# US 12,192,173 B2 · Network traffic inspection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,173 B2 - Document ID: US12192173B2 - Status: Granted - Kind: B2 - Application number: 18/595,155 - Filed: 2024-03-04 - Published: 2024-06-27 - Granted: 2025-01-07 - Earliest claimed: 2017-10-06 - Assignees: Barracuda Networks, Inc. - Applicants: Barracuda Networks, Inc. - Inventors: Pablo German Sole; Jose Luis Ferras Pereira; Sinan Eren; Luisa Marina Moya Praca de Araujo Lima - Web page: https://patentgrep.com/patent/US12192173B2 ## CPC - G06F 21/554: {involving event detection and direct action} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - G06F 21/552: {involving long-term monitoring or reporting} - H04L 63/0272: {Virtual private networks} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/12: Detection or prevention of fraud - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Network traffic inspection is disclosed. An application executing on a client device as an operating system that uses a virtual private network (VPN) stack of the operating system intercepts a first IP packet. The application determines that a policy should be applied to the intercepted first IP packet. The policy is applied to the intercepted first IP packet. ## Claims ### Claim 1 A client device, comprising: a processor with an operating system running on the client device; and a memory coupled to the processor and configured to provide the processor with instructions, wherein the processor is configured to: install a security application as an operating system extension on the client device, wherein the security application accesses network traffic of a system while executing in a non-privileged sandboxed process controlled by the operating system; wherein an application running on the client device initiates a Domain Name System (DNS) packet request for a remote computer external to the client device, wherein the security application running on the client device is configured to: intercept the DNS packet request; create a first internet protocol (IP) stack between the application running on the client device and the security application; create a second IP stack between the security application and the remote computer; analyze a plurality of packets of the network traffic and determine whether at least one or more packets of the plurality of packets pose a security threat; and responsive to determining that the at least one or more packets of the plurality of packets pose a security threat, prevent the at least one or more packets of the plurality of packets from being transmitted. ### Claim 2 (depends on 1) The client device of claim 1, wherein the operating system extension is a network extension service. ### Claim 3 (depends on 2) The client device of claim 2, wherein the network extension service includes an application programming interface (API) for customizing and extending network features of the operating system. ### Claim 4 (depends on 1) The client device of claim 1, wherein the security application is initialized each time that the operating system is initialized. ### Claim 5 (depends on 1) The client device of claim 1, wherein the security application is executed in a sandboxed process and wherein access to resources of the client device is controlled by the operating system. ### Claim 6 (depends on 1) The client device of claim 1, wherein the security application is configured to passthrough the plurality of packets between the client device and the remote computer in response to determining that the at least one or more packets of the plurality of packets pose no security threat and wherein the security application is configured to prevent the at least one or more packets of the plurality of packets from being transmitted in response to determining that the at least one or more packets pose a security threat. ### Claim 7 (depends on 1) The client device of claim 1, wherein the security application replicates an IP stack functionality of a kernel in the security application. ### Claim 8 (depends on 7) The client device of claim 7, wherein the kernel is configured to transmit packets to the security application. ### Claim 9 (depends on 1) The client device of claim 1, wherein the security application parses the DNS packet request and creates a socket to the remote computer based on the parsed DNS packet request. ### Claim 10 (depends on 1) The client device of claim 1, wherein the security application is configured to determine whether the DNS query appears on a blacklist and in response to determining that the DNS query appearing on the blacklist preventing the at least one or more packets from being transmitted. ### Claim 11 (depends on 10) The client device of claim 10, wherein the processor is further configured to generate an alert that a user of the client device was protected from accessing a site included on the blacklist. ### Claim 12 (depends on 11) The client device of claim 11, wherein the processor is further configured to receive a set of exceptions that override the blacklist. ### Claim 13 (depends on 1) The client device of claim 1, wherein the security application is a proxy and wherein the security application performs at least one or more policy enforcement associated with network traffic. ### Claim 14 (depends on 13) The client device of claim 13, wherein the at least one or more policy enforcement is role-based access control and attribute-based access control. ### Claim 15 (depends on 13) The client device of claim 13, wherein the security application receives a resource identifier that the client device is requesting connection to, a port that the client device is attempting to connect to, and an identifier for the client device. ### Claim 16 (depends on 15) The client device of claim 15, wherein the proxy sends a proxy identifier to the client device before obtaining a client certificate and wherein the client device is configured to send the client certificate in response to the determining that the proxy identifier is correct. ### Claim 17 A method, comprising: installing a security application as an operating system extension on a client device; accessing network traffic of a system while executing in a non-privileged sandboxed process controlled by the operating system; initiating a Domain Name System (DNS) packet request for a remote computer external to the client device; intercepting the DNS packet request by the security application running on the client device; creating a first internet protocol (IP) stack between an application running on the client device and the security application using the security application; and creating a second IP stack between the security application and the remote computer using the security application; analyzing a plurality of packets of the network traffic to determine whether at least one or more packets of the plurality of packets pose a security threat; and responsive to determining that the at least one or more packets of the plurality of packets pose a security threat, preventing the at least one or more packets of the plurality of packets from being transmitted. ### Claim 18 A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for: installing a security application as an operating system extension on a client device; accessing network traffic of a system while executing in a non-privileged sandboxed process controlled by an operating system; initiating a Domain Name System (DNS) packet request for a remote computer external to the client device; intercepting the DNS packet request by the security application running on the client device; creating a first internet protocol (IP) stack between an application running on the client device and the security application using the security application; and creating a second IP stack between the security application and the remote computer using the security application; analyzing a plurality of packets of the network traffic to determine whether at least one or more packets of the plurality of packets pose a security threat; and responsive to determining that at least one or more packets of the plurality of packets pose a security threat, preventing the at least one or more packets of the plurality of packets from being transmitted.