Back to results
US 10,757,074 B2Granted
Packet classification for network routing
AssigneePalo Alto Networks, Inc.
InventorsNir Zuk, Marc Joseph Benoit
Life of this patent
Estimating the term…
Abstract
Techniques for packet classification for network routing are disclosed. In some embodiments, packet classification for network routing includes receiving packets associated with a new flow at a security controller from a network device, in which the network device performs packet forwarding; classifying the flow; and determining an action for the flow based on a policy (e.g., a security policy). In some embodiments, the network device is a Software Defined Network (SDN) network device (e.g., a packet forwarding device that supports the OpenFlow protocol or another protocol).
Claims16
A system for a security controller that performs packet classification for network routing, comprising:
- a processor configured to:
- receive packets associated with a new flow from a network device, wherein the network device performs packet forwarding;
- classify the flow, comprising to:
- determine application associated with the flow, comprising to:
- determine type of traffic related to the flow, the type of traffic including HTTP traffic, HTTPS traffic, FTP traffic, SSL traffic, SSH traffic, DNS requests, unclassified application traffic, or any combination thereof;
- and
- perform application signature matching based on the type of traffic to determine the application;
- and
- determine user associated with the flow, comprising to:
- extract username, password, or a combination thereof being submitted to an external site from the received packets to determine the user;
- determine an action for the flow based on a policy;
- instruct the network device to perform the action for the flow;
- and
- in the event that the action is to shunt the flow, receive additional packets associated with the flow from the network device, wherein the security controller performs further classification of the flow, wherein an application associated with the additional packets is different from the application associated with the flow, wherein a type of traffic related to the additional packets matches the type of traffic related to the packets associated with the flow, and wherein the shunted flow is determined to be a flow that is to be ignored or dropped based on the further classification;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
13 more elements
A method of a security controller that performs packet classification for network routing, comprising:
- receiving packets associated with a new flow at the security controller from a network device, wherein the network device performs packet forwarding;
- classifying the flow using a processor of the security controller that performs packet classification for network routing, comprising:
- determining application associated with the flow, comprising:
- determining type of traffic related to the flow, the type of traffic including HTTP traffic, HTTPS traffic, FTP traffic, SSL traffic, SSH traffic, DNS requests, unclassified application traffic, or any combination thereof;
- and
- performing application signature matching based on the type of traffic to determine the application;
- and
- determining user associated with the flow, comprising:
- extracting username, password, or a combination thereof being submitted to an external site from the received packets to determine the user;
- determining an action for the flow based on a policy;
- instructing the network device to perform the action for the flow;
- and
- in the event that the action is to shunt the flow, receiving additional packets associated with the flow from the network device, wherein the security controller performs further classification of the flow, wherein an application associated with the additional packets is different from the application associated with the flow, wherein a type of traffic related to the additional packets matches the type of traffic related to the packets associated with the flow, and wherein the shunted flow is determined to be a flow that is to be ignored or dropped based on the further classification.
10 more elements
A computer program product for a security controller that performs packet classification for network routing, the computer program product being embodied in a tangible, non-transitory computer readable storage medium and comprising computer instructions for:
- receiving packets associated with a new flow at the security controller from a network device, wherein the network device performs packet forwarding;
- classifying the flow, comprising:
- determining application associated with the flow, comprising:
- determining type of traffic related to the flow, the type of traffic including HTTP traffic, HTTPS traffic, FTP traffic, SSL traffic, SSH traffic, DNS requests, unclassified application traffic, or any combination thereof;
- and
- performing application signature matching based on the type of traffic to determine the application;
- and
- determining user associated with the flow, comprising:
- extracting username, password, or a combination thereof being submitted to an external site from the received packets to determine the user;
- determining an action for the flow based on a policy;
- instructing the network device to perform the action for the flow;
- and
- in the event that the action is to shunt the flow, receiving additional packets associated with the flow from the network device, wherein the security controller performs further classification of the flow, wherein an application associated with the additional packets is different from the application associated with the flow, wherein a type of traffic related to the additional packets matches the type of traffic related to the packets associated with the flow, and wherein the shunted flow is determined to be a flow that is to be ignored or dropped based on the further classification.
10 more elements
Dependencies are inferred from the claim text.