Managing security of network communications in an information handling system
A security level of data generated by an application may be communicated from the application layer to the network layer and that security level used to determine of several available network connects for transmitting the data. A method of communicating may include associating the plurality of network connections with security levels to form associations, the associations indicating security levels of data that may be transmitted over each of the plurality of network connections; receiving, at the network layer, data for transmission; determining, at the network layer, a security level for the data; determining, at the network layer, at least one network connection of a plurality of network connections to transmit the data based, at least in part, on the security level; and transmitting the data packet over the at least one network connection.
1. A method, comprising:
receiving, at a device at a network layer, data for transmission;
receiving, at the device at the network layer from an application layer, an indication associated with the data;
determining, by the device at the network layer, a security level for the data based, at least in part, on the indication according to a mapping of indicators to security levels;
determining, by the device at the network layer, at least one network connection of a plurality of network connections to transmit the data in at least one data packet based, at least in part, on the security level and an association of the at least one network connection with the security level, the at least one network connection determined further based on an application priority level associated with the data; and
transmitting, by the device, the at least one data packet over the at least one network connection.
2. The method of claim 1 , wherein receiving the indication comprises receiving information through an application interface for passing information from a software module executing in a user mode to a software module executing in a kernel mode.
3. The method of claim 1 , wherein determining the at least one network connection comprises:
determining a secure network connection from the plurality of network connections for transmission of the data in a first condition when the security level corresponds to secure data;
determining any of the plurality of network connections for transmission of the data in a second condition when the security level corresponds to insecure data and the application priority level corresponds to high-priority data; and
determining an insecure network connection from the plurality of network connections for transmission of the data in a third condition when the data packet does not correspond to the first condition and does not correspond to the second condition.
4. The method of claim 1 , further comprising associating the plurality of network connections with security levels to form associations, the associations indicating security levels of data that may be transmitted over each of the plurality of network connections.
5. An apparatus, comprising:
a memory; and
a processor coupled to the memory and configured to perform steps comprising:
receiving, at a network layer, data for transmission;
receiving, at the network layer from an application layer, an indication associated with the data;
determining, at the network layer, a security level for the data based, at least in part, the indication according to a mapping of indicators to security levels;
determining, at the network layer, at least one network connection of a plurality of network connections to transmit the data in at least one data packet based, at least in part, on the security level and an association of the at least one network connection with the security level, the at least one network connection determined further based on an application priority level associated with the data; and
transmitting the at least one data packet over the at least one network connection.
6. The apparatus of claim 5 , wherein receiving the indication comprises receiving information through an application interface for passing information from a software module executing in a user mode to a software module executing in a kernel mode.
7. The apparatus of claim 5 , wherein determining the application priority level comprises receiving an indication of the application priority level from the application layer.
8. The apparatus of claim 5 , wherein determining the at least one network connection comprises:
determining a secure network connection from the plurality of network connections for transmission of the data in a first condition when the security level corresponds to secure data;
determining any of the plurality of network connections for transmission of the data in a second condition when the security level corresponds to insecure data and the application priority level corresponds to high-priority data; and
determining an insecure network connection from the plurality of network connections for transmission of the data in a third condition when the data packet does not correspond to the first condition and does not correspond to the second condition.
9. The apparatus of claim 5 , wherein the processor is further configured to associate the plurality of network connections with security levels to form associations, the associations indicating security levels of data that may be transmitted over each of the plurality of network connections.
10. An information handling system, comprising:
a first network adaptor configured to transmit data over a first network connection of a plurality of network connections;
a second network adaptor configured to transmit data over a second network connection of the plurality of network connections;
a memory; and
a processor coupled to the first network adaptor, to the second network adaptor, and to the memory, wherein the processor is configured to perform steps comprising:
associating the plurality of network connections with security levels to form associations, the associations indicating security levels of data that may be transmitted over each of the plurality of network connections, including a first security level for the first network adaptor and a second security level for the second network adaptor;
receiving, at a network layer, data for transmission;
determining, at the network layer, a security level for the data, wherein determining the security level for the data comprises receiving an indication of the security level from an application layer;
determining, at the network layer, at least one network connection of the plurality of network connections to transmit the data in at least one data packet based, at least in part, on the security level and an association of the at least one network connection with the security level, the at least one network connection determined further based, at least in part, on an application priority level associated with the data; and
transmitting the at least one data packet over the at least one network connection.
11. The information handling system of claim 10 , wherein receiving the indication comprises receiving information through an application interface for passing information from a software module executing in a user mode on the processor to a software module executing in a kernel mode on the processor.
12. The information handling system of claim 10 , wherein determining the at least one network connection comprises:
determining a secure network connection from the plurality of network connections for transmission of the data in a first condition when the security level corresponds to secure data;
determining any of the plurality of network connections for transmission of the data in a second condition when the security level corresponds to insecure data and the application priority level corresponds to high-priority data; and
determining an insecure network connection from the plurality of network connections for transmission of the data in a third condition when the data packet does not correspond to the first condition and does not correspond to the second condition.
13. The information handling system of claim 10 , wherein the processor is configured to execute a driver operating at the network layer for accessing the first network adaptor and the second network adaptor, and wherein the processor is configured to execute a filtering platform, wherein the filtering platform provides an application interface to the network layer for receiving the indication of the security level from the application layer.