Adding policy coding to packet headers to use to access resources in a secure network
Provided are a computer program product, system, and method for adding policy coding to packet headers to use to access resources in a secure network. A determination is made of policy information for a user defining user privileges to access resources in the secure network. The policy information is inserted into packet headers in packets to transmit to an enforcement point associated with a destination resource in the secure network indicated in the packet headers. The packets with the packet headers including the policy information are transmitted to the enforcement point. The enforcement point applies policy rules to the policy information to determine whether to forward the packets to the destination resource.
1 . A computer program product for generating packets at a client device to access resources in a secure network, the computer program product comprising a computer readable storage medium having computer readable program code embodied therein that when executed performs operations, the operations comprising:
determining, at the client device, policy information for a user defining user privileges to access resources in the secure network;
inserting, at the client device, the policy information into each of a plurality of packet headers in each of a plurality of packets to transmit the packets with the inserted policy information to an enforcement point associated with a destination resource in the secure network indicated in the packet headers; and
transmitting, by the client device, the packets with the packet headers including the policy information to the enforcement point, wherein the enforcement point applies policy rules to the policy information to determine whether to forward the packets to the destination resource.
2 . The computer program product of claim 1 , wherein the determining the policy information comprises:
determining a policy coding as a function of a user type of the user, device type of the client device, and user permissions within the secure network, wherein the policy information inserted into the packet headers comprises the policy coding.
3 . The computer program product of claim 2 , wherein the policy coding comprises an encoded value indicating the user type of the user, the device type, and the user permissions, wherein the enforcement point applies the policy rules to the user permissions, the device type, and the user type indicated in the policy coding to determine whether to forward the packets to the destination resource indicated in the packets.
4 . The computer program product of claim 1 , wherein the operations further comprise:
using at least one of encryption and signing of the policy information to insert at least one of encrypted and signed policy information into the packet headers, wherein the enforcement point performs at least one of decrypting and authenticating the signed policy information and then apply the policy rules to the policy information.
5 . The computer program product of claim 1 , wherein the determining the policy information comprises:
transmitting a request to authenticate the user of the client device to an access control system of the secure network and obtain the policy information; and
receiving the policy information from the access control system to include in the packet headers of the packets transmitted to the secure network in response to the access control system authenticating the user and returning the policy information for the authenticated user.
6 . The computer program product of claim 1 , wherein the determining the policy information for the user comprises:
authenticating the user at the client device; and
accessing the policy information from local storage in the client device to include in the packet headers of the packets in response to the authenticating the user.
7 . The computer program product of claim 1 , wherein the operations further comprise:
running a packet encapsulation manager in a kernel of an operating system of the client device to perform the determining of the policy information and the inserting the policy information in the packet headers, and further performs:
intercepting packets directed to the secure network, wherein the policy information is inserted in the packet headers of the intercepted packets; and
forwarding the packets with the packet headers having the policy information to the secure network.
8 . The computer program product of claim 1 , wherein the policy information is inserted in an extended header of an Internet Protocol (IP) packet available for user determined information.
9 . A system for generating packets at a client device to access resources in a secure network, comprising:
a processor; and
a computer readable storage medium having computer readable program code embodied therein that when executed by the processor performs operations, the operations comprising:
determining, at the client device, policy information for a user defining user privileges to access resources in the secure network;
inserting, at the client device, the policy information into each of a plurality of packet headers in each of a plurality of packets to transmit the packets with the inserted policy information to an enforcement point associated with a destination resource in the secure network indicated in the packet headers; and
transmitting, by the client device, the packets with the packet headers including the policy information to the enforcement point, wherein the enforcement point applies policy rules to the policy information to determine whether to forward the packets to the destination resource.
10 . The system of claim 9 , wherein the determining the policy information comprises:
determining a policy coding as a function of a user type of the user, device type of the client device, and user permissions within the secure network, wherein the policy information inserted into the packet headers comprises the policy coding.
11 . The system of claim 10 , wherein the policy coding comprises an encoded value indicating the user type of the user, the device type, and the user permissions, wherein the enforcement point applies the policy rules to the user permissions, the device type, and the user type indicated in the policy coding to determine whether to forward the packets to the destination resource indicated in the packets.
12 . The system of claim 9 , wherein the determining the policy information comprises:
transmitting a request to authenticate the user of the client device to an access control system of the secure network and obtain the policy information; and
receiving the policy information from the access control system to include in the packet headers of the packets transmitted to the secure network in response to the access control system authenticating the user and returning the policy information for the authenticated user.
13 . The system of claim 9 , wherein the determining the policy information for the user comprises:
authenticating the user at the client device; and
accessing the policy information from local storage in the client device to include in the packet headers of the packets in response to the authenticating the user.
14 . The system of claim 9 , wherein the computer readable storage medium includes:
an operating system; and
a packet encapsulation manager running in a kernel of the operating system, wherein the packet encapsulation manager performs the determining of the policy information and the inserting the policy information in the packet headers, and further performs:
intercepting packets directed to the secure network, wherein the policy information is inserted in the packet headers of the intercepted packets; and
forwarding the packets with the packet headers having the policy information to the secure network.
15 . A computer implemented method for generating packets at a client device to access resources in a secure network, comprising:
determining, at the client device, policy information for a user defining user privileges to access resources in the secure network;
inserting, at the client device, the policy information into each of a plurality of packet headers in each of a plurality of packets to transmit the packets with the inserted policy information to an enforcement point associated with a destination resource in the secure network indicated in the packet headers; and
transmitting, by the client device, the packets with the packet headers including the policy information to the enforcement point, wherein the enforcement point applies policy rules to the policy information to determine whether to forward the packets to the destination resource.
16 . The computer implemented method of claim 15 , wherein the determining the policy information comprises:
determining a policy coding as a function of a user type of the user, device type of the client device, and user permissions within the secure network, wherein the policy information inserted into the packet headers comprises the policy coding.
17 . The computer implemented method of claim 16 , wherein the policy coding comprises an encoded value indicating the user type of the user, the device type, and the user permissions, wherein the enforcement point applies the policy rules to the user permissions, the device type, and the user type indicated in the policy coding to determine whether to forward the packets to the destination resource indicated in the packets.
18 . The computer implemented method of claim 15 , wherein the determining the policy information comprises:
transmitting a request to authenticate the user of the client device to an access control system of the secure network and obtain the policy information; and
receiving the policy information from the access control system to include in the packet headers of the packets transmitted to the secure network in response to the access control system authenticating the user and returning the policy information for the authenticated user.
19 . The computer implemented method of claim 15 , wherein the determining the policy information for the user comprises:
authenticating the user at the client device; and
accessing the policy information from local storage in the client device to include in the packet headers of the packets in response to the authenticating the user.
20 . The computer implemented method of claim 15 , further comprising:
running a packet encapsulation manager running in a kernel of an operating system of the client device, wherein the packet encapsulation manager performs the determining of the policy information and the inserting the policy information in the packet headers, and further performs:
intercepting packets directed to the secure network, wherein the policy information is inserted in the packet headers of the intercepted packets; and
forwarding the packets with the packet headers having the policy information to the secure network.