Secure and lightweight traffic forwarding systems and methods to cloud based network security systems
A method implemented by an agent operating on a mobile device communicating to a cloud-based system includes opening up local listening sockets on the mobile device; redirecting outgoing traffic from all application on the mobile device except the agent to the local listening sockets; and forwarding the outgoing traffic from the local listening sockets to the cloud-based system with additional information included therein for the cloud-based system.
1. A cloud node in a cloud system, the cloud node comprising:
a network interface communicatively coupled to a network, a processor communicatively coupled to the network interface, and memory storing instructions that when executed cause the processor to:
receiving traffic from a mobile device based on forwarding from local listening sockets on the mobile device, wherein the local listening sockets are opened on the mobile device and the traffic is redirected from applications on the mobile device to the local listening sockets and forwarded to the cloud node with additional information related to an associated application on the mobile device; and
applying one or more remote policies in the cloud node to the traffic based in part on the additional information.
2. The cloud node of claim 1 , wherein the local listening sockets are a Transmission Control Protocol (TCP) listening socket for Web traffic and a User Datagram Protocol (UDP) listening socket for Domain Name System (DNS) traffic.
3. The cloud node of claim 1 , wherein the additional information comprises any of application unique package name, application version, operating system version, device model, and agent version.
4. The cloud node of claim 1 , wherein the memory storing instructions that when executed further cause the processor to:
enroll a user of the mobile device in the cloud system and authorize the mobile device in the cloud system.
5. The cloud node of claim 1 , wherein the memory storing instructions that when executed further cause the processor to:
responsive to a violation of the one or more remote policies, provide an end user notification to the mobile device via a push notification to the mobile device.
6. The cloud node of claim 5 , wherein the push notification is via a mobile operating system notification cloud.
7. The cloud node of claim 1 , wherein the memory storing instructions that when executed further cause the processor to:
responsive to a violation of the one or more remote policies, block the traffic in the cloud node and provide an end user notification to the mobile device.
8. The cloud node of claim 1 , wherein the one or more remote policies comprise allowing or blocking transactions from one or more applications on the mobile device.
9. The cloud node of claim 8 , wherein the one or more applications are allowed or block based on one or more of malware detection, location, and susceptibility to information leakage.
10. The cloud node of claim 1 , wherein the mobile device comprises a user device configured with the one or more remote policies for an organization associated with a user of the mobile device.
11. A cloud method in a node in a cloud system, the cloud method comprising:
receiving traffic from a mobile device based on forwarding from local listening sockets on the mobile device, wherein the local listening sockets are opened on the mobile device and the traffic is redirected from applications on the mobile device to the local listening sockets and forwarded to the cloud node with additional information related to an associated application on the mobile device; and
applying one or more remote policies in the cloud node to the traffic based in part on the additional information.
12. The cloud method of claim 11 , wherein the local listening sockets are a Transmission Control Protocol (TCP) listening socket for Web traffic and a User Datagram Protocol (UDP) listening socket for Domain Name System (DNS) traffic.
13. The cloud method of claim 11 , wherein the additional information comprises any of application unique package name, application version, operating system version, device model, and agent version.
14. The cloud method of claim 11 , further comprising:
enrolling a user of the mobile device in the cloud system and authorizing the mobile device in the cloud system.
15. The cloud method of claim 11 , further comprising:
responsive to a violation of the one or more remote policies, providing an end user notification to the mobile device via a push notification to the mobile device.
16. The cloud method of claim 15 , wherein the push notification is via a mobile operating system notification cloud.
17. The cloud method of claim 11 , further comprising:
responsive to a violation of the one or more remote policies, blocking the traffic in the cloud node and providing an end user notification to the mobile device.
18. The cloud method of claim 11 , wherein the one or more remote policies comprise allowing or blocking transactions from one or more applications on the mobile device.
19. The cloud method of claim 18 , wherein the one or more applications are allowed or block based on one or more of malware detection, location, and susceptibility to information leakage.
20. A non-transitory computer readable medium comprising instructions that when executed cause a processor in a cloud node to:
receive traffic from a mobile device based on forwarding from local listening sockets on the mobile device, wherein the local listening sockets are opened on the mobile device and the traffic is redirected from applications on the mobile device to the local listening sockets and forwarded to the cloud node with additional information related to an associated application on the mobile device; and
apply one or more remote policies in the cloud node to the traffic based in part on the additional information.