VPN deep packet inspection
Policy enforcement previously available for web proxy access methods is extended and applied to layer 3 packets flowing through VPN channels. With these extensions, a common security policy is possible that is enforceable between VPN proxied access and VPN tunneled access. Equivalent security policy to tunnel based VPN access without comprising the inherent performance, scalability and application compatibility advantages tunnel based VPNs have over their proxy based VPN counterparts.
1 . A method for securing a virtual private network (VPN), the method comprising:
receiving a connection request from an originating device for a VPN session, wherein the connection request is associated with authentication information including a user identifier and a hardware identifier of the originating device;
accessing authentication data from a data store, wherein the authentication data includes a plurality of user identifiers and hardware identifiers associated with access to the VPN session;
identifying that the authentication information of the originating device matches the authentication data in the data store and a session type corresponding to a proxied VPN session;
allowing the proxied VPN session with the originating device based on the identified session type, wherein data traveling through the proxied VPN session is subjected to packet inspection; and
passing to a proxy server a connection identifier that allows the proxy server to provide policy server requests correlating to the packet inspected data for the proxied VPN session with the originating device.
2 . The method of claim 1 , further comprising tracking a state of the proxied VPN session, and storing the state of the proxied VPN session tracked in the data store.
3 . The method of claim 1 , wherein the policy server requests made by the proxy server correspond to a response to the connection request from the originating device.
4 . The method of claim 1 , wherein allowing the proxied VPN session includes identifying the proxy server for receiving communications associated with the proxied VPN session.
5 . The method of claim 1 , further comprising sending application-level information by spoofing a protocol exchange with the originating device, wherein the application-level information is included in the connection request.
6 . The method of claim 1 , further comprising supplying one or more tunnels of the VPN with a list corresponding to a port.
7 . The method of claim 6 , wherein the list is associated with one or more access rules specifying application-level information associated with allowing the proxied VPN session.
8 . The method of claim 1 , wherein allowing the proxied VPN session is further based on identifying that the authentication information of the originating device matches the authentication data in the data store and the session type.
9 . An apparatus for securing a virtual private network (VPN), the apparatus comprising:
a transceiver that receives a connection request from an originating device for a VPN session, wherein the connection request is associated with authentication information including a user identifier and a hardware identifier of the originating device;
a data store that stores authentication data that includes a plurality of user identifiers and hardware identifiers associated with access to the VPN session; and
a processor that executes instructions stored in memory, wherein the processor executes the instructions to:
access the authentication data from the data store;
identify that the authentication information of the originating device matches the authentication data in the data store and a session type corresponding to a proxied VPN session;
allow the proxied VPN session with the originating device based on the identified session type, wherein data traveling through the proxied VPN session is subjected to packet inspection; and
pass to a proxy server a connection identifier that allows the proxy server to provide policy server requests correlating to the packet inspected data for the proxied VPN session with the originating device.
10 . The apparatus of claim 9 , wherein the processor executes further instructions to track a state of the proxied VPN session, and wherein the data store further stores the state of the proxied VPN session.
11 . The apparatus of claim 9 , wherein the policy server requests made by the proxy server correspond to a response to the connection request from the originating device.
12 . The apparatus of claim 9 , wherein the processor allows the proxied VPN session by identifying the proxy server for receiving communications associated with the proxied VPN session.
13 . The apparatus of claim 9 , wherein the transceiver further sends application-level information by spoofing a protocol exchange with the originating device, wherein the application-level information is included in the connection request.
14 . The apparatus of claim 9 , wherein the processor executes further instructions to supply one or more tunnels of the VPN with a list corresponding to a port.
15 . The apparatus of claim 14 , wherein the list is associated with one or more access rules specifying application-level information associated with allowing the proxied VPN session.
16 . The apparatus of claim 9 , wherein the processor allows the proxied VPN session further based on identifying that the authentication information of the originating device matches the authentication data in the data store and the session type.
17 . A non-transitory, computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for securing a virtual private network (VPN), the method comprising:
receiving a connection request from an originating device for a VPN session, wherein the connection request is associated with authentication information including a user identifier and a hardware identifier of the originating device;
accessing authentication data from a data store, wherein the authentication data includes a plurality of user identifiers and hardware identifiers associated with access to the VPN session;
identifying that the authentication information of the originating device matches the authentication data in the data store and a session type corresponding to a proxied VPN session;
allowing the proxied VPN session with the originating device based on the identified session type, wherein data traveling through the proxied VPN session is subjected to packet inspection; and
passing to a proxy server a connection identifier that allows the proxy server to provide policy server requests correlating to the packet inspected data for the proxied VPN session with the originating device.