Systems and methods for quality of service of encrypted network traffic
The present invention is directed towards systems and methods for providing classification of an encrypted network packet for performing QoS and acceleration techniques. Encrypted packets may be classified by a first classifier at a first portion of a network stack of a device as corresponding to a first predetermined application, and an application identifier may be included with the packet. In some embodiments, the packets may be decrypted in an order dependent on a first classification of the encrypted network packet. After decryption, packets may be reclassified as corresponding to a second predetermined application by a second classifier operating at a second portion of a network stack of the device above the first portion. Thus, network performance may be enhanced and optimized by providing QoS and acceleration engines with packet- or data-specific information corresponding to the application, while avoiding inefficiencies due to a lack of prioritization of decryption.
1. A method for providing classification of encrypted network traffic, the method comprising:
(a) classifying, by a first classifier operating at a first portion of a network stack of a device, an encrypted packet received via a network port;
(b) including with the packet, by the first classifier, an application identifier corresponding to a first predetermined application identified by the classification;
(c) receiving, by a second classifier operating at a second portion of the network stack above the first portion, the application identifier and the encrypted packet;
(d) reclassifying, by the second classifier, the encrypted packet received from the first classifier to a second predetermined application based on decrypted content of the encrypted packet;
(e) replacing, by the second classifier, the application identifier with a second application identifier of the second predetermined application if the second classifier determines the second predetermined application is more granular than the first predetermined application; and
(f) maintaining the application identifier of the first classifier if the second classifier determines that the first predetermined application is more granular than the second predetermined application.
2. The method of claim 1 , wherein step (a) further comprises classifying, by the first classifier, the packet based on unencrypted portions of the packet.
3. The method of claim 1 , wherein step (a) further comprises receiving a packet comprising an encrypted payload and classifying the packet based on non-payload content.
4. The method of claim 1 , wherein step (b) further comprises attaching, by the first classifier, the application identifier to the packet.
5. The method of claim 1 , wherein step (b) further comprises modifying, by the first classifier, the packet to include the application identifier.
6. The method of claim 1 , wherein step (d) further comprises identifying, by the second classifier, the second predetermined application within a tunnel of encrypted network traffic.
7. The method of claim 1 , wherein step (d) further comprises determining, by the second classifier, that the first predetermined application has a child relationship to the second predetermined application.
8. The method of claim 1 , wherein step (d) further comprises determining, by the second classifier, whether to use the second predetermined application or the first predetermined application for classification of the packet.
9. A system for providing classification of encrypted network traffic, the system comprising:
a device intermediary to and receiving network traffic between a plurality of clients and a plurality of servers;
a first classifier operating at a first portion of a network stack of the device, the first classifier classifying an encrypted packet received via a network port and including with the packet an application identifier corresponding to a first predetermined application identified by the classification; and
a second classifier operating at a second portion of the network stack above the first portion, the second classifier: (i) receiving the application identifier and the encrypted packet, and (ii) reclassifying the encrypted packet received from the first classifier to a second predetermined application based on decrypted content of the encrypted packet;
wherein the second classifier replaces the application identifier with a second application identifier of the second predetermined application if the second classifier determines that the second predetermined application is more granular than the first predetermined application, and maintains the application identifier of the first classifier if the second classifier determines that the first predetermined application is more granular than the second predetermined application.
10. The system of claim 9 , wherein the first classifier classifies the packet based on unencrypted portions of the packet.
11. The system of claim 9 , wherein the device receives a packet comprising an encrypted payload and the first classifier classifies the packet based on non-payload content.
12. The system of claim 9 , wherein the first classifier attaches the application identifier to the packet.
13. The system of claim 9 , wherein the first classifier modifies the packet to include the application identifier.
14. The system of claim 9 , wherein the second classifier identifies the second predetermined application within a tunnel of encrypted network traffic.
15. The system of claim 9 , wherein the second classifier determines that the first predetermined application has a child relationship to the second predetermined application.
16. The system of claim 9 , wherein second classifier determines whether to use the second predetermined application or the first predetermined application for classification of the packet.