System and method for interlocking a host and a gateway
A method is described in example embodiments below that include receiving a content tag associated with transferring a file over a network connection. A session descriptor may also be received. The session descriptor and the content tag may be correlated with a network policy, which may be applied to the network connection. In some embodiments, the content tag may be received with the session descriptor. The file may be tainted by another file in some embodiments, and the content tag may be associated with other file.
1. One or more non-transitory computer readable media that include code for execution and when executed by one or more processors is operable to perform operations comprising:
receiving a content tag associated with transferring a first file over a network connection from a host, wherein the content tag indicates a classification of content in a second file, and wherein the first file and the second file were used on the host during a same session;
correlating the content tag with a network policy; and
applying the network policy to the network connection.
2. The one or more non-transitory computer readable claim 1 , wherein the content tag is associated with the first file based on the first file and the second file being used on the host during the same session.
3. The one or more non-transitory computer readable claim 1 , wherein when executed by the one or more processors, the code is operable to perform operations comprising:
receiving a session descriptor associated with transferring the first file, wherein the session descriptor is correlated with the network policy.
4. The one or more non-transitory computer readable claim 3 , wherein the session descriptor includes at least one of:
a user identifier associated with transferring the first file; or
an identifier of an application associated with transferring the first file.
5. The one or more non-transitory computer readable claim 3 , wherein the session descriptor includes the content tag.
6. The one or more non-transitory computer readable claim 1 , wherein the content tag is a content sensitivity tag.
7. An apparatus, comprising:
a firewall module; and
one or more processors configured to execute instructions associated with the firewall module such that the apparatus is configured to:
receive a content tag associated with transferring a first file over a network connection, wherein the content tag indicates a classification of content in a second file, and wherein the first file and the second file were used on the host during a same session;
correlate the content tag with a network policy; and
apply the network policy to the network connection.
8. The apparatus of claim 7 , wherein the content tag is associated with the first file based on the first file and the second file being used on the host during the same session.
9. The apparatus of claim 7 , wherein the apparatus is further configured to:
receive a session descriptor associated with transferring the first file, wherein the session descriptor is correlated with the network policy.
10. The apparatus of claim 9 , wherein the session descriptor includes the content tag.
11. The apparatus of claim 9 , wherein the apparatus is further configured to:
receive a reputation score associated with a destination for the first file, wherein the reputation score is correlated with the network policy.
12. One or more non-transitory computer readable media that include code for execution and when executed by one or more processors is operable to perform operations comprising:
receiving a content tag that indicates a classification of content in a first file;
associating the content tag with a second file based on the second file and the first file being used during a same session on a host;
detecting a transfer of the second file to a network gateway; and
sending the content tag to the network gateway.
13. The one or more non-transitory computer readable claim 12 , wherein when executed by the one or more processors, the code is operable to perform operations comprising:
monitoring one or more other files being used on the host during the same session as the first file to detect whether any of the one or more other files are transferred to the network gateway, wherein the second file is one of the one or more other files.
14. The one or more non-transitory computer readable claim 12 , wherein when executed by the one or more processors, the code is operable to perform operations comprising:
detecting a transfer of the first file to the host;
calculating a hash of the first file; and
querying a content tag server with the hash to obtain the content tag.
15. The one or more non-transitory computer readable claim 12 , wherein when executed by the one or more processors, the code is operable to perform operations comprising:
monitoring the first file on the host to determine whether any modifications are made to the first file.
16. One or more non-transitory computer readable media that include code for execution and when executed by one or more processors is operable to perform operations comprising:
receiving a content tag that indicates a classification of content in a first file;
associating the content tag with a second file when the second file is a modified version of the first file;
detecting a transfer of the second file to a network gateway; and
sending the content tag to the network gateway.
17. The one or more non-transitory computer readable claim 16 , wherein when executed by the one or more processors, the code is operable to perform operations comprising:
detecting a transfer of the first file to the host;
calculating a hash of the first file; and
querying a content tag server with the hash to obtain the content tag.
18. The one or more non-transitory computer readable claim 16 , wherein when executed by the one or more processors, the code is operable to perform operations comprising:
monitoring the first file to determine whether any modifications are made to the first file.
19. The one or more non-transitory computer readable claim 16 , wherein when executed by the one or more processors, the code is operable to perform operations comprising:
monitoring the second file for modifications when the monitoring the first file indicates at least one modification was made to the first file to create the second file.
20. The one or more non-transitory computer readable claim 16 , wherein the second file is an encrypted version of the first file.
21. An apparatus, comprising:
one or more processors; and
a firewall module including instructions that, when executed by the one or more processors, cause the apparatus to:
receive a content tag that indicates a classification of content in a first file;
associate the content tag with a second file based on the second file and the first file being used during a same session on a host;
detect a transfer of the second file to a network gateway; and
send the content tag to the network gateway.
22. The apparatus of claim 21 , wherein the instructions, when executed by the one or more processors, cause the apparatus to:
detect a transfer of the first file to the host;
calculate a hash of the first file; and
query a content tag server with the hash to obtain the content tag.
23. An apparatus, comprising:
one or more processors; and
a firewall module including instructions that, when executed by the one or more processors, cause the apparatus to:
receive a content tag that indicates a classification of content in a first file;
associate the content tag with a second file if the second file is a modified version of the first file;
detect a transfer of the second file to a network gateway; and
send the content tag to the network gateway.
24. The apparatus of claim 23 , wherein the instructions, when executed by the one or more processors, cause the apparatus to:
monitor the first file to determine whether any modifications are made to the first file.