Systems and methods for network edge selection of network security processing
Various embodiments provide embodiments provide systems and methods for performing edge processing using selectively suspended network security processing.
1 . A method for selecting network security processing at a network edge, the method comprising:
providing, by an edge network device, a first network traffic to a non-edge network device, wherein the first network traffic is a first part of a network traffic session;
receiving, by the edge network device, a grant of suspended security review from the non-edge network device identifying the network traffic session, wherein the grant of suspended security review is given for network traffic that has been identified as having a likelihood of maliciousness below a pre-selected threshold based on historical instances of maliciousness identified in one or more of the identified source or destination;
receiving, by the edge network device, a second network traffic, wherein the second network traffic is a second part of the network traffic session; and
forwarding, by the edge network device, the second network traffic to a destination other than the non-edge network device without accessing the non-edge network device.
2 . The method of claim 1 , the method further comprising:
applying, by the edge network device, network address translation to the second network traffic to yield the destination.
3 . The method of claim 1 , wherein the non-edge network device is a network security appliance.
4 . The method of claim 1 , wherein the edge network device is a network router.
5 . The method of claim 4 , wherein the first network traffic is provided from a user device coupled directly to the network router.
6 . The method of claim 1 , wherein the grant of suspended security review from the non-edge network device indicates the network traffic session; the method further comprising:
receiving, by the non-edge network device, a termination point for the grant of suspended security review; and
revoking, by the non-edge network device, the grant of suspended security review based at least in part on the termination point.
7 . The method of claim 6 , wherein the termination point is the end of the network traffic session.
8 . The method of claim 6 , wherein the termination point is a defined number of bytes of the network traffic session.
9 . The method of claim 1 , wherein the indication that the edge network device is not required to transmit a second part of the network traffic session to the non-edge network device is a grant of suspended security review, the method further comprising:
receiving, by the edge network device, a revocation of the grant of suspended security review from the non-edge network device.
10 . An edge network device, the device comprising:
a processing resource;
a non-transitory computer-readable medium, coupled to the processing resource, and having stored therein instructions that when executed by the processing resource cause the processing resource to:
provide a first network traffic to a non-edge network device, wherein the first network traffic is a first part of a network traffic session;
receive a grant of suspended security review from the non-edge network device identifying the network traffic session, wherein the grant of suspended security review is given for network traffic that has been identified as having a likelihood of maliciousness below a pre-selected threshold based on historical instances of maliciousness identified in one or more of the identified source or destination;
receive a second network traffic, wherein the second network traffic is a second part of the network traffic session; and
forward the second network traffic to a destination other than the non-edge network device without accessing the non-edge network device.
11 . The device of claim 10 , wherein the non-transitory computer-readable medium further includes therein instructions that when executed by the processing resource cause the processing resource to apply network address translation to the first network traffic to yield the destination.
12 . The device of claim 10 , wherein the non-edge network device is a network security appliance.
13 . The device of claim 10 , wherein the edge network device is a network router.
14 . The device of claim 13 , wherein the first network traffic is provided from a user device coupled directly to the network router.
15 . The device of claim 10 , wherein the non-transitory computer-readable medium further includes therein instructions that when executed by the processing resource cause the processing resource to:
receive a termination point for the grant of suspended security review; and
revoke the grant of suspended security review based at least in part on the termination point.
16 . The device of claim 15 , wherein the termination point is the end of the network traffic session.
17 . The device of claim 15 , wherein the termination point is a defined number of bytes of the network traffic session.
18 . The device of claim 10 , wherein the non-transitory computer-readable medium further includes therein instructions that when executed by the processing resource cause the processing resource to receive a revocation of the grant of suspended security review from the non-edge network device.
19 . A non-transitory computer-readable medium, the non-transitory computer readable medium having stored therein instructions that when executed by a processing resource cause the processing resource to perform a method comprising:
providing a first network traffic to a non-edge network device, wherein the first network traffic is a first part of a network traffic session;
receiving a grant of suspended security review from the non-edge network device identifying the network traffic session, wherein the grant of suspended security review is given for network traffic that has been identified as having a likelihood of maliciousness below a pre-selected threshold based on historical instances of maliciousness identified in one or more of the identified source or destination;
receiving a second network traffic, wherein the second network traffic is a second part of the network traffic session;
applying network address translation to the second network traffic to yield the destination; and
forwarding the second network traffic to a destination other than the non-edge network device without accessing the non-edge network device.
20 . The non-transitory computer-readable medium of claim 19 , wherein the non-edge network device is a network security appliance.