Mobile device-based intrusion prevention system

Patent metadata

Field	Value
Publication number	US-9954873-B2
Application number	US-201514871758-A
Country	US
Kind code	B2
Filing date	Sep 30, 2015
Priority date	Sep 30, 2015
Publication date	Apr 24, 2018
Grant date	Apr 24, 2018

Abstract

A method for managing network traffic at a portable electronic device connected to a network that includes establishing a virtual network interface to queue network traffic originated by applications running on the device, monitoring the virtual network interface for queued data, assembling a data packet from the queued data, wherein at least some data in the data packet is intended for a node of the network, applying a first set of rules to the data packet, in accordance with a determination that application of the first set of rules triggers a predetermined response associated with the first set of rules, processing the data packet according to the predetermined response, and in accordance with a determination that application of the first set of rules does not trigger the predetermined response, forwarding at least a portion of the data packet to a connection with the node for transmission to the node.

First claim

What is claimed as new and desired to be protected by Letters Patent of the United States is:

1. A method for managing network traffic comprising:
at a portable electronic device connected to a network:
restricting at least one application running in restricted user space on the device from operating on data packets until the data packets pass up through a communication stack to an application layer of the communication stack;
calling, by a monitoring application running in the restricted user space, a virtual private network function to establish a virtual network interface, wherein calling the virtual private network function includes passing a null route table and an internal network address;
in response to the call of the virtual private network function, establishing, by a kernel process, the virtual network interface configured with the null route table and internal IP address, wherein the virtual network interface is configured to queue network traffic originated by one or more of the applications running in restricted user space on the device;
monitoring, by the monitoring application running in restricted user space, the virtual network interface for queued data originated by the one or more of the applications running in restricted user space on the device;
assembling, by the monitoring application, a data packet from at least some of the queued data, wherein the data packet includes data intended for a node of the one or more nodes of the network;
applying, by the monitoring application, a first set of rules to the data packet;
in accordance with a determination that application of the first set of rules to the data packet triggers a predetermined response associated with the first set of rules, processing, by the monitoring application, the data packet according to the predetermined response associated with the first set of rules; and
in accordance with a determination that application of the first set of rules does not trigger the predetermined response, forwarding, by the monitoring application, at least the data intended for the node to a connection with the node for transmission to the node.

2. The method of claim 1 comprising:
monitoring the connection with the node of the one or more nodes of the network for inbound data received by the device from the node;
assembling an inbound data packet associated with a destination application running on the device from at least some of the received inbound data;
applying a second set of rules to the inbound data packet;
in accordance with a determination that application of the second set of rules to the inbound data packet triggers a predetermined response associated with the second set of rules, processing the data packet according to the predetermined response associated with the second set of rules; and
in accordance with a determination that application of the second set of rules to the inbound data packet does not trigger a predetermined response associated with the second set of rules, forwarding the inbound data packet to the virtual network interface for retrieval by the destination application.

3. The method of claim 2 , wherein forwarding the inbound data packet to the virtual network interface for retrieval by the destination application comprises adding headers to the inbound data packet and forwarding the inbound data packet with the headers to the virtual network interface.

4. The method of claim 1 , wherein assembling the data packet includes assembling at least a header portion and a payload portion, the method further comprising:
prior to forwarding the at least the data intended for the node to the connection with the node for transmission to the node, establishing the connection with the node using at least some information from the header portion,
wherein the at least the data intended for the node is forwarded without the header portion.

5. The method of claim 4 , wherein the established connection bypasses the virtual network interface.

6. The method of claim 4 , wherein the data packet is originated by an application of the one or more applications, the method further comprising:
maintaining an association between the established connection and the application;
receiving data from the node through the established connection; and
forwarding the data to the application based on the association between the established connection and the application.

7. The method of claim 6 , wherein a header for the received data is generated based on the association between the established connection and the application and the header is forwarded with the data.

8. The method of claim 1 , wherein the method is performed with non-privileged control of the device.

9. The method of claim 1 comprising:
determining that the data packet does not contain sufficient data to apply a rule of the one or more rules;
in response to determining that the data packet does not contain sufficient data to apply the rule of the one or more rules, storing at least a portion of the data packet in a buffer;
in response to detecting a second data packet at the virtual network interface, applying the rule of the one or more rules to a combination of at least a portion of the second data packet and the at least a portion of the data packet stored in the buffer to determine whether the rule applies to the combination;
in accordance with a determination that application of the rule to the combination triggers a predetermined response associate with the rule, processing the at least a portion of the data packet according to the predetermined response associated with the rule; and
in accordance with a determination that application of the rule to the combination does not trigger the predetermined response, forwarding the at least a portion of the data packet stored in the buffer and the at least a portion of the second data packet to the connection with the node for transmission to the node.

10. The method of claim 1 , wherein the one or applications comprises a plurality of applications.

11. The method of claim 1 , wherein the one or more applications include at least one of an email application, a web browser, and a game application.

12. A portable electronic device for managing network traffic comprising:
one or more processors,
memory, and
one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs comprising instructions for:
restricting at least one application running in restricted user space on the device from operating on data packets until the data packets pass up through a communication stack to an application layer of the communication stack;
calling, by a monitoring application running in the restricted user space, a virtual private network function to establish a virtual network interface, wherein calling the virtual private network function includes passing a null route table and an internal network address;
in response to the call of the virtual private network function, establishing, by a kernel process, the virtual network interface configured with the null route table and internal IP address, wherein the virtual network interface is configured to queue network traffic originated by one or more of the applications running in restricted user space on the device;
monitoring, by the monitoring application running in restricted user space, the virtual network interface for queued data originated by the one or more of the applications running in restricted user space on the device;
assembling, by the monitoring application, a data packet from at least some of the queued data, wherein the d

Assignees

• Mitre Corp

Inventors

• Mitchell Mark

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L47/824

  Applicable to portable or mobile terminals · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L29/06585

  Electricity · mapped topic