Methods and systems for providing a token-based application firewall correlation
First Claim
1. A method comprising:
- receiving a request for access to a resource from a remote user device, the request received by an application-level firewall;
associating a token with the request, by the application-level firewall, wherein the token is added to a session context and the token is injected into multiple events that originate from the request to service the request during the session to allow the application-level firewall to correlate the request with a corresponding session wherein associating a token with the request comprises the application-level firewall modifying logic of the request to include the token;
storing the token and associated information in an event correlator communicatively coupled with the application-level firewall;
associating the token with one or more subsequent actions by the resource in response to receiving the request, wherein the one or more subsequent actions comprises at least generating a database query based on the request, the database query including the token in logic of the database query;
selectively applying one or more traffic management policies by the application-level firewall based on at least the session context having the token by at least identifying abnormalities in transactions through the application-level firewall utilizing at least a statistical model, wherein a total score is maintained over a session and can be updated by multiple host system entities; and
transmitting a response to the request with the token to the remote user device via the application firewall, wherein the application-level firewall analyzes the response and determines an action to be taken on the response based on the token and the associated information.
1 Assignment
0 Petitions
Accused Products
Abstract
Token-based firewall functionality. A request is received for access to a resource from a remote user device, the request received by an application firewall. A token is associated with the request. The token and associated information are stored in an event correlator coupled with the application firewall. The token is associated with one or more subsequent actions by the resource in response to receiving the request. A response to the request including the token is generated. The response with the token is transmitted to the remote user device via the application firewall. The application firewall analyzes the response and determines an action to be taken on the response based on the token and the associated information.
-
Citations
19 Claims
-
1. A method comprising:
-
receiving a request for access to a resource from a remote user device, the request received by an application-level firewall; associating a token with the request, by the application-level firewall, wherein the token is added to a session context and the token is injected into multiple events that originate from the request to service the request during the session to allow the application-level firewall to correlate the request with a corresponding session wherein associating a token with the request comprises the application-level firewall modifying logic of the request to include the token; storing the token and associated information in an event correlator communicatively coupled with the application-level firewall; associating the token with one or more subsequent actions by the resource in response to receiving the request, wherein the one or more subsequent actions comprises at least generating a database query based on the request, the database query including the token in logic of the database query; selectively applying one or more traffic management policies by the application-level firewall based on at least the session context having the token by at least identifying abnormalities in transactions through the application-level firewall utilizing at least a statistical model, wherein a total score is maintained over a session and can be updated by multiple host system entities; and transmitting a response to the request with the token to the remote user device via the application firewall, wherein the application-level firewall analyzes the response and determines an action to be taken on the response based on the token and the associated information. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. An article comprising a non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, are configurable to cause the one or more processors to:
-
receive a request for access to a resource from a remote user device, the request received by an application-level firewall; associate a token with the request, by the application-level firewall, wherein the token is added to a session context and the token is injected into multiple events that originate from the request to service the request during the session to allow the application-level firewall to correlate the request with a corresponding session; store the token and associated information in an event correlator communicatively coupled with the application-level firewall; associate the token with one or more subsequent actions by the resource in response to receiving the request, wherein the one or more subsequent actions comprises at least generating a database query based on the request, the database query including the token in logic of the database query; selectively apply one or more traffic management policies by the application-level firewall based on at least the session context having the token by at least identifying abnormalities in transactions through the application-level firewall utilizing at least a statistical model, wherein a total score is maintained over a session and can be updated by multiple host system entities; and transmit a response to the request with the token to the remote user device via the application firewall, wherein the application-level firewall analyzes the response and determines an action to be taken on the response based on the token and the associated information. - View Dependent Claims (9, 10, 11, 12, 13, 14)
-
-
15. A system comprising:
a computing environment coupled over a network to communicate with multiple user systems each having at least one memory device and one or more hardware processing devices coupled with the at least one memory device, the computing environment comprising at least an application-level firewall and an application, both coupled to receive traffic from the multiple user systems, the application-level firewall and the application to interact to receive a request for access to a resource from a remote user device, the request received by an application-level firewall to associate a token with the request, by the application-level firewall, wherein the token is added to a session context and the token is injected into multiple events that originate from the request to service the request during the session to allow the application-level firewall to correlate the request with a corresponding session, to store the token and associated information in an event correlator communicatively coupled with the application-level firewall, to associate the token with one or more subsequent actions by the resource in response to receiving the request, wherein the one or more subsequent actions comprises at least generating a database query based on the request, the database query including the token in logic of the database query, to selectively apply one or more traffic management policies by the application-level firewall based on at least the session context having the token by at least identifying abnormalities in transactions through the application-level firewall utilizing at least a statistical model, wherein a total score is maintained over a session and can be updated by multiple host system entities, and to transmit a response to the request with the token to the remote user device via the application firewall, wherein the application-level firewall analyzes the response and determines an action to be taken on the response based on the token and the associated information. - View Dependent Claims (16, 17, 18, 19)
Specification