Securing local network traffic using cloud computing
Systems and methods for securely handling data traffic on local or private networks, such as by using cloud computing, are provided. A non-transitory computer-readable medium, according to one implementation, may be configured to store executable instructions enabling a processor of a user device to perform the step of discovering an origin of a source application associated with network packets bound for a private address space. The executable instructions may further enable the processor to send a tuple regarding the discovered origin to a cloud server to request an analysis of the tuple. Upon receiving an allow instruction from the cloud server, the instructions enable the processor to allow the network packets to flow normally to a destination associated with the private address space. Upon receiving a deny instruction from the cloud server, the instructions enable the processor to drop the network packets.
1. A non-transitory computer-readable medium configured to store executable instructions enabling a processor of a user device to perform the steps of:
intercepting network packets originating from one or more source applications operating on the user device,
discovering an origin source application of the one or more source applications associated with the network packets bound for a private address space,
recording a tuple associated with the discovered origin source application, the tuple defining a sequenced list related to the source application comprising any of an application name and a network type,
sending the tuple regarding the discovered origin source application to a cloud server to request an analysis of the tuple,
upon receiving an allow instruction from the cloud server, allowing the network packets to flow normally to a destination associated with the private address space, and
upon receiving a deny instruction from the cloud server, dropping the network packets, wherein upon receiving a caution instruction from the cloud server, the executable instructions further enable the processor to allow the network packets to flow normally and redirect a copy of the network packets and additional network transaction information to the cloud server for further analysis of the tuple.
2. The non-transitory computer-readable medium of claim 1 , wherein, upon receiving an allow instruction from the cloud server based on the further analysis, the executable instructions further enable the processor to allow the network packets to flow normally to the destination associated with the private address space, and, upon receiving a deny instruction from the cloud server based on the further analysis, the executable instructions further enable the processor to drop the network packets.
3. The non-transitory computer-readable medium of claim 1 , wherein the executable instructions further enable the processor to:
intercept incoming and outgoing network packets at the user device,
open a tunnel with the cloud server, and
download, via a procedure to receive executed on the user device, configuration information, policy information, and traffic rules from the cloud server for the user device to use thereon.
4. The non-transitory computer-readable medium of claim 3 , wherein the executable instructions further enable the processor to:
determine where the incoming and outgoing network packets are to be transmitted,
upon determining that the incoming and outgoing network packets are to be transmitted to a public address space, send the incoming and outgoing network packets via the cloud server, and
upon determining that the incoming and outgoing network packets are to be transmitted to the private address space, perform the step of discovering the origin of the source application associated with the network packets.
5. A user device configured to execute an application for securing local network traffic, the user device comprising:
a processor; and
memory configured to store executable instructions enabling the processor to:
intercept network packets originating from one or more source applications operating on the user device,
discover an origin source application of the one or more source applications associated with the network packets bound for a private address space,
record a tuple associated with the discovered origin source application, the tuple defining a sequenced list related to the source application comprising any of an application name and a network type,
send the tuple regarding the discovered origin source application to a cloud server to request an analysis of the tuple,
upon receiving an allow instruction from the cloud server, allow the network packets to flow normally to a destination associated with the private address space, and
upon receiving a deny instruction from the cloud server, drop the network packets; wherein, upon receiving a caution instruction from the cloud server the executable instructions further enable the processor to allow the network packets to flow normally and redirect a copy of the network packets and additional network transaction information to the cloud server for further analysis of the tuple.
6. The user device of claim 5 , wherein, upon receiving an allow instruction from the cloud server based on the further analysis, the executable instructions further enable the processor to allow the network packets to flow normally to the destination associated with the private address space, and, upon receiving a deny instruction from the cloud server based on the further analysis, the executable instructions further enable the processor to drop the network packets.
7. The user device of claim 5 , wherein the executable instructions further enable the processor to:
intercept incoming and outgoing network packets,
open a tunnel with the cloud server,
download configuration information, policy information, and traffic rules from the cloud server for the user device to use thereon,
determine where the incoming and outgoing network packets are to be transmitted,
upon determining that the incoming and outgoing network packets are to be transmitted to a public address space, send the incoming and outgoing network packets via the cloud server, and
upon determining that the incoming and outgoing network packets are to be transmitted to the private address space, perform the step of discovering the origin of the source application associated with the network packets.
8. The user device of claim 5 , further comprising a network interface configured to communicate with the cloud server.
9. The user device of claim 5 , wherein the user device is configured to enable a remote user to access an enterprise network from outside a physical perimeter of the enterprise network.
10. The user device of claim 5 , wherein the user device is one of a laptop, smartphone, tablet, netbook, personal digital assistant, MP3 player, cell phone, e-book reader, IoT device, server, desktop, printer, television, and streaming media device.
11. A cloud server configured to execute an application for securing local network traffic, the cloud server comprising:
a processor; and
memory configured to store executable instructions enabling the processor to:
receive a tuple from a user device, the tuple including information regarding an origin source application executing on the user device associated with network packets bound for a private address space, the tuple defining a sequenced list related to the source application comprising any of an application name and a network type,
comprising any of an application name and a network type,
perform an analysis of the information of the tuple to identify potential malware and/or policy violations, and
provide results of the analysis to the user device by sending the user device one of an allow instruction and a deny instruction, the allow instruction configured to instruct the user device to perform an action of allowing the network packets to flow normally via the cloud server to a destination, the deny instruction configured to instruct the user device to perform an action of dropping the network packets, wherein, upon receiving a caution instruction from the cloud server the executable instructions further enable the processor to allow the network packets to flow normally and redirect a copy of the network packets and additional network transaction information to the cloud server for further analysis of the tuple.
12. The cloud server of claim 11 , wherein the executable instructions further enable the processor to
open a tunnel with the user device in response to a request for assistance, and
download configuration information, policy information, and traffic rules to the user device for the user device to use thereon.
13. The cloud server of claim 11 , wherein, upon receiving the network packets and additional network transaction information from the user device in response to the caution instruction, the instructions further enable the processor to perform a further analysis using a deep packet inspection of a network transaction associated with the network packets.
14. The cloud server of claim 13 , wherein the deep packet inspection includes determining whether malicious behavior is detected, sending the user device an allow instruction for allowing the network packets to flow normally via the cloud server to the destination in response to determining that the source application does not exhibit malicious behavior, and sending the user device a deny instruction for dropping the network packets in response to determining that the source application exhibits malicious behavior.
15. The cloud server of claim 14 , further comprising a malware repository, wherein the deep packet inspection includes designating the source application as safe in the malware repository in response to determining that the source application does not exhibit malicious behavior and designating the source application as unsafe in the malware repository in response to determining that the source application exhibits malicious behavior.
16. The cloud server of claim 11 , further comprising a malware repository, wherein performing the analysis of the information of the tuple to identify potential malware and/or policy violations includes
comparing the information of the tuple with information stored in the malware repository,
sending the allow instruction when the information of the tuple is designated as safe in the malware repository,
sending the deny instruction when the information of the tuple is designated as unsafe in the malware repository, and
sending a caution instruction when the information of the tuple is not present in the malware repository.
17. The cloud server of claim 11 , wherein the private address space is part of a Virtual Private Network (VPN).