Trust based application filtering
Methods, devices, and systems are provided for filtering packets and other communication messages or portions thereof. Particularly, mechanisms are provided for efficiently determining and applying a set of trust-based filtering rules. Trust scores may be assigned to various connections and packets received on a particular connection may have filtering rules applied thereto in accordance with the trust score of the connection.
1. A method, comprising:
determining a trust level for a connection established between a communication device and an enterprise server;
caching, at a socket layer module, the trust level for the connection;
receiving, at the socket layer module, a packet, the packet being received over the connection; and
tagging, by the socket layer module, the packet with the cached trust level for the connection.
2. The method of claim 1 , wherein the trust level for the connection is maintained at a centralized sessions table.
3. The method of claim 1 , wherein the connection comprises a trusted connection and wherein a header of the packet is tagged with information indicating that no filtering is necessary for the packet.
4. The method of claim 3 , wherein the connection comprises one or more of an intra-enterprise connection, an IPSec connection, a VPN connection, and a TLS connection.
5. The method of claim 1 , wherein the connection comprises a semi-trusted connection and wherein a packet transmission rate over the connection is monitored to determine if rate limit filtering is to be applied to the packets received over the connection.
6. The method of claim 5 , further comprising:
determining that the packet transmission rate is above a predetermined threshold; and
tagging the packet with information indicating that rate limit filtering is to be applied to the packet.
7. The method of claim 1 , wherein the connection comprises an untrusted connection and wherein the tag indicates that the packet is to be dropped.
8. The method of claim 7 , wherein the connection comprises a connection over which a user has provided an invalid or expired authentication certificate.
9. A method, comprising:
determining a trust level for a connection established between a communication device and an enterprise server;
caching, at a socket layer module, the trust level for the connection;
receiving, at the socket layer module, a packet, the packet being received over the connection;
tagging, by the socket layer module, the packet with the cached trust level for the connection;
passing the tagged packet to a packet filtering module;
receiving the tagged packet at the packet filtering module;
analyzing, by the packet filtering module, the tag of the received packet;
identifying, based on the tag of the packet, a trust-based filtering policy to be applied to the packet; and
applying the identified trust-based filtering policy to the packet.
10. The method of claim 9 , further comprising:
forwarding the filtered packet to a device an enterprise device for further processing.
11. The method of claim 1 , further comprising:
changing the trust level of the connection, wherein changing the trust level of the connection results in packets received prior to the change being assigned a first trust level and packets received after the change being assigned a second trust level different from the first trust level.
12. The method of claim 1 , further comprising:
defining filtering rules that comprise trust levels associated therewith; and
applying the filtering rules to the packet.
13. A server, comprising:
a sessions table comprising a mapping of connections established at the server to trust levels associated with each connection;
a socket layer module adapted to retrieve a trust level for a connection and further adapted to tag a packet received over the connection with the trust level of the connection; and
a filtering module adapted to apply trust-based filtering rules to the packet based on trust-level information contained in the tag of the packet.
14. The server of claim 13 , wherein the sessions table is centralized and shared among a plurality of different socket layer modules.
15. The server of claim 13 , wherein the connection comprises a trusted connection and wherein a header of the packet is tagged with information indicating that no filtering is necessary for the packet.
16. The server of claim 15 , wherein the connection comprises one or more of an intra-enterprise connection, an IPSec connection, a VPN connection, and a TLS connection.
17. The server of claim 13 , wherein the connection comprises a semi-trusted connection and wherein a packet transmission rate over the connection is monitored to determine if rate limit filtering is to be applied to the packets received over the connection.
18. The server of claim 17 , wherein the socket layer module is further adapted to determine that the packet transmission rate is above a predetermined threshold and tagging the packet with information indicating that rate limit filtering is to be applied to the packet.
19. The server of claim 13 , wherein the connection comprises an untrusted connection and wherein the tag indicates that the packet is to be dropped.
20. The server of claim 19 , wherein the connection comprises a connection over which a user has provided an invalid or expired authentication certificate.
21. A server, comprising:
a sessions table comprising a mapping of connections established at the server to trust levels associated with each connection;
a socket layer module adapted to retrieve a trust level for a connection and further adapted to tag a packet received over the connection with the trust level of the connection;
a filtering module adapted to apply trust-based filtering rules to the packet based on trust-level information contained in the tag of the packet, wherein the sessions table is adapted to be dynamically changed after the connection has been established and before the connection has been terminated, wherein a change to the sessions table results in a change to a trust level of the connection and wherein the change to the trust level of the connection results in packets received prior to the change being assigned a first trust level and packets received after the change being assigned a second trust level different from the first trust level.
22. A computer program product comprising computer executable instructions stored onto a non-transitory computer readable medium which, when executed by a processor of a computer, cause the processor to execute a method, the method comprising:
determining a trust level for a connection established at an enterprise server;
receiving a packet over the connection;
tagging the packet with the trust level for the connection; and
forwarding the tagged packet to a filtering module for filtering in accordance with the trust level of the connection.