Systems and methods for managing connections

1. A computer-implemented method for managing connections, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

detecting, by a security agent on an endpoint, an attempt by another application on the endpoint to establish a connection according to a specific Internet protocol; and

injecting, by the security agent on the endpoint, into an options field within a header of a network packet within the connection, the header formatted according to the specific Internet protocol, at least one byte that reveals identifying information about the application to enable an in-line proxy security device to manage the connection according to the revealed identifying information;

wherein:

the specific Internet protocol comprises the Transmission Control Protocol;

the options field comprises an option-kind subfield, an option-length subfield, and an option-data subfield; and

a value set in the option-kind subfield of the options field is unreserved according to the Transmission Control Protocol;

the unreserved value in the option-kind subfield is an integer between 9 and 254 that designates encrypted application management according to an encoding scheme that is shared between the security agent and the in-line proxy security device;

the option-data subfield includes a code that designates an identity of the application according to the encoding scheme;

the option-data subfield further includes a subcode that designates a type of functionality that is provided by the application according to the encoding scheme; and

the encoding scheme maps codes to respective application identities.

2. The computer-implemented method of claim 1 , wherein an encoding scheme that is shared between the security agent and the in-line proxy security device maps application identifiers to numerical codes.

3. The computer-implemented method of claim 1 ,

the subcode designates texting functionality.

4. The computer-implemented method of claim 1 , wherein the subcode designates video conferencing functionality.

5. The computer-implemented method of claim 1 , wherein the security agent is configured to use a same encoding scheme to encode the at least one byte that is used by the in-line proxy security device to enable the in-line proxy security device to decode the information.

6. The computer-implemented method of claim 1 , wherein the information fits within forty bytes.

7. The computer-implemented method of claim 4 , wherein the subcode forms a single digit.

8. The computer-implemented method of claim 1 , wherein the option-length subfield is four octets.

9. The computer-implemented method of claim 1 , wherein the code forms two digits.

10. The computer-implemented method of claim 1 , wherein the identity of the application corresponds to a social network application.

11. The computer-implemented method of claim 1 , wherein the identity of the application corresponds to a texting application.

12. The computer-implemented method of claim 1 , wherein the byte is an octet.

13. The computer-implemented method of claim 1 , wherein a payload of the network packet is encrypted.

14. The computer-implemented method of claim 13 , wherein the network packet is delivered to a destination specified in the header without decrypting the payload.

15. The computer-implemented method of claim 14 , wherein omitting decryption eliminates a request for a transmitter of the network packet to authorize decrypting the payload.

16. The computer-implemented method of claim 1 , wherein enabling the in-line proxy security device to manage the connection according to the revealed identifying information eliminates a burden for the security agent to manage the connection on the endpoint.

17. The computer-implemented method of claim 1 , wherein injecting the byte into the options field within the header enables an in-line proxy security device to prioritize or accelerate transmission of the network packet based on revealing the identifying information about the application.

18. The computer-implemented method of claim 17 , wherein revealing the identifying information reveals that the network packet is directed to video network traffic.

19. A system for managing connections, the system comprising:

a detection module, stored in memory, that detects, as part of a security agent on an endpoint, an attempt by another application on the endpoint to establish a connection according to a specific Internet protocol;

an injection module, stored in memory, that injects, as part of the security agent on the endpoint, into an options field within a header of a network packet within the connection, the header formatted according to the specific Internet protocol, at least one byte that reveals identifying information about the application to enable an in-line proxy security device to manage the connection according to the revealed identifying information; and

at least one physical processor configured to execute the detection module, and the injection module;

wherein:

the specific Internet protocol comprises the Transmission Control Protocol;

the options field comprises an option-kind subfield, an option-length subfield, and an option-data subfield; and

a value set in the option-kind subfield of the options field is unreserved according to the Transmission Control Protocol;

the unreserved value in the option-kind subfield is an integer between 9 and 254 that designates encrypted application management according to an encoding scheme that is shared between the security agent and the in-line proxy security device;

the option-data subfield includes a code that designates an identity of the application according to the encoding scheme;

the option-data subfield further includes a subcode that designates a type of functionality that is provided by the application according to the encoding scheme; and

the encoding scheme maps codes to respective application identities.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

detect, through a security agent on an endpoint, an attempt by another application on the endpoint to establish a connection according to a specific Internet protocol; and

inject, through the security agent on the endpoint, into an options field within a header of a network packet within the connection, the header formatted according to the specific Internet protocol, at least one byte that reveals identifying information about the application to enable an in-line proxy security device to manage the connection according to the revealed identifying information;

wherein:

the specific Internet protocol comprises the Transmission Control Protocol;

the options field comprises an option-kind subfield, an option-length subfield, and an option-data subfield; and

a value set in the option-kind subfield of the options field is unreserved according to the Transmission Control Protocol;

the unreserved value in the option-kind subfield is an integer between 9 and 254 that designates encrypted application management according to an encoding scheme that is shared between the security agent and the in-line proxy security device;

the option-data subfield includes a code that designates an identity of the application according to the encoding scheme;

the option-data subfield further includes a subcode that designates a type of functionality that is provided by the application according to the encoding scheme; and

the encoding scheme maps codes to respective application identities.