Methods and systems for protecting a secured network
Methods and systems for protecting a secured network are presented. For example, one or more packet security gateways may be associated with a security policy management server. At each packet security gateway, a dynamic security policy may be received from the security policy management server, packets associated with a network protected by the packet security gateway may be received, and at least one of multiple packet transformation functions specified by the dynamic security policy may be performed on the packets.
1. A method of filtering packets at a packet security gateway configured for protection of a network, wherein the packet security gateway is capable of receiving a plurality of dynamic security policies and is associated with a security policy management server external from the network, the method comprising:
receiving, by the packet security gateway and from the security policy management server, a dynamic security policy comprising packet filtering rules, wherein one or both of the dynamic security policy or one or more of the packet filtering rules of the dynamic security policy were automatically created or altered, by the security policy management server, based on malicious traffic information received from a plurality of malicious host tracker services, wherein at least two of the plurality of malicious host tracker services are managed by different organizations, wherein one or more of the packet filtering rules were added, removed, or altered by the security policy management server based on a correlation between portions of the malicious traffic information, and wherein a first packet matching rule of the packet filtering rules comprises:
at least one packet matching criterion,
a corresponding packet transformation function, and
an indication of a feed managed by at least one of the plurality of malicious host tracker services; and
performing, based on the packet filtering rules, packet filtering on individual packets of a plurality of packets associated with the network protected by the packet security gateway, wherein the packet filtering comprises:
inspecting individual packets; and
filtering each packet based on content determined from the inspection of that individual packet.
2. The method of claim 1 , wherein the at least one packet matching criterion comprises at least one network address associated with an indication of malicious network traffic.
3. The method of claim 1 , wherein at least one packet transformation function comprises a network protection action.
4. The method of claim 1 , wherein the dynamic security policy specifies that a first plurality of packets should be placed in a first forwarding queue and a second plurality of packets should be placed in a second forwarding queue, wherein the first forwarding queue has a higher forwarding rate than the second forwarding queue, and wherein the method further comprises:
sending, by the packet security gateway, the first plurality of packets in the first forwarding queue; and
sending, by the packet security gateway, the second plurality of packets in the second forwarding queue.
5. The method of claim 1 , further comprising:
receiving, by the packet security gateway and using an interface that is not addressed at the network layer, packets in a network layer transparent manner; and
performing at least one packet transformation function at the network layer.
6. The method of claim 1 , wherein the packet security gateway is a LAN switch.
7. The method of claim 1 , wherein the filtering each packet comprises:
filtering one packet at a time; and
performing a packet digest logging function with respect to each filtered packet.
8. The method of claim 7 , wherein, the packet digest logging function comprises:
identifying a subset of information in each packet that is also specified by the packet digest logging function;
generating, for each packet, a record comprising the subset of information;
reformatting, for each packet, the subset of information according to a logging system standard; and
routing, based on the subset of information in the identified packet, each packet to a monitoring device.
9. A packet security gateway configured for protection of a network, capable of receiving a plurality of dynamic security policies and associated with a security policy management server external from the network, the packet security gateway comprising:
at least one processor; and
memory comprising instructions that, when executed by the last least one processor, cause the packet security gateway to:
receive, from the security policy management server, a dynamic security policy comprising packet filtering rules, wherein one or both of the dynamic security policy or one or more of the packet filtering rules of the dynamic security policy were automatically created or altered, by the security policy management server, based on malicious traffic information received from a plurality of malicious host tracker services, wherein at least two of the plurality of malicious host tracker services are managed by different organizations, wherein one or more of the packet filtering rules were added, removed, or altered by the security policy management server based on a correlation between portions of the malicious traffic information, and wherein a first packet matching rule of the packet filtering rules comprises:
at least one packet matching criterion,
a corresponding packet transformation function, and
an indication of a feed managed by at least one of the plurality of malicious host tracker services; and
perform, based on the packet filtering rules, packet filtering on individual packets of a plurality of packets associated with the network protected by the packet security gateway, wherein the packet filtering comprises:
inspecting individual packets; and
filtering each packet based on content determined from the inspection of that individual packet.
10. The packet security gateway of claim 9 , wherein the at least one packet matching criterion comprises at least one network address associated with an indication of malicious network traffic.
11. The packet security gateway of claim 9 , wherein at least one packet transformation function comprises a network protection action.
12. The packet security gateway of claim 9 , wherein the dynamic security policy specifies that a first plurality of packets should be placed in a first forwarding queue and a second plurality of packets should be placed in a second forwarding queue, wherein the first forwarding queue has a higher forwarding rate than the second forwarding queue, and wherein the instructions, when executed by the at least one processor, cause the packet security gateway to:
send the first plurality of packets in the first forwarding queue; and
send the second plurality of packets in the second forwarding queue.
13. The packet security gateway of claim 9 , wherein the instructions, when executed by the at least one processor, cause the packet security gateway to:
receive, using an interface that is not addressed at the network layer, packets in a network layer transparent manner; and
perform at least one packet transformation function at the network layer.
14. The packet security gateway of claim 9 , wherein the packet security gateway is a LAN switch.
15. The packet security gateway of claim 9 , wherein the instructions, when executed by the at least one processor, cause the packet security gateway to:
filter one packet at a time; and
perform a packet digest logging function with respect to each filtered packet.
16. The packet security gateway of claim 15 , wherein the packet digest logging function comprises:
identifying a subset of information in each packet that is also specified by the packet digest logging function;
generating, for each packet, a record comprising the subset of information;
reformatting, for each packet, the subset of information according to a logging system standard; and
routing, based on the subset of information in the identified packet, each packet to a monitoring device.
17. One or more non-transitory computer-readable media comprising instructions that, when executed by one or more processors of a packet security gateway configured to protect a network, cause the packet security gateway to:
receive, from a security policy management server, a dynamic security policy comprising packet filtering rules, wherein one or both of the dynamic security policy or one or more of the packet filtering rules of the dynamic security policy were automatically created or altered, by the security policy management server, based on malicious traffic information received from a plurality of malicious host tracker services, wherein at least two of the plurality of malicious host tracker services are managed by different organizations, wherein one or more of the packet filtering rules were added, removed, or altered by the security policy management server based on a correlation between portions of the malicious traffic information, and wherein a first packet matching rule of the packet filtering rules comprises:
at least one packet matching criterion,
a corresponding packet transformation function, and
an indication of a feed managed by at least one of the plurality of malicious host tracker services; and
perform, based on the packet filtering rules, packet filtering on individual packets of a plurality of packets associated with the network protected by the packet security gateway, wherein the packet filtering comprises:
inspecting individual packets; and
filtering each packet based on content determined from the inspection of that individual packet.
18. The one or more non-transitory computer-readable media of claim 17 , wherein the at least one packet matching criterion comprises at least one network address associated with an indication of malicious network traffic.
19. The one or more non-transitory computer-readable media of claim 17 , wherein at least one packet transformation function comprises a network protection action.
20. The one or more non-transitory computer-readable media of claim 17 , wherein the dynamic security policy specifies that a first plurality of packets should be placed in a first forwarding queue and a second plurality of packets should be placed in a second forwarding queue, wherein the first forwarding queue has a higher forwarding rate than the second forwarding queue, and wherein the instructions, when executed by the one or more processors of the packet security gateway, cause the packet security gateway to:
send the first plurality of packets in the first forwarding queue; and
send the second plurality of packets in the second forwarding queue.
21. The one or more non-transitory computer-readable media of claim 17 , wherein the instructions, when executed by the one or more processors of the packet security gateway, cause the packet security gateway to:
receive, using an interface that is not addressed at the network layer, packets in a network layer transparent manner; and
perform at least one packet transformation function at the network layer.
22. The one or more non-transitory computer-readable media of claim 17 , wherein the packet security gateway is a LAN switch.
23. The one or more non-transitory computer-readable media of claim 17 , wherein the instructions, when executed by the one or more processors of the packet security gateway, cause the packet security gateway to:
filter one packet at a time; and
perform a packet digest logging function with respect to each filtered packet.
24. The one or more non-transitory computer-readable media of claim 23 , wherein the packet digest logging function comprises:
identifying a subset of information in the packet that is also specified by the packet digest logging function;
generating, for each packet, a record comprising the subset of information;
reformatting, for each packet, the subset of information according to a logging system standard; and
routing, based on the subset of information in the identified packet, each packet to a monitoring device.
25. A system comprising:
a security policy management server external from a network associated with a packet security gateway, wherein the security policy management server comprises:
one or more first processors; and
first memory storing first instructions that, when executed by one or more first processors, cause the security policy management server to:
receive, from a plurality of malicious host tracker services, first malicious traffic information, wherein at least two of the plurality of malicious host tracker services are managed by different organizations;
automatically create, based on the first malicious traffic information, a dynamic security policy or packet filtering rules of the dynamic security policy, wherein a first packet filtering rule of the packet filtering rules comprise:
one or more packet matching criteria comprising a corresponding network addresses,
one or more corresponding packet transformation functions, and
an indication of a feed managed by at least one of the plurality of malicious host tracker services; and
add, remove, or alter the one or more rules of the dynamic security policy based, at least in part, on making a correlation between portions of the first malicious traffic information;
the packet security gateway, wherein the packet security gateway is configured for protection of a network and associated with the security policy management server external from the network, the packet security gateway comprising:
one or more second processors; and
second memory storing second instructions that, when executed by one or more second processors, cause the packet security gateway to:
receive, from the security policy management server, the dynamic security policy comprising the packet filtering rules; and
perform, based on the packet filtering rules, packet filtering on individual packets of a plurality of packets associated with the network protected by the packet security gateway, wherein the packet filtering comprises:
inspecting individual packets; and
filtering each packet based on content determined from the inspection of that individual packet.
26. The system of claim 25 , wherein the at least one packet matching criterion comprises at least one network address associated with an indication of malicious network traffic.
27. The system of claim 25 , wherein at least one packet transformation function comprises a network protection action.
28. The system of claim 25 , wherein the dynamic security policy specifies that a first plurality of packets should be placed in a first forwarding queue and a second plurality of packets should be placed in a second forwarding queue, wherein the first forwarding queue has a higher forwarding rate than the second forwarding queue, and wherein the second instructions, when executed by the one or more second processors, further cause the packet security gateway to:
send the first plurality of packets in the first forwarding queue; and
send the second plurality of packets in the second forwarding queue.
29. The system of claim 25 , wherein the second instructions, when executed by the one or more second processors, further cause the packet security gateway to:
receive, using an interface that is not addressed at the network layer, packets in a network layer transparent manner; and
performing at least one packet transformation function at the network layer.
30. The system of claim 25 , wherein the packet security gateway is a LAN switch.
31. The system of claim 25 , wherein the second instructions, when executed by the one or more second processors, cause the packet security gateway to:
filter one packet at a time; and
perform a packet digest logging function with respect to each filtered packet.
32. The system of claim 31 , wherein, the packet digest logging function comprises:
identifying a subset of information in each packet that is also specified by the packet digest logging function;
generating, for each packet, a record comprising the subset of information;
reformatting, for each packet, the subset of information according to a logging system standard; and
routing, based on the subset of information in the identified packet, each packet to a monitoring device.
33. The system of claim 25 , wherein at least one packet transformation function is configured to route associated packets to a monitoring device.