# US 10,454,895 B2 · Method and apparatus for application awareness in a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,895 B2 - Document ID: US10454895B2 - Status: Granted - Kind: B2 - Application number: 15/262,861 - Filed: 2016-09-12 - Published: 2016-12-29 - Granted: 2019-10-22 - Earliest claimed: 2013-02-14 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Azeem Feroz; Binyuan Chen; Amit Chopra - Web page: https://patentgrep.com/patent/US10454895B2 ## CPC - H04L 63/0263: {Rule management} - G06F 21/44: Program or device authentication - G06F 21/554: {involving event detection and direct action} - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/166: {at the transport layer} - H04L 63/168: {above the transport layer} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for enforcing a network policy is described herein. In the method, a network socket event request from an application executing in a first context is intercepted by an agent prior to the request reaching a transport layer in the first context. A context refers to virtualization software, a physical computer, or a combination of virtualization software and physical computer. In response to the interception of the request, the agent requests a decision on whether to allow or deny the network socket event request to be communicated to a security server executing in a second context that is distinct from the first context. The request for a decision includes an identification of the application. The agent then receives from the security server either an allowance or a denial of the network socket event request, the allowance or denial being based at least in part on the identification of the application and a security policy. The agent blocks the network socket event from reaching the transport layer when the denial is received from the security server. In one embodiment, the method is implemented using a machine readable medium embodying software instructions executable by a computer. ## Claims ### Claim 1 A method for enforcing a network policy on an application executing within a first context, the method comprising: intercepting, by an agent executing in the first context, a network socket event request from the application before the network socket event request reaches a transport layer located between a network layer and the application in a network stack of the first context; sending, by the agent to a security server executing in a second context, a request for a decision on whether to allow or deny the intercepted network socket event, the request for the decision including application information comprising a domain of the application; receiving, by the agent, the decision from the security server, the decision being an allowance or a denial of the network socket event request, the decision being based at least in part on the application information; and preventing, by the agent, the network socket request from reaching the transport layer in the first context when the decision is the denial of the network socket event request. ### Claim 2 (depends on 1) The method of claim 1, wherein the request for the decision further includes application information comprising an identification of a user of the application, an application file name, an application executable hash, and an application identifier. ### Claim 3 (depends on 1) The method of claim 1, further comprising: sending the network socket event request from the application in the first context to the transport layer in the first context. ### Claim 4 (depends on 1) The method of claim 1, wherein the request for the decision further includes application information comprising an application file name, an application executable hash, and an application identifier. ### Claim 5 (depends on 1) The method of claim 1, further comprising: collecting statistics about data flow through the network socket of the first context; sending the statistics from the first context, to a data collection module that receives statistics about data flows through multiple network sockets of multiple contexts; and generating a report of the statistics about the data flows through the multiple network sockets of the multiple contexts. ### Claim 6 (depends on 1) The method of claim 1, wherein the network event is any of: opening the network socket, closing the network socket, and listening to the network socket. ### Claim 7 (depends on 1) The method of claim 1, wherein the application identifier is based on at least a process identifier that identifies (i) a process created when an operating system loads and runs an executable file of the application, and (ii) the executable file of the application. ### Claim 8 (depends on 1) The method of claim 1, wherein a transport layer interface located between the transport layer and the application intercepts the network socket event, and the transport layer interface is a Transport Driver Interface. ### Claim 9 (depends on 1) The method of claim 1, wherein the transport layer interface is a layered service provider that allows or blocks network socket event requests and resides above a base transport provider. ### Claim 10 A non-transitory computer-readable medium with computer readable instructions executable by a context, comprising: instructions that perform, intercepting, by an agent executing in the first context, a network socket event request from the application before the network socket event request reaches a transport layer located between a network layer and the application in a network stack of the first context; instructions that perform, sending, by the agent to a security server executing in a second context, a request for a decision on whether to allow or deny the intercepted network socket event, the request for the decision including application information comprising a domain of the application; instructions that perform, receiving, by the agent, the decision from the security server, the decision being an allowance or a denial of the network socket event request, the decision being based at least in part on the application information; and instructions that perform, preventing, by the agent, the network socket request from reaching the transport layer in the first context when the decision is the denial of the network socket event request. ### Claim 11 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the application identifier is based on data received from an interface of the transport on the first context. ### Claim 12 (depends on 10) The non-transitory computer-readable medium of claim 10, further comprising: instructions sending the network socket event request from the application in the first context to the transport layer in the first context. ### Claim 13 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the security module makes decisions on whether to allow or deny network socket events in multiple contexts. ### Claim 14 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the network event is any of: opening the network socket, closing the network socket, and listening to the network socket. ### Claim 15 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the transport layer interface is a layered service provider that allows or blocks network socket event requests and resides above a base transport provider. ### Claim 16 (depends on 12) The non-transitory computer-readable medium of claim 12, further comprising: instructions collecting statistics about data flow through the network socket of the first context; and instructions sending the statistics from the first context, to a data collection module that receives statistics about data flows through multiple network sockets of multiple contexts; and instructions generating a report of the statistics about the data flows through the multiple network sockets of the multiple contexts. ### Claim 17 A computer system, comprising: an agent executing in a context; a security server executing in a second context; a firewall; and a processor and memory with the context, the context executing: instructions that perform, receiving, by the security server, a request from the for a decision on whether to allow or deny a network socket event request from an application, the network socket event request being intercepted by the agent before the network socket event request reaches a transport layer located between a network layer and the application in a network stack of the context, the request for the decision including application information comprising a domain of the application; and instructions that perform, sending, by the security server, the decision to the firewall that enforces the decision, the decision being an allowance or a denial of the network socket event request, the decision being based at least in part on the application information, and wherein the denial prevents the network socket request from reaching the transport layer in the context. ### Claim 18 (depends on 17) The system of claim 17, wherein the application information comprises an identification of a user of the application, an application file name, an application executable hash, and an application identifier. ### Claim 19 (depends on 17) The system of claim 17, wherein the context further executes instructions that perform sending the network socket event request from the application in the context to the transport layer in the context. ### Claim 20 (depends on 17) The system of claim 17, wherein the transport layer interface is a layered service provider that allows or blocks network socket event requests and resides above a base transport provider.