Application firewall
A firewall uses information about an application that originates a network request to determine whether and how to forward the request over a network. The firewall may more generally rely on the identity of the originating application, the security state of the originating application, the security state of the endpoint, and any other information that might provide an indication of malicious activity, to make routing and forwarding decisions for endpoint-originated network traffic.
1. A computer program product for operating a firewall to selectively forward network communications between a first network interface of the firewall operable to couple to an endpoint and a second network interface of the firewall operable to couple to a remote resource hosted at a server, the computer program product comprising computer executable code embodied in a non-transitory memory of the firewall that, when executing on the firewall, responds to a request from the endpoint to the remote resource by performing the steps of:
determining, at the firewall, an identity of an application that originated the request on the endpoint by authenticating an application identity contained in a packet carrying the request;
determining a security state of the application that originated the request by querying, from the firewall a security data recorder on the endpoint; and
conditionally forwarding the request from the firewall to the server only when the identity of the application is recognized and the security state of the application is uncompromised.
2. The computer program product of claim 1 wherein determining the security state of the application that originated the request includes determining the security state based on a secure heartbeat included in the packet.
3. The computer program product of claim 1 wherein determining the security state of the application includes traversing a causal chain of events on the endpoint to identify a root cause of the request.
4. The computer program product of claim 1 wherein conditionally forwarding the request to the server includes conditionally forwarding the request to the server only when the security state of the endpoint is uncompromised.
5. The computer program product of claim 1 wherein querying the security data recorder includes querying the security data recorder to identify a root cause of the request.
6. A firewall configured to selectively forward network communications, the firewall comprising:
a first network interface operable to couple to an endpoint;
a second network interface operable to couple to a remote resource hosted at a server; and
a processor in the firewall, the processor configured to respond to a request from the endpoint to the remote resource for a service by performing the steps of:
determining, at the firewall, an identity of an application that originated the request on the endpoint by authenticating an application identity contained in a packet carrying the request,
determining a security state of the application by querying a security data recorder on the endpoint, and
conditionally forwarding the request to the server only when the identity of the application is recognized and the security state of the application is uncompromised.
7. The firewall of claim 6 wherein determining the identity of the application includes following a causal chain from a nominal originating application to identify a root cause of the request.
8. The firewall of claim 6 wherein the firewall is locally coupled to the remote resource.
9. The firewall of claim 6 wherein the firewall is locally coupled to the endpoint.
10. The firewall of claim 6 wherein the endpoint and the remote resource are peers coupled together through a peer-to-peer network.
11. The firewall of claim 6 wherein the identity of the application is extracted from the request.
12. The firewall of claim 6 wherein the security state of the application is extracted from the request.
13. The firewall of claim 6 wherein conditionally forwarding the request includes conditionally forwarding the request to the server only when the security state of the endpoint is uncompromised.
14. The firewall of claim 6 wherein determining the security state of the application includes querying the endpoint from the firewall for indicia of compromise.
15. The firewall of claim 6 wherein determining the identity of the application includes querying the endpoint from the firewall for the identity.
16. The firewall of claim 6 wherein the processor is further configured to perform the steps of monitoring a pattern of traffic to the remote resource from a plurality of endpoints and automatically developing a rule for acceptable connections to the server based on the pattern of traffic.
17. The firewall of claim 6 wherein the request from the endpoint includes credentials authenticating the application to the server.
18. The firewall of claim 6 wherein the request from the endpoint contains an encrypted heartbeat containing information about a state of the endpoint.
19. The firewall of claim 6 wherein determining the security state of the application includes querying the endpoint for at least one of credentials authenticating the application to the server, credentials authenticating a user of the endpoint to the server, or an encrypted heartbeat containing information about a state of the endpoint.
20. The firewall of claim 6 wherein the processor is further configured to transmit a notification to the endpoint when an indication of compromise is detected for the application.
21. The firewall of claim 6 wherein querying the security data recorder includes querying the security data recorder to identify a root cause of the request.
22. A method for operating a firewall to selectively forward network communications between a first network interface of the firewall operable to couple to an endpoint and a second network interface of the firewall operable to couple to a remote resource hosted at a server, the method including responding to a request from the endpoint to the remote resource by performing the steps of:
determining, at the firewall, an identity of an application that originated the request on the endpoint by authenticating an application identity contained in a packet carrying the request;
determining a security state of the application by querying, from the firewall a security data recorder on the endpoint; and
conditionally forwarding the request from the firewall to the server only when the identity of the application is recognized and the security state of the application is uncompromised.
23. The method of claim 22 wherein querying the security data recorder includes querying the security data recorder to identify a root cause of the request.