new URL.

18. The system of claim 13 , wherein determining whether the packet is transmitted to the proxy comprises:
determining whether a request Uniform Resource Identifier (URI) field in a header of a Hypertext Transfer Protocol (HTTP) GET m

Assignees

• Aruba Networks Inc

Inventors

• Ardeli Ramesh
• Marichetty Venkatesan

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/0254

  Stateful filtering · CPC title

• H04L63/0227 Primary

  Filtering policies (mail message filtering H04L51/212) · CPC title