Patent ID: 8458786
Filing Date: 2013-06-04
Classification: H04L

Abstract:
1. A system, comprising: a data processing apparatus in a distributed security system external to a plurality of logically independent internet protocol (IP) networks, wherein at least one or more tunneling communications protocol communications channels are established between the plurality of logically independent IP networks; a memory store in data communication with the data processing apparatus and storing: tunnel session data storing a session entry for each of a plurality of tunnels sessions for corresponding tunnels, each session entry describing an authentication status, the authentication status for each tunnel session being one of authenticated or unauthenticated; wherein user requests from the plurality of logically independent IP networks are routed through one of the plurality of tunnels to the distributed security system for processing therein; location data describing, for each of a plurality of locations: tunnels associated with the location and that provide data communication between the data processing apparatus and the logically independent IP networks; and security policies specific to the location and to be applied to traffic communicated over the tunnels associated with the location unauthenticated; computer-readable instructions executable by the data processing apparatus and that upon execution cause the data processing apparatus to perform operations comprising: receiving tunnel packets for the logically independent networks in data communication with the data processing apparatus; for each received tunnel packet: determining, from a tunnel identifier received as part of tunnel packet and identifying a tunnel from which the packet was received, whether a session entry in the session data exists for the tunnel; in response to determining that a session entry does not exist in the session data, then creating a session entry for the tunnel, performing an authentication process to determine a location to be associated with the session entry, and associating an entry in the location data for the location with the session entry, wherein the authentication process comprises marking the tunnel as unauthenticated for a predefined period of time while observing the tunnel for a certain number of one or more transactions to determine if one or more conditions are met for authentication, and wherein the predefined period of time is greater than at least one transaction; in response to determining that a session entry exists in the session data, determining whether an authentication status indicates the tunnel session is authenticated or unauthenticated; and in response to determining that an authentication expiration event has occurred, changing the authentication status to unauthenticated.