Conserving inspection bandwidth of a data inspection and loss prevention appliance
The technology disclosed relates to conserving inspection bandwidth of a data inspection and loss prevention appliance (DILPA) of a network security system (NSS). The technology disclosed uses bypass lists to ensure that rich content traffic is not subjected to inspection by the DILPA. An endpoint routing client (ERC), running on a device, has a bypass list of bandwidth conservable destination identifiers for which inspection bandwidth of the DILPA is conserved by bypassing the DILPA. The identifiers specify rich content sources through domain names, URLs, web categories, and server names (e.g., server name indications (SNIs), HOST headers). ERC classifies incoming connecting access requests as loss prevention inspectable or bandwidth conservable by comparing them against entries in the bypass list. ERC tunnels loss prevention inspectable requests to the DILPA over a secure encrypted channel for inspection. ERC forwards bandwidth conservable requests to the destination web service servers, bypassing inspection by the DILPA.
1. A network security system that reduces latency in security enforcement, the network security system comprising:
a server including a hardware processor that periodically updates performance bypass lists deployed to endpoint routing clients running on devices;
wherein the performance bypass lists identify exempt connection identifiers;
wherein the exempt connection identifiers are not subject to routing through a data inspection and loss prevention appliance;
wherein the exempt connection identifiers are used by the endpoint routing clients to classify incoming connection access requests as non-exempt or exempt, and wherein an incoming connection access request originates from one of the devices;
wherein the data inspection and loss prevention appliance, in dependence upon the performance bypass list-based classification by the endpoint routing clients, inspects non-exempt incoming connection access requests and applies a policy; and
wherein the data inspection and loss prevention appliance, in dependence upon the performance bypass list-based classification by the endpoint routing clients, remains agnostic to exempt incoming connection access requests.
2. The system of claim 1 , wherein the connection access requests are unified resource locator (abbreviated URL) requests and the incoming connection access request is an incoming URL request.
3. The system of claim 1 , wherein the exempt connection identifiers are identifiers that identify domain names.
4. The system of claim 1 , wherein the exempt connection identifiers are identifiers that identify subdomain names.
5. The system of claim 1 , wherein the exempt connection identifiers are identifiers that identify URLs.
6. The system of claim 1 , wherein the exempt connection identifiers are identifiers that identify content types.
7. The system of claim 1 , wherein the exempt connection identifiers are identifiers that identify web categories.
8. The system of claim 7 , wherein the performance bypass list identifies a set number of most frequently visited domains for each of the web categories.
9. The system of claim 1 , wherein the exempt connection identifiers are identifiers that identify system services.
10. The system of claim 1 , wherein the exempt connection identifiers are identifiers that identify certificate pinned applications.
11. The system of claim 1 , wherein the exempt connection identifiers are identifiers that identify server name indications (abbreviated SNIs).
12. The system of claim 1 , wherein the exempt connection identifiers are identifiers that identify network location profiles.
13. The system of claim 1 , wherein the exempt connection identifiers are identifiers that identify source countries.
14. The system of claim 1 , wherein the exempt connection identifiers are identifiers that identify source Internet Protocol (abbreviated IP) address and/or ranges and/or subnets for the source IP address.
15. The system of claim 1 , wherein the exempt connection identifiers are identifiers that identify destination Internet Protocol (abbreviated IP) address and/or ranges and/or subnets for the destination IP address.
16. The system of claim 1 , wherein the data inspection and loss prevention appliance is a cloud-based traffic inspection proxy.
17. The system of claim 1 , wherein the data inspection and loss prevention appliance is an on-premise traffic inspection proxy.
18. The system of claim 1 , wherein the device is an off-organization-network device.
19. The system of claim 1 , wherein the exempt connection identifiers are configured using a web management interface (abbreviated WMI).
20. The system of claim 1 , wherein the exempt connection identifiers are automatically configured using a URL classification service.
21. The system of claim 1 , wherein the exempt connection identifiers are automatically configured based on system services applicable to and/or running on the device.
22. The system of claim 1 , further including the network security system:
generating separate performance bypass lists for different exempt connection identifiers; and
sending the separate performance bypass lists to the endpoint routing client.
23. The system of claim 1 , further including the network security system:
generating a unified performance bypass list for different exempt connection identifiers; and
sending the unified performance bypass list to the endpoint routing client.
24. The system of claim 1 , further including the network security system:
periodically updating the performance bypass list sent to the endpoint routing client.
25. The system of claim 1 , where the performance bypass list is stored at the endpoint routing client as a proxy auto-config (abbreviated PAC) file.