Transparent packet inspection for last mile zero trust workload protection

Abstract

The invention relates to transparent packet inspection for last mile zero trust workload protection. Systems, apparatus, methods, and computer readable media are disclosed for policy-based transparent packet inspection for last mile zero trust workload protection. The method comprises receiving a packet on a network interface of provisioning resources in a user equipment or data center within a network; determining, by a first interception agent provided within a network interface comprising a Smart Network Interface Card (SmartNIC) or a Data Processing Unit (DPU) and configured with the first interception agent based on a control plane of the network, whether the packet is to be checked based on a rule received from the control plane of the network; selectively invoking a deep packet check of the packet based on a check of the packet by the first interception agent using rules from the control plane; and identifying malicious content within the packet based on the deep packet check, the packet being blocked at the network interface.

Description

[0001] Cross-reference to related applications

[0002] This application claims the benefit of U.S. Provisional Application No. 63 / 631,910, filed April 9, 2024, entitled “POLICY-BASED TRANSPARENT PACKET INSPECTION FOR LAST MILE ZERO-TRUST WORKLOAD PROTECTION,” which is hereby expressly incorporated by reference in its entirety. Technical Field

[0003] The present disclosure relates generally to cloud networking and, more particularly, but not exclusively, to systems and techniques for policy-based transparent packet inspection for last-mile zero-trust workload protection. Background Art

[0004] Traditional networks implicitly assume that all malicious actors are denied access, and devices within the internal network are implicitly trusted. Perimeter-based security models assume a clear boundary between the trusted internal network and the untrusted outside world, but this boundary is no longer realistic due to the widespread use of cloud services, mobile devices, and remote work. These developments mean that data and access points are dispersed beyond the traditional network perimeter, making it difficult to effectively implement security controls. Furthermore, network threats have evolved significantly and can often bypass perimeter defenses through tactics such as phishing, social engineering, and in-network vulnerability exploitation. Once inside, these threats can move laterally with little resistance, as internal network segments are often less well-defended. Summary of the Invention

[0005] According to one aspect of the present disclosure, a method for policy-based transparent packet inspection for last-mile zero-trust workload protection is provided, comprising: receiving a packet on a network interface of a user device within a network or a configured resource in a data center; determining, by a first interception agent configured within the network interface, whether to inspect the packet based on a rule received from a control plane of the network, wherein the network interface comprises a smart network interface card (SmartNIC) or a data processing unit (DPU) and is configured with the first interception agent based on the control plane; selectively calling deep packet inspection of the packet based on inspection of the packet by the first interception agent using the rule from the control plane; and identifying malicious content within the packet based on the deep packet inspection, blocking the packet at the network interface.

[0006] According to one aspect of the present disclosure, a computing device is provided, comprising: a network device configured to: receive a packet on a network device within a network; determine, by a first interception agent provided within the network device, whether to inspect the packet based on a rule received from a control plane of the network, wherein the network device comprises a smart network interface card (SmartNIC) or a data processing unit (DPU) and is configured with the first interception agent based on the control plane; selectively call a deep packet inspection of the packet based on the inspection of the packet by the first interception agent using the rule from the control plane; and identify malicious content within the packet based on the deep packet inspection, and block the packet at the network device. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] To illustrate the manner in which the above and other advantages and features of the present disclosure can be obtained, a more particular description of the principles briefly described above will be given by reference to specific embodiments thereof as illustrated in the accompanying drawings. Understanding that these drawings depict only exemplary embodiments of the present disclosure and are therefore not to be considered limiting of its scope, the principles herein will be described and explained in more detail and detail through the use of the accompanying drawings, in which:

[0008] Figure 1 An example of a network using a firewall to protect client devices within the network that consume network functionality is illustrated;

[0009] Figure 2 is a block diagram of a transparent endpoint protection service that protects client devices according to some aspects of the present disclosure;

[0010] Figure 3 is a conceptual diagram of a logical space associated with a client device according to some aspects of the present disclosure;

[0011] Figure 4A is a conceptual diagram of a client device using a transparent endpoint protection service according to some aspects of the present disclosure;

[0012] Figure 4B is a conceptual diagram of a client device using a transparent endpoint protection service for inter-process protection according to aspects of the present disclosure;

[0013] Figure 4C is a conceptual diagram of a client device utilizing a transparent endpoint protection service that performs selective deep packet inspection in accordance with aspects of the present disclosure;

[0014] Figure 4D is a conceptual diagram of a client device using a transparent endpoint protection service for call events according to some aspects of the present disclosure;

[0015] Figure 5is a conceptual diagram of a transparent endpoint protection service for encoding metadata between endpoint tunnels according to some aspects of the present disclosure;

[0016] Figure 6 is a conceptual diagram of a transparent endpoint protection service for encoding metadata between a client device and a remote access headend according to aspects of the present disclosure;

[0017] Figure 7 illustrates an example method for transparent endpoint protection services according to some aspects of the present disclosure; and

[0018] Figure 8 An example of a computing system is shown, which may be, for example, any computing device capable of implementing the components of the system. DETAILED DESCRIPTION

[0019] Various embodiments of the present disclosure are discussed in detail below. Although specific implementations are discussed, it should be understood that this is done for illustrative purposes only. Those skilled in the relevant art will recognize that other components and configurations may be used without departing from the spirit and scope of the present disclosure. Thus, the following description and drawings are illustrative and should not be construed as restrictive. Many specific details are described to provide a thorough understanding of the present disclosure. However, in some cases, well-known or conventional details are not described to avoid obscuring the description. References to an embodiment or an embodiment in the present disclosure may be references to the same embodiment or any embodiment; and, such references refer to at least one embodiment.

[0020] Reference to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present disclosure. The appearances of the phrase "in one embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. Furthermore, various features are described that some embodiments may exhibit and others may not.

[0021] The terms used in this specification generally have their ordinary meaning in the art within the disclosed context and within the specific context in which each term is used. Alternative language and synonyms may be used for any one or more terms discussed herein, without assigning special significance to whether a term is elaborated or discussed herein. In some cases, synonyms for certain terms are provided. The inclusion of one or more synonyms does not exclude the use of other synonyms. The examples used anywhere in this specification, including the examples of any term discussed herein, are illustrative only and are not intended to further limit the scope and meaning of the disclosure or any illustrative term. Similarly, the disclosure is not limited to the various embodiments provided in this specification.

[0022] Without intending to limit the scope of the present disclosure, examples of instruments, devices, methods and related results thereof according to embodiments of the present disclosure are provided below. Note that, for the convenience of the reader, titles or subtitles may be used in the examples, which should in no way limit the scope of the present disclosure. Unless otherwise defined, the technical and scientific terms used herein have the same meaning as those generally understood by those of ordinary skill in the art to which the present disclosure belongs. In the event of a conflict, this document (including definitions) will be used as the basis.

[0023] Additional features and advantages of the present disclosure will be described in the following description and in part will be apparent from the description, or may be learned by practice of the principles disclosed herein. The features and advantages of the present disclosure may be realized and obtained by means of the means and combinations particularly pointed out in the appended claims. These and other features of the present disclosure will become more fully apparent from the following description and the appended claims, or may be learned by practice of the principles disclosed herein.

[0024] Overview

[0025] Zero Trust networking, a modern cybersecurity technology, addresses the evolving threat landscape and the shortcomings of traditional perimeter-based security models. Zero Trust assumes that threats can exist both outside and inside the network and requires continuous authentication of every user and device attempting to access network resources, minimizing the risk of unauthorized access, data breaches, and data loss. Zero Trust networking doesn't completely abandon perimeter-based security models, as firewalls prevent unauthorized ingress of network data. For example, they block unauthorized access, malware, and other cyberthreats that could exploit devices as entry points into the network. The lack of a firewall on client devices can undermine the Zero Trust principles of continuous authentication and strict access control by allowing potential attackers to circumvent security policies designed to protect sensitive data and network resources. Furthermore, some attacks can originate from within the device itself, exposing data based on open process identifiers and ports within the device itself, creating additional entry points for malicious actors.

[0026] This document describes systems, apparatus, processes (also referred to as methods), and computer-readable media (collectively, "systems and techniques") to enable transparent last-mile zero-trust workload protection, thereby using a control plane to protect endpoints from within the network. In one aspect, an interception agent (e.g., also referred to as an interceptor) is transparently configured and injected into a network interface. For example, some network interfaces may include programmable hardware or software functions to offload various processes, such as cryptographic functions.

[0027] An example method includes receiving a packet on a network interface of a user device within a network or a resource configured in a data center, and determining whether to inspect the packet by a first interception agent configured within the network interface based on rules received from a control plane of the network. The network interface includes a smart network interface card (SmartNIC) or a data processing unit (DPU) and is configured with the first interception agent based on the control plane. The method also includes selectively invoking deep packet inspection of the packet based on inspection of the packet by the first interception agent using rules from the control plane; and identifying malicious content within the packet based on the deep packet inspection, blocking the packet at the network interface.

[0028] Intercepting agents can be inserted into such network devices (also known as network interfaces) based on administrative control and supplemented with policies at runtime, allowing network administrators to improve the security of endpoint devices without users being aware of them. In addition, third-party security services can provide information notifications that are then provided to endpoint user devices autonomously or semi-autonomously with minimal delay.

[0029] Additionally, these systems and technologies can optionally configure endpoint devices for deep packet inspection, providing a multi-layered approach to security at the device, along with additional capabilities such as logging, event generation, and other security best practices.

[0030] Various aspects of the application will be described with reference to the accompanying drawings.

[0031] Example Embodiments

[0032] Figure 1 An example of a network 100 that uses a firewall to protect client devices within the network that consume network functions is shown. In a traditional network (such as network 100), endpoint devices 102 that consume network functions (e.g., send and receive data) are generally trusted and can access and send data. Network devices 104 that provide networking functions and services to endpoint devices 102 implicitly trust each device within the network based on the ability to send and receive data at the edge of the private network through firewall 106, which then forwards the data into network 110.

[0033] If the endpoint device 102 is compromised, the endpoint device 102 may collect information and attempt to transmit data to malicious actors through the firewall 106. The firewall 106 may attempt to block this traffic using data loss prevention (DLP) technology. The endpoint device 102 may also attack other devices within the network by disrupting traffic, identifying vulnerabilities, or other types of malicious attacks. DLP at the endpoint device is critical to protecting sensitive information from unauthorized access and leakage. By implementing a DLP solution on the endpoint device, an organization can monitor, detect, and control the movement of confidential data to ensure it is not exposed or inappropriately transmitted. This protection is crucial because endpoint devices such as laptops, smartphones, and tablets are often vulnerable entry points for cyberattacks and data breaches. Effective DLP measures help enforce data security policies, prevent accidental or malicious data leakage, and maintain compliance with regulatory requirements, thereby ensuring the safety of assets and protecting their reputation.

[0034] Figure 2 is a block diagram of a transparent endpoint protection service for protecting a device 200 according to some aspects of the present disclosure. In some aspects, the device is an endpoint that originates network traffic or a destination for network traffic, such as client devices (e.g., laptops, phones, etc.) and servers (e.g., container services such as Kubernetes, etc.).

[0035] The device 200 includes a processor 202 configured to execute software instructions, a memory 204 configured to store content (e.g., instructions, data, etc.), a network interface 206, and an interface 208 (e.g., a device interface such as a universal serial bus). In some aspects, the network interface 206 may include a hardware component for executing the interceptor 210. For example, the network interface 206 can be a smart network interface card (SmartNIC) or a data processing unit (DPU), which are network components designed to enhance performance by offloading and accelerating specific network and data processing tasks. SmartNICs integrate dedicated processing capabilities into network cards to handle tasks and network functions (e.g., compression) directly on the network interface to reduce the workload of the processor 202. In some aspects, a DPU is a highly programmable processor designed to manage data-centric operations such as packet processing, security, and storage management. SmartNICs and DPUs may include field-programmable gate arrays (FPGAs) or system-on-a-chip (SoC) architectures to enable efficient processing of complex data tasks and improve overall system efficiency and performance.

[0036] Interceptor 210 can be transparently injected into network interface 206 to capture and process all packets from network 212. In some cases, control plane 220 (e.g., a control device within an internal network) can transparently inject interceptor 210 into network interface 206.

[0037] The interceptor 210 is configured to perform the required security checks based on the configured policies from the control plane 220. Based on the provided policies, packets can be blocked, forwarded to an inspection engine, and / or logged. For example, an interception agent can be attached to a socket to transparently intercept messages on that socket. Because the interceptor 210 executes separately from the processor 202, the user of the device 200 will not experience any processing speed reduction or memory consumption caused by a separate software-based protection service. The user will also not be aware of any updates, changes, etc. because the system administrator or other protection services can use the control plane 220 to autonomously deploy policies to the interceptor 210.

[0038] The control plane 220 is controlled by the administrator based on a dynamic security posture. For example, various third-party services can issue security guidance, and the control plane 220 can issue policies in response to the security guidance. Security guidance can be vendor-specific, such as identifying flaws in an operating system or service, but can also be regional guidance for different types of services or sources of network traffic. Third-party security vendors may provide guidance related to different types of network traffic, which is based on massive analysis of network data and indicates malicious attacks against specific targets or services, allowing administrators to dynamically shift security posture based on the recommendations of third-party security vendors. The control plane 220 can transparently provide these policies to endpoints, thereby providing a higher level of security posture without user intervention.

[0039] Figure 3 is a conceptual diagram of a logical space associated with a client device according to some aspects of the present disclosure. Specifically, Figure 3 The diagram shows that user space 300 and kernel space 310 are separated by a logical barrier to isolate applications and system resources for security and system purposes. Specifically, Figure 3 The diagram shows that data from user space 300 and kernel space 310 are mapped into physical memory 350. The physical memory may be implemented by any suitable random access memory (RAM), such as static RAM (SRAM) or synchronous dynamic RAM (SDRAM).

[0040] Modern operating systems can implement virtual memory (VM), which collects and manages memory from a series of memory devices (for example, non-volatile hard disks or other non-RAM storage media to provide additional program memory) to create virtual memory, protected memory, and shared memory. Virtual memory is the collection of all memory, protected memory provides exclusive access to memory areas allocated to a process, and shared memory provides cooperative access to areas shared by multiple processes.

[0041] exist Figure 3 In the example shown, multiple applications 302 execute in user space 300 and can call application programming interfaces (APIs) 304 or can use a common language runtime (CLR) (e.g., Java, C#, WebAssembly) in kernel space to access kernel subsystems 312. The CLR API 304 can implement logic for managing the heap, which is a dynamically sized memory that changes during runtime (e.g., as the application executes).

[0042] The kernel subsystem 312 also provides access to hardware devices. For example, the application 302 includes instructions to use the API 304 to perform a network request, and the API 304 provides appropriate instructions to the device driver 314 to perform the network request using the device 316. For example, the device 316 can be a network interface to perform a Hypertext Protocol (HTTP) GET request for specific data (e.g., a request to retrieve a web page).

[0043] In some cases, application 302 may implement heap management functionality and interact directly with kernel subsystem 312 without API 304. Although not illustrated, such application 302 may selectively operate with API 304 to perform some functionality (e.g., interaction with device 316) but omit other aspects (e.g., heap management).

[0044] Kernel subsystem 312 handles management of physical memory 350 and performs access (eg, read / write) functions using VM 320. VM 320 includes various components such as a slat allocator, a zone allocator, and a buddy allocator for controlling memory allocation and access.

[0045] Kernel space 310 is controlled by the kernel and is accessible only to the kernel, as it provides all mechanisms for accessing physical memory 350 and storage devices. Various applications 302 store data in user space 300. User space 300 and kernel space 310 are separated to isolate different concerns and provide a security barrier to prevent applications from intentionally or accidentally writing to kernel space 310. VM 320 is an example of a memory management system that manages physical memory and separates application content in user space 300 from system content in kernel space 310. Another OS may implement the memory management subsystem differently, but use similar concepts to provide a layer of system security to prevent applications 302 from being able to access kernel space 310.

[0046] In some cases, the processor and / or the system itself may include additional devices to provide additional layers of security. For example, Figure 3 The processor, not shown in the figure, may include secure registers that are not available for general use and have security precautions. For example, the processor may include a secure configuration register (SCR) that can be programmed with a security score during the boot sequence. Specific hardware components may be configured to calculate a security score during the boot sequence and store the score in the SCR.

[0047] In some aspects, the device 316 may be a SmartNIC or a DPU and execute an interceptor 318 to perform actions from the control plane (e.g., Figure 2 The interceptor 318 may include pattern matching functionality to match source addresses identified by a third-party security vendor as indicative of malicious content or traffic. For example, a user may be using a VPN connection to access an enterprise through their home router, but the router has been compromised due to a vulnerability, and the interceptor 318 may identify and block this traffic.

[0048] Figure 4A Illustrated is an example device 400 for transparent protection of last-mile zero-trust workload protection and security enforcement according to some aspects of the present disclosure.

[0049] The device 400 includes a distributed policy-based transparent packet interceptor 402 for transparent protection of last-mile zero-trust workload protection and security enforcement. The interceptor 402 is transparently injected into an interface, such as a network device including a DPU or SmartNIC, and captures the interface (e.g., Figure 2The interceptor 402 performs the required security checks based on the configured policies. Based on the administrator policy that has been issued (e.g., via the control plane 220), packets can be blocked, forwarded to the inspection engine, and / or logged. In some aspects, the interception agent can be attached to a configured resource (e.g., a SmartNIC or DPU in a data center). For example, the interception agent can be attached to a socket to transparently intercept packets on the socket.

[0050] In some aspects, the appliance 400 provides intelligent and transparent inspection of network traffic as close to a given workload as possible, without burdening the network settings / configuration of the appliance 400 and / or the applications 404. This inspection can be policy-based and come with fast-path support (once traffic is determined to be safe, the inspection process stops and subsequent packets of the same traffic are no longer inspected). In addition, these agents can be used to monitor packets in real time and send copies of the packets to third-party entities for further inspection / monitoring without disrupting the network and preventing them from reaching their intended destination. Events can also be generated based on the monitored traffic (e.g., DNS attacks, etc.).

[0051] In one example, the system includes a distributed, policy-based, transparent packet interceptor for last-mile zero-trust workload protection and security enforcement. The interceptor 402 is transparently injected into the interface and runs within the DPU and SmartNIC (e.g., in the data center) to capture all packets received on the interface and perform the required security checks based on the configured policy.

[0052] Based on network policy, packets can be blocked, forwarded to the inspection engine, and / or logged.

[0053] This differs from existing packet inspection solutions because it is transparently injected into the data path. Users (or applications) are unaware of the inline inspection of packets.

[0054] Figure 4B Illustrated is an example device 420 for transparent protection of last-mile zero-trust workload protection and security enforcement in accordance with some aspects of the present disclosure.

[0055] Device 420 includes a transparent, policy-based packet interceptor 402 within the node for last-mile zero-trust workload protection and security enforcement. Interceptor 402 can be transparently attached to sockets and low-level networking primitives to perform required security checks on traffic between local applications based on configured policies. Based on network policy, packets can be blocked, forwarded to an inspection engine, and / or logged.

[0056] Figure 4C An example device 420 is illustrated for transparent protection of last mile zero trust workload protection and security enforcement in accordance with some aspects of the present disclosure. Device 410 includes an interceptor 402 to inspect local or remote inspection and threat detection using different types of analysis (e.g., fast path support). For example, interceptor 402 can perform fast pattern matching to identify whether a deep packet inspector (DPI) 422 should further inspect a packet. Network traffic can be redirected to DPI 422 without making any changes to application 404 of device 410, and if no threat is detected, the packet is then forwarded to application 404 for regular processing. Interceptor 402 can also transparently intercept all traffic leaving DPI 422. This allows packets to be inspected just before being received by the intended target. Based on network policy, some traffic can bypass inspection entirely, or bypass inspection after a positive decision is made by the threat detection engine.

[0057] Figure 4D Illustrated is an example device 430 for transparent protection of last-mile zero-trust workload protection and security enforcement in accordance with some aspects of the present disclosure.

[0058] Device 430 includes interceptor 402 for transparent, policy-based packet replication for local or remote recording. All traffic or selected packets can be replicated and forwarded to a recorder application for lawful interception, debugging, or threat analysis based on provided policies (e.g., from control plane 220). Recording can occur automatically for all flows or can be triggered based on inspection engine decisions and can be stored in storage 432 for analysis.

[0059] Device 400 can also be configured to transparently generate policy-based traffic-related events. Based on network policy (e.g., from control plane 220), events 434 can be generated to report threats, threshold crossings, incidents, and other activities. For example, these events can be used in conjunction with an event generation system (e.g., Kafka). Event generation can occur automatically for all flows or can be triggered based on inspection engine decisions.

[0060] Figure 5 Illustrated is an example system 500 for transparent protection of last-mile zero-trust workload protection and security enforcement according to some aspects of the present disclosure.

[0061] System 500 includes a first device 510 and a second device 520, each of which includes a transparent inside-out secure connectivity framework that uses an interceptor 512 to protect the last mile connectivity to one or more applications 514. The interceptor 512 is transparently injected into the interfaces (e.g., DPU and SmartNIC) of the first device 510 and the second device 520 to establish a secure connection between the entry point and the target to ensure trusted connectivity between separate nodes.

[0062] System 500 may also include transparent security metadata delivery. The interceptor transparently injects information about the flow (e.g., source IP, user information, entry point information) into the traffic itself for delivery to the inspection engine, regardless of the engine's location. For example, additional information such as authentication tokens and other metadata (e.g., location information such as GPS coordinates) can be used to enforce additional policies such as geo-fencing and tracking.

[0063] The security connectivity framework and security metadata delivery may also be combined together, or may be separate implementations (eg, separate intercepting proxies).

[0064] Figure 6 An example system 600 for transparent protection of last-mile zero-trust workload protection and security enforcement according to some aspects of the present disclosure is illustrated. System 600 includes a first device 610 configured to connect to a head-end system 620, which is a central server or server group that manages and controls access to a network of remote devices or terminals. Head-end system 620 facilitates connections between remote users and computing resources, manages data traffic, ensures security through authentication and encryption, and provides centralized management and monitoring of the network. For example, head-end system 620 is configured to monitor traffic associated with one or more applications 614.

[0065] The first device 610 and the head-end system 620 may include an interceptor 612 to inject additional metadata for various purposes, such as geo-fencing, authentication, and the like. Additional metadata can be dynamically collected based on the interceptor 612, such as collecting location data when a trigger condition is met. The additional metadata can provide additional context and improve various services, such as disabling unnecessary authentication. In some cases, the interceptor 612 can also provide an additional layer of security based on various detected phishing attempts and other malicious activities.

[0066] Figure 7An example method for zero-trust IP address resolution in a cloud service is illustrated. Although the example method 700 depicts a specific sequence of operations, the sequence can be changed without departing from the scope of this disclosure. For example, some of the operations depicted can be performed in parallel or in a different sequence, which will not materially affect the functionality of the method 700. In other examples, different components of the example device or system implementing the method 700 can perform functions at substantially the same time or in a specific sequence. Although a networked device (e.g., using a system on a chip (SoC) or FPGA, etc.) is described as performing the method, this example is for illustrative purposes only.

[0067] At block 702, a network device may receive a packet from a user device within a network or a provisioned resource in a data center. The network interface comprises a smart network interface card (SmartNIC) or a data processing unit (DPU). In some aspects, the network interface may be configured with a first interception agent based on a control plane function (e.g., a management control function). The first interception agent is transparent to the user and, as described above and below, provides zero-trust packet inspection at an endpoint (e.g., a client device, a server) of the network function. An endpoint is a source or destination of a network, not an intervening component (e.g., a router). For example, the first interception agent is configured to inspect traffic within the network originating from an endpoint, from other endpoints, or from network entities.

[0068] At block 704, the network device may determine whether to inspect the packet based on rules received from the control plane of the network via a first interception agent configured within the network interface. In some aspects, the first interception agent is executed within the network interface (e.g., via an FPGA, SoC, etc.) and attached to a socket of the network interface. The first interception agent may also be configured via the control plane. In some aspects, the administrator transparently configures the interception agent without modifying the destination application or the configured application.

[0069] At block 706, the network device can selectively invoke deep packet inspection on the packet based on the first intercept agent's inspection of the packet using rules from the control plane. In some cases, the intercept agent can perform deep packet inspection. In other aspects, the intercept agent can forward the packet to a separate device (e.g., a hardware accelerator) or other network entity for handling inspection.

[0070] As part of block 706, the network device can identify a corresponding flow associated with the packet. That is, if the computing system determines that the packet is associated with an existing flow, then the packet is forwarded without deep packet inspection if it passes the initial inspection within the first interception agent. If the packet passes the inspection and is not associated with a known flow, then the packet is designated for deep packet inspection. If the packet passes the deep packet inspection, the computing system (using the interception agent)

[0071] In some aspects, the network device may also forward a copy of the packet to a data logging system for storing information related to the packet. The copy of the packet may be used for analysis (eg, for threats, etc.).

[0072] In some aspects, the network device may forward a duplicate version of the packet to an event system for triggering downstream effects within a cloud system including a data center.

[0073] In another example, the network device can also use packets to generate events. For example, the network device can update a state associated with a policy based on the first interception agent's inspection of the packet, and invoke an event based on whether the state meets a condition in the policy. For example, the network device can generate events in the event system to trigger various types of network actions.

[0074] At block 708 , the network device may identify malicious content within the packet based on deep packet inspection and block the packet at the network interface.

[0075] At block 710 , the network device may send the packet to a destination application based on identifying benign content within the packet.

[0076] In other aspects, the network device can determine whether a second interception agent is associated with the source of the packet and configure an encrypted network connection between the first interception agent and the second interception agent. In this aspect, the second interception agent can inject metadata into the packet received by the first interception agent. The metadata includes user authentication information, network address information, and application entry point information, which is provided at the network interface to enhance the information provided to the receiving device.

[0077] In another aspect, a network device can be transparently updated during endpoint runtime. For example, the network device can receive a policy update from a control plane and re-launch a first interception agent based on the policy update. For example, the network device can store the policy update in a non-volatile storage medium and re-start the network device with the updated configuration. When the network device is re-initialized based on the policy update, the network interface can pause accepting packets while re-launching the first interception agent.

[0078] In another aspect, the network device can transparently inspect network traffic on a local host interface by attaching an interception proxy to the socket interface. In this case, when the network device detects that a local packet from a first application on the local host interface is being directed to a second application, the network device can inspect the local packet based on rules received from the control plane. The network device can also choose to send the local packet to deep packet inspection, log the data as described above, and so on. In this case, the interception proxy can perform internal traffic inspection to prevent malicious activity within the device itself.

[0079] Figure 8 is a diagram illustrating an example of a system for implementing certain aspects of the present technology. Specifically, Figure 8 An example of a computing system 800 is shown, which may be, for example, any computing device comprising an internal computing system, a remote computing system, a camera, or any component thereof, wherein the components of the system communicate with each other using a connection 805. Connection 805 may be a physical connection using a bus, or a direct connection to processor 810, such as in a chipset architecture. Connection 805 may also be a virtual connection, a networked connection, or a logical connection.

[0080] In some aspects, computing system 800 is a distributed system in which the functionality described in this disclosure can be distributed across a data center, multiple data centers, a peer-to-peer network, etc. In some aspects, one or more of the described system components represent a number of such components, each component performing some or all of the functionality described for that component. In some aspects, a component can be a physical or virtual device.

[0081] The example computing system 800 includes at least one processing unit (central processing unit (CPU) or processor) 810 and connections 805 that couple various system components including system memory 815 (e.g., ROM 820 and RAM 825) to the processor 810. The computing system 800 may include a cache 812 of high-speed memory directly connected to the processor 810, in close proximity to the processor 810, or integrated as part of the processor 810.

[0082] Processor 810 may include any general-purpose processor and hardware or software services, such as services 832, 834, and 836 stored in storage device 830, configured to control processor 810, as well as specialized processors where software instructions are incorporated into the actual processor design. Processor 810 may be a fully independent, self-contained computing system, including multiple cores or processors, buses, memory controllers, caches, etc. Multi-core processors may be symmetric or asymmetric.

[0083] To enable user interaction, the computing system 800 includes an input device 845, which can represent any number of input mechanisms, such as a microphone for voice, a touch-sensitive screen for gesture or graphical input, a keyboard, a mouse, motion input, voice, and the like. The computing system 800 can also include an output device 835, which can be one or more of several output mechanisms. In some cases, a multimodal system can enable a user to provide multiple types of input / output to communicate with the computing system 800. The computing system 800 can include a communication interface 840, which can generally govern and manage user input and system output. The communication interface can use wired and / or wireless transceivers to perform or facilitate the reception and / or transmission of wired or wireless communications, including communications utilizing the following: audio jacks / plugs, microphone jacks / plugs, universal serial bus (USB) ports / plugs, Ports / plugs, Ethernet ports / plugs, fiber optic ports / plugs, dedicated wired ports / plugs, Wireless signal transmission, BLE wireless signal transmission, Wireless signal transmission, RFID wireless signal transmission, near-field communication (NFC) wireless signal transmission, dedicated short range communication (DSRC) wireless signal transmission, 802.11 WiFi wireless signal transmission, WLAN signal transmission, visible light communication (VLC), Worldwide Interoperability for Microwave Access (WiMAX), IR communication wireless signal transmission, Public Switched Telephone Network (PSTN) signal transmission, Integrated Services Digital Network (ISDN) signal transmission, 3G / 4G / 5G / LTE cellular data network wireless signal transmission, ad hoc network signal transmission, radio wave signal transmission, microwave signal transmission, infrared signal transmission, visible light signal transmission, ultraviolet light signal transmission, wireless signal transmission along the electromagnetic spectrum, or some combination of the above. The communication interface 840 may also include one or more Global Navigation Satellite System (GNSS) receivers or transceivers for determining the location of the computing system 800 based on one or more signals received from one or more satellites associated with one or more GNSS systems. GNSS systems include, but are not limited to, the US-based GPS, the Russian-based Global Navigation Satellite System (GLONASS), the Chinese-based BeiDou Navigation Satellite System (BDS), and the European-based Galileo GNSS. There is no restriction on operating on any particular hardware arrangement, so the basic features herein can be easily replaced by improved hardware or firmware arrangements as they are developed.

[0084] The storage device 830 may be a non-volatile and / or non-transitory and / or computer-readable memory device and may be a hard disk or other type of computer-readable medium that can store computer-accessible data, such as a magnetic cassette, a flash memory card, a solid-state memory device, a digital versatile disk, a magnetic cassette, a floppy disk, a flexible disk, a hard disk, a magnetic tape, a magnetic stripe / strip, any other magnetic storage medium, flash memory, a memristor memory, any other solid-state memory, a compact disc read only memory (CD-ROM), a rewritable compact disc (CD), a digital video disc (DVD), a Blu-ray disc (BDD), a holographic disc, other optical media, a secure digital (SD) card, a micro secure digital (microSD) card, a memory card, a 32-bit CMOS chip, a 4K optical disc, a 10-bit CMOS chip, a 10-bit CMOS chip, a 10-bit CMOS chip, a 4K optical disc, a 5-bit CMOS chip, a 10-bit CMOS chip, a 5 ... card, smart card chip, EMV chip, subscriber identity module (SIM) card, pocket / micro / nano / pico SIM card, other IC chip / card, RAM, static RAM (SRAM), dynamic RAM (DRAM), ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash EPROM, cache memory (L1 / L2 / L3 / L4 / L5 / L#), resistive random-access memory (RRAM / ReRAM), phase change memory (PCM), spin transfer torque RAM (STT-RAM), other memory chips or memory cartridges, and / or combinations thereof.

[0085] The storage device 830 may include software services, servers, services, etc. that, when the code defining such software is executed by the processor 810, enable the system to perform a function. In some aspects, a hardware service that performs a particular function may include a software component stored in a computer-readable medium that, in conjunction with the necessary hardware components such as the processor 810, the connection 805, the output device 835, etc., performs that function. The term "computer-readable medium" includes, but is not limited to, portable or non-portable storage devices, optical storage devices, and various other media capable of storing, containing, or carrying (one or more) instructions and / or data. Computer-readable media may include non-transitory media in which data may be stored, but does not include carrier waves and / or transient electronic signals propagated wirelessly or over a wired connection. Examples of non-transitory media may include, but are not limited to, disks or tapes, optical storage media such as CDs or DVDs, flash memory, memory, or storage devices. Computer readable media may store code and / or machine executable instructions that may represent any combination of a process, function, subroutine, program, routine, subroutine, module, software package, class, or instruction, data structure, or program statement. A code segment may be coupled to another code segment or hardware circuit by transmitting and / or receiving information, data, parameters, arguments, or memory contents. Information, parameters, arguments, data, etc. may be delivered, forwarded, or transmitted via any appropriate means, including memory sharing, message passing, token passing, network transmission, or the like.

[0086] In some examples, the processes described herein (e.g., method 700, and / or other processes described herein) can be performed by a computing device or apparatus. In one example, method 700 can be performed by a computer having Figure 8 The computing architecture of the computing system 800 shown in FIG. 8 is implemented by a computing device.

[0087] In some cases, a computing device or apparatus may include various components, such as one or more input devices, one or more output devices, one or more processors, one or more microprocessors, one or more microcomputers, one or more cameras, one or more sensors, and / or other component(s) configured to perform the steps of the processes described herein. In some examples, a computing device may include a display, one or more network interfaces configured to communicate and / or receive data, any combination thereof, and / or other component(s). The one or more network interfaces may be configured to communicate and / or receive wired and / or wireless data, including data according to 3G, 4G, 5G, and / or other cellular standards, data according to Wi-Fi (802.11x), data according to Bluetooth TM Standard data, data according to IP standards, and / or other types of data.

[0088] Components of a computing device may be implemented using circuitry. For example, a component may include and / or be implemented using electronic circuitry or other electronic hardware, which may include one or more programmable electronic circuits (e.g., a microprocessor, a graphics processing unit (GPU), a digital signal processor (DSP), a CPU, and / or other suitable electronic circuitry), and / or may include and / or be implemented using computer software, firmware, or any combination thereof to perform the various operations described herein.

[0089] In some aspects, computer-readable storage devices, media, and memories may include wired or wireless signals containing bit streams, etc. However, when referred to, non-transitory computer-readable storage media expressly excludes media such as energy, carrier signals, electromagnetic waves, and signals themselves.

[0090] Specific details are provided in the above description so that the aspects and examples provided herein are thoroughly understood. However, it will be understood by those skilled in the art that various aspects can be implemented without these specific details. For clarity of explanation, in some cases, the present technology may be presented as individual functional blocks, including functional blocks consisting of devices, device components, steps or routines in methods embodied in software, or a combination of hardware and software. In addition to those components shown in the accompanying drawings and / or described herein, other additional components may also be used. For example, circuits, systems, networks, processes, and other components may be shown as components in block diagram form to avoid obscuring these aspects with unnecessary details. In other cases, known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary details to avoid obscuring various aspects.

[0091] Individual aspects may be described above as processes or methods, which are depicted as flow charts, job diagrams, data flow diagrams, structure diagrams, or block diagrams. Although a flow chart may describe operations as a sequential process, many operations may be performed in parallel or simultaneously. Furthermore, the order of operations may be rearranged. A process terminates when its operations are completed, but may have additional steps not included in the diagram. A process may correspond to a method, function, process, subroutine, subprogram, or the like. When a process corresponds to a function, its termination may correspond to the function returning to the calling function or the main function.

[0092] The processes and methods according to the above examples can be implemented using computer-executable instructions stored in a computer-readable medium or otherwise available from a computer-readable medium. Such instructions may include, for example, instructions and data that enable or otherwise configure a general-purpose computer, a special-purpose computer, or a processing device to perform a specific function or a group of functions. Some parts of the computer resources used may be accessible over a network. Computer-executable instructions may be, for example, binary files, intermediate format instructions (such as assembly language), firmware, source code, etc. Examples of computer-readable media that can be used to store instructions, information used, and / or information created during the method according to the described examples include magnetic or optical disks, flash memory, USB devices provided with non-volatile memory, networked storage devices, etc.

[0093] Devices implementing the processes and methods according to these disclosures may include hardware, software, firmware, middleware, microcode, hardware description language, or any combination thereof, and may take various form factors. When implemented in software, firmware, middleware, or microcode, the program code or code segments for performing the necessary tasks (e.g., computer program products) may be stored in a computer-readable or machine-readable medium. (One or more) processors may perform the necessary tasks. Typical examples of form factors include laptops, smartphones, mobile phones, tablet devices, or other small form factor personal computers, personal digital assistants, rack-mounted devices, stand-alone devices, and the like. The functions described herein may also be embodied in peripheral devices or add-on cards. As a further example, such functions may also be implemented on different chips on a circuit board or between different processes performed in a single device.

[0094] Instructions, media for communicating such instructions, computing resources for executing the instructions, and other structure for supporting such computing resources are example means for providing the functionality described in this disclosure.

[0095] In the foregoing description, various aspects of the present application are described with reference to specific aspects thereof, but those skilled in the art will recognize that the present application is not limited to these aspects. Thus, although the illustrative aspects of the present application have been described in detail herein, it is to be understood that the inventive concepts may be embodied and used in various other ways, and the appended claims are intended to be interpreted as including such variations, unless limited by the prior art. The various features and aspects of the above-mentioned application may be used alone or in combination. In addition, the various aspects may be utilized in any number of environments and applications other than those described herein without departing from the broader spirit and scope of this specification. The description and drawings should therefore be considered illustrative, not restrictive. For illustration, the method is described in a particular order. It should be understood that in alternative aspects, the method may be performed in an order different from that described.

[0096] A person of ordinary skill in the art will understand that the less than ("<") and greater than (">") symbols or terms used herein may be replaced with less than or equal to ("≤") and greater than or equal to ("≥") symbols, respectively, without departing from the scope of this specification.

[0097] When a component is described as being “configured to” perform certain operations, such configuration may be achieved, for example, by designing an electronic circuit or other hardware to perform the operation, by programming a programmable electronic circuit (e.g., a microprocessor or other appropriate electronic circuit) to perform the operation, or by any combination thereof.

[0098] The term “coupled” refers to any component that is physically connected directly or indirectly to another component and / or that communicates directly or indirectly with another component (e.g., via a wired or wireless connection and / or other appropriate communication interface).

[0099] A claim statement or other statement that recites "at least one of" a set and / or "one or more" of a set indicates that one member of the set or multiple members of the set (in any combination) satisfy the claim. For example, a claim statement that recites "at least one of A and B" or "at least one of A or B" refers to A, B, or A and B. A claim statement that recites "at least one of A, B, and C" or "at least one of A, B, or C" refers to A, B, C, or A and B, or A and C, or B and C, or A, B, and C. A statement that recites "at least one of" a set and / or "one or more" of a set does not limit the set to the items listed in the set. For example, a claim statement that recites "at least one of A and B" or "at least one of A or B" may refer to A, B, or A and B, and may additionally include items not listed in the set of A and B.

[0100] The various illustrative logic blocks, modules, circuits, and algorithmic steps described in connection with the various aspects disclosed herein may be implemented as electronic hardware, computer software, firmware, or a combination thereof. In order to clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps are generally described above in terms of their functions. Whether such functions are implemented as hardware or software depends on the specific application and design constraints imposed on the entire system. Those skilled in the art may implement the described functions in different ways for each specific application, but such implementation decisions should not be interpreted as resulting in departure from the scope of this application.

[0101] The techniques described herein may also be implemented using electronic hardware, computer software, firmware, or any combination thereof. This technology may be implemented in any of a variety of devices, such as a general-purpose computer, a wireless communication device mobile phone, or an integrated circuit device with multiple uses, including applications in wireless communication device mobile phones and other devices. Any features described as modules or components may be implemented together in an integrated logic device, or may be implemented separately as discrete but interoperable logic devices. If implemented in software, these techniques may be implemented at least in part by a computer-readable data storage medium, which includes program code, which includes instructions that, when executed, perform one or more of the methods described above. The computer-readable data storage medium may form part of a computer program product, which may include packaging materials. The computer-readable medium may include a memory or data storage medium, such as RAM (such as synchronous dynamic random access memory (SDRAM)), ROM, non-volatile random access memory (NVRAM), EEPROM, flash memory, magnetic or optical data storage medium, and the like. These techniques may additionally or alternatively be implemented at least in part via a computer-readable communication medium that carries or communicates program code in the form of instructions or data structures and that can be accessed, read, and / or executed by a computer, such as a propagated signal or wave.

[0102] The program code may be executed by a processor, which may include one or more processors, such as one or more DSPs, general-purpose microprocessors, ASICs, FPGAs, or other equivalent integrated or discrete logic circuits. Such a processor may be configured to perform any of the techniques described in this disclosure. A general-purpose processor may be a microprocessor; however, the processor may alternatively be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in combination with a DSP core, or any other such configuration. Therefore, the term "processor" as used herein may refer to any of the foregoing structures, any combination of the foregoing structures, or any other structure or device suitable for implementing the techniques described herein.

Claims

1. A method for policy-based transparent packet inspection for last-mile zero-trust workload protection, comprising: Receiving the packet on a network interface of a user device within the network or a provisioned resource in a data center; determining, by a first interception agent configured in the network interface, whether to inspect the packet based on a rule received from a control plane of the network, wherein the network interface comprises a smart network interface card (SmartNIC) or a data processing unit (DPU) and is configured with the first interception agent based on the control plane; selectively invoking deep packet inspection on the packet based on inspection of the packet by the first intercept agent using rules from the control plane; and Malicious content within the packet is identified based on the deep packet inspection, and the packet is blocked at the network interface.

2. The method of claim 1, further comprising: Based on inspection of the packet by the first interception agent, a copied version of the packet is forwarded to a data logging system for storage of the packet.

3. The method of claim 1 , further comprising: updating a state associated with a policy based on inspection of the packet by the first interception agent; and An event is invoked based on the state satisfying a condition in the policy.

4. The method of claim 1 , further comprising: determining that a second interception agent is associated with a source of the packet; and An encrypted network connection is configured between the first interception proxy and the second interception proxy.

5. The method according to claim 4, wherein: The second interception proxy is configured to inject metadata into packets received at the first interception proxy.

6. The method according to claim 5, wherein: The metadata includes at least one of user authentication information, network address information, or application entry point information.

7. The method of claim 1 , further comprising: receiving a policy update from the control plane; and The first interception agent is re-initiated based on the policy update.

8. The method of claim 7, wherein: The network interface is configured to suspend accepting packets while re-initiating the first interception agent.

9. The method of claim 1, wherein: Determining whether to inspect the packet includes: A corresponding flow associated with the packet is identified, wherein the packet is designated for the deep packet inspection based on the absence of the flow.

10. The method of claim 1, further comprising: receiving a local packet directed from a first application to a second application on a local host interface; and The local packet is inspected by the first intercept agent based on rules received from the control plane.

11. A computing device comprising: A network device configured to: Receive packets on a network device within the network; determining, by a first interception agent configured in the network device, whether to inspect the packet based on a rule received from a control plane of the network, wherein the network device comprises a smart network interface card (SmartNIC) or a data processing unit (DPU) and is configured with the first interception agent based on the control plane; selectively invoking deep packet inspection on the packet based on inspection of the packet by the first intercept agent using rules from the control plane; and Malicious content within the packet is identified based on the deep packet inspection, and the packet is blocked at the network device.

12. The computing device of claim 11, wherein: The network device is configured to: Based on inspection of the packet by the first interception agent, a copied version of the packet is forwarded to a data logging system for storage of the packet.

13. The computing device of claim 11, wherein: The network device is configured to: updating a state associated with a policy based on inspection of the packet by the first interception agent; and An event is invoked based on the state satisfying a condition in the policy.

14. The computing device of claim 11, wherein: The network device is configured to: determining that a second interception agent is associated with the source of the packet; and An encrypted network connection is configured between the first interception proxy and the second interception proxy.

15. The computing device of claim 14, wherein: The second interception proxy is configured to inject metadata into packets received at the first interception proxy.

16. The computing device of claim 15, wherein: The metadata includes at least one of user authentication information, network address information, or application entry point information.

17. The computing device of claim 11, wherein: The network device is configured to: receiving a policy update from the control plane; and The first interception agent is re-initiated based on the policy update.

18. The computing device of claim 17, wherein: The network device is configured to suspend receiving packets while re-initiating the first interception agent.

19. The computing device of claim 11, wherein: The network device is configured to: A corresponding flow associated with the packet is identified, wherein the packet is designated for the deep packet inspection based on the absence of the flow.

20. The computing device of claim 11, wherein: The network device is configured to: receiving a local packet directed from a first application to a second application on a local host interface; and The local packet is inspected by the first intercept agent based on rules received from the control plane.

Images