Back to results
US 12,192,173 B2Granted
Network traffic inspection
AssigneeBarracuda Networks, Inc.
InventorsPablo German Sole, Jose Luis Ferras Pereira, Sinan Eren, Luisa Marina Moya Praca de Araujo Lima
Life of this patent
Estimating the term…
Abstract
Network traffic inspection is disclosed. An application executing on a client device as an operating system that uses a virtual private network (VPN) stack of the operating system intercepts a first IP packet. The application determines that a policy should be applied to the intercepted first IP packet. The policy is applied to the intercepted first IP packet.
Claims18
A client device, comprising:
- a processor with an operating system running on the client device;
- and
- a memory coupled to the processor and configured to provide the processor with instructions,
- wherein the processor is configured to:
- install a security application as an operating system extension on the client device, wherein the security application accesses network traffic of a system while executing in a non-privileged sandboxed process controlled by the operating system;
- wherein an application running on the client device initiates a Domain Name System (DNS) packet request for a remote computer external to the client device,
- wherein the security application running on the client device is configured to:
- intercept the DNS packet request;
- create a first internet protocol (IP) stack between the application running on the client device and the security application;
- create a second IP stack between the security application and the remote computer;
- analyze a plurality of packets of the network traffic and determine whether at least one or more packets of the plurality of packets pose a security threat;
- and
- responsive to determining that the at least one or more packets of the plurality of packets pose a security threat, prevent the at least one or more packets of the plurality of packets from being transmitted.
10 more elements
A method, comprising:
- installing a security application as an operating system extension on a client device;
- accessing network traffic of a system while executing in a non-privileged sandboxed process controlled by the operating system;
- initiating a Domain Name System (DNS) packet request for a remote computer external to the client device;
- intercepting the DNS packet request by the security application running on the client device;
- creating a first internet protocol (IP) stack between an application running on the client device and the security application using the security application;
- and
- creating a second IP stack between the security application and the remote computer using the security application;
- analyzing a plurality of packets of the network traffic to determine whether at least one or more packets of the plurality of packets pose a security threat;
- and
- responsive to determining that the at least one or more packets of the plurality of packets pose a security threat, preventing the at least one or more packets of the plurality of packets from being transmitted.
7 more elements
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- installing a security application as an operating system extension on a client device;
- accessing network traffic of a system while executing in a non-privileged sandboxed process controlled by an operating system;
- initiating a Domain Name System (DNS) packet request for a remote computer external to the client device;
- intercepting the DNS packet request by the security application running on the client device;
- creating a first internet protocol (IP) stack between an application running on the client device and the security application using the security application;
- and
- creating a second IP stack between the security application and the remote computer using the security application;
- analyzing a plurality of packets of the network traffic to determine whether at least one or more packets of the plurality of packets pose a security threat;
- and
- responsive to determining that at least one or more packets of the plurality of packets pose a security threat, preventing the at least one or more packets of the plurality of packets from being transmitted.
7 more elements
Dependencies are inferred from the claim text.