Network session management

This invention uses network stack information to enforce context-based policies. The combination of policies, user/application context information and packet filtering is used to enable fine-grained control of network resources.

This invention relates to network session management.

BACKGROUND

A virtual private network (VPN) is a data service that offers transmission characteristics similar to those of private lines using the public Internet. Remote access VPNs can be used for accessing corporate local area networks (LANs) over public networks from small office home offices (SOHO) where employees of the corporations can work from home. The rise of security technologies such as IPSEC, a secure form of the Internet Protocol with optional authentication and encryption, as well as improved quality of service (QoS) has made VPN applications practical. At the same time, the rise in high-speed communication lines such as asymmetric digital subscriber lines (ADSL) and cable modems has increased the vulnerability of the VPNs because they provide conduits for hackers on the public Internet to access sensitive information on a corporate network during a VPN session.

IT administrators can impose restrictions on network access privileges of the remote system to the corporate LAN during a VPN session. For example, during a VPN session between a SOHO and a corporate LAN, the home gateway between the SOHO and the LAN might allow the client access to the printer at home but not to the public Internet. In many situations the home office user may wish to re-configure the network resources based on policies delivered from the LAN. VPN clients are not typically home-networking aware and consequently may limit home network usage during VPN sessions. Personal computer (PC) firewalls are configurable, but are not well integrated with VPN clients and cannot enforce dynamic network stack reconfiguration based on policies.

DETAILED DESCRIPTION

As shown inFIG. 1, a transaction system100allows for transactions between a home office and a corporation. A client station such as a SOHO105can use a browser110or other network software to initiate a network transaction. The SOHO105uses its network software to connect to the Internet115. The SOHO105can connect to Public Web Servers on Internet/Other network120or can initiate a VPN session with a corporate LAN135through this connection with the Internet115and through the corporate Access server125. The corporate LAN135can be, for example, a local network or expanded network of computers in a single location or a national or even international location. When the SOHO105initiates the VPN session, it is connected with other computers associated with the corporate LAN135(based on policies set for corporate LAN135. Various devices140,145are connected to the corporate LAN135for access from other devices on the LAN or a SOHO/remote device105.

The corporate Access server125can include a policy engine126having a list of policies that grant privileges to a variety of users. The policy engine126is used to create filters127that permit or deny users access to the devices140,145on the corporate LAN135.

FIG. 2illustrates the system100ofFIG. 1with an expanded view of the SOHO105as a network200. A SOHO LAN205can have several attached devices including a PC210that initiates a VPN session, a printer215and other devices220. During a VPN session, the device that initiated the VPN session also can function as a node in the SOHO network200. For example, in a typical SOHO network200, the VPN device210can perform the role of a gateway. Other devices such as the PC225can access services available on the VPN PC210, or the VPN PC210can access printer215or other devices220on the SOHO network200.

Sharing the SOHO network200, however, should not compromise the security of the corporate LAN135. Other PCs such as the PC225should be able to access the corporate LAN135through the VPN PC210. Conversely, other devices140,145on the corporate LAN135should not be able to access PCs on the SOHO network200. If the VPN PC210is also the gateway, then other PCs on the SOHO network such as PC225should be able to access Public servers or other network120without compromising security of the SOHO network200or the corporate LAN135or any device associated with the VPN session. However, any nodes on the Internet120, that is, any unauthorized users, should not able to access any of the services on the VPN PC210during the VPN session. Any such access would be a breach of security of the VPN session and must be avoided.

To enhance the security of the system, the VPN PC210has a network stack component210b. The network stack component210bincludes data storage locations typically accessed in a sequential manner, and defines the parameters of the VPN session. To provide the security and access parameters discussed above, the network stack is dynamically reconfigured during the VPN session. Reconfiguration can be statically pre-determined or can be dynamically controlled by policies downloaded by the VPN PC210from126during the VPN session setup. Policies can be fine-grained or coarse-grained. A fine-grained policy can be, for example, a rule that creates a very narrowly defined filter to control the data flow on a specific network interface. A course-grained policy can, for example, be a rule that creates a more broadly defined filter to control the data flow on a larger class or type of network interface.

FIG. 3illustrates an embodiment of a network stack210bthat can be reconfigured during a VPN session. The VPN PC210can have a number of applications running on it such as applications305. A policy store320serves as a repository for policies from the policy engine126that are updated by retrieving policies from the Access server125each time a VPN session is initiated. An augmented policy engine310is an extension of the policy engine126on the Access server125. The augmented policy engine310uses policy rules from the policy store320and applies the rules to both application context priorities as well as data traffic over the network. For example, a policy rule may allow a particular word processing application on the VPN PC210to access a document located on the device140on the corporate LAN135. The word processing program also has associated with it an application context that determines its priority in accessing the device140. Furthermore, policy rules may apply to the network data traffic. Network flow is tracked using various factors such as the type of flow (local or remote origination), network interfaces, destination network address, and source (application, user etc.). The augmented policy engine310uses the application context along with the network data flow factors to enforce finer-grained packet filtering based on the policy rules in the policy store320. In this example, the word processing application may be limited not only by the policy rule, but also by its application context and the network data traffic. The finer granularity of control prevents unwanted outsiders from accessing the VPN session. The network stack210bstores the address space of the LAN205to allow the stack210bto distinguish between devices on the SOHO LAN205and devices on the corporate LAN135, and undesired nodes on the Internet or other network120. The network stack210bis thus able to filter packets based on the source and destination.

A socket interceptor330serves as a session layer component in the network stack210bthat identifies all active network applications305. The Portable Operating System Interface UNIX (POSIX) is used to create application sockets and provide a uniform application interface. In one embodiment, the socket interceptor drops packets destined to and from certain applications305. For example, the socket interceptor drops packets from user logins that are not authorized to be part of a VPN session. In another embodiment, the socket interceptor330provides context information for network packets flowing from a packet guard360that creates packet filters as they flow into the packet guard. In one embodiment, the socket interceptor can be implemented as a WinSock layered service provider (LSP) on a Microsoft Windows platform. In this way, the socket interceptor330acts as an application program interface (API) between Microsoft Windows and TCP/IP protocol software.

In addition to receiving context information from the socket interceptor330, the packet guard360also creates filters from the policies in the policy store320. The packet guard360also can be connected to a predetermined static configuration365that also provides filtering criteria. “Instance” filtering is dictated by the augmented policy engine310based on rules in the policy store320. In one embodiment, the packet guard layer360can be implemented as a Network Driver Interface Specification (NDIS) intermediate driver on the Microsoft Windows platform. In this way the packet guard360can offer protocol multiplexing so that multiple protocol stacks can co-exist on the same host.

A Transmission Control/Internet Protocol (TCP/IP) layer that provides the network communication is connected between the socket interceptor330and the packet guard360. A packet translator350is connected between the TCP/IP interface340and the packet guard layer360. The packet translator350translates data packets to and from the different network locations, in this case, the packets between the corporate LAN135and the SOHO LAN205. In one implementation, the packet translator can be the Internet standard Network Address Translation (NAT) that allows a company to shield internal addresses from the Internet.

A network interface370is connected to the packet guard360. The network interface is the session layer that interfaces the network stack210bwith network software (not shown) to connect the VPN PC210to the SOHO LAN205and ultimately to the corporate LAN135.

The network stack210bthus creates an effective “firewall” between the VPN session and outside intrusion.

To reconfigure the network stack210bsecurely and automatically during the VPN session, the network stack210bsenses the VPN session. As shown inFIG. 4, a client begins405a VPN session. The network stack210breceives410policies from the Access server125and stores415the policies in the policy store320. At this point, the VPN session initially is sensed and the received policies determine what access the client, the SOHO105or the SOHO LAN205, is permitted. The packet guard360is used to enforce420packet filtering. The packet filtering is performed either by receiving policy rules from the augmented policy engine310or by reading the pre-programmed static configuration365that determines what packets are filtered. Next, the socket interceptor330is created and provides430user and/or application context. The socket interceptor330can detect and drop440packets, for example, from user logins that are not permitted to be part of the VPN session. Packets from any other external PCs (not shown) also are dropped. The socket interceptor330also can provide445application context information back to the augmented policy engine320about applications305. This context information can be used by the augmented policy engine310to further enforce420packet filtering. Furthermore, the policies are used to filter460packets. Therefore, the network stack210bis constantly re-configuring itself based on policy rules received from the Access Server125and context information provided by the socket interceptor330and from the packet guard, which serves as a “packet firewall”. The process400constantly monitors450network configuration changes throughout the VPN session to detect any external intervening and unauthorized processes.

Various aspects of the apparatus and methods may be implemented in digital circuitry, or in computer hardware, firmware, software, or in combinations of them. Apparatus can be implemented in a computer products tangibly embodied in a machine-readable storage device for execution by a programmable processor. The foregoing techniques may be performed, for example, by a programmable processor executing a program of instructions to perform functions of the invention by operating on input data and generating output. The methods can be implemented in one or more computer programs that are executable on a programmable system including at least one programmable processor coupled to receive data and instructions from, and to transmit data and instructions to, a data storage system, at least one in/out device, and at least one output device. Each computer program may be implemented in a high-level procedural or object-oriented programming language, or in assembly or machine language. The language may be compiled or interpreted language. Suitable processors include, by way of example, both general and special purpose microprocessors. Generally, a processor will receive instructions and data from read-only memory and/or random access memory. Storage devices suitable for tangibly embodying computer program instructions and data include all forms of non-volatile memory, including by way of example, semiconductor devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM disks. Any of the foregoing may be supplemented by or incorporated in, specially designed application-specific integrated circuits (ASICS).

Possible advantages of the foregoing techniques include dynamic creation of a packet filtering firewall (the packet guard360), which is driven by policies or static configurations. Another advantage is the ability to extend policies to include application and/or user context. For example, a corporate policy may temporarily ban the use of a particular browser until patches are applied. Correlating application context and network packet flows can easily enforce such a policy. Another advantage is the ability to confirm continuously that security policies are being applied on the client side.

The foregoing method also can use unified network stack information to enforce the context-based policies. The stack is an aggregation of information across the various layers of the network stack. The combination of application and/or user context to network flow enables the fine-grained control of the network resources in the home office.