Systems and methods for a protocol gateway

• US 20040109518A1
• Filed: 06/10/2003
• Published: 06/10/2004
• Est. Priority Date: 06/10/2002
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Akonix Systems, Inc. (Quest Software, Inc.)
• Inventors: Shapiro, Dmitry, Miller, Randy, Poling, Robert, Pugh, Richard S.
• Granted Patent: US 7,707,401 B2
• Time in Patent Office: Days
• US Class Current: 375/356
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 7/00 Arrangements for synchronising receiver with transmitter synchronisation of generators of electric oscillations or pulses H03L7/00

Abstract

A protocol management system is capable of detecting certain message protocols and applying policy rules to the detected message protocols that prevent intrusion, or abuse, of a network'"'"'s resources. In one aspect, a protocol message gateway is configured to apply policy rules to high level message protocols, such as those that reside at layer 7 of the ISO protocol stack.

Claims

1. A method for managing communication protocol in a network comprising:

receiving a message that uses a message protocol;

determining whether protocol rule should be applied to the message based on the protocol associated with the message;

when it is determined that a protocol adaptation rule should be applied to the message, then applying the appropriate protocol rule.

2. The method of claim 1, further comprising, when it is determined that a protocol rule should not be applied to the message, then implementing the protocol associated with the message.

3. The method of claim 1, wherein the policy rule is based on the source of the received message.

4. The method of claim 1, wherein the policy rule is based on the intended destination of the received message.

5. The method of claim 1, wherein the policy rule is based on information included in the received message.

6. The method of claim 1, wherein the policy rule is based on when the received message is sent or intended to be received.

7. The method of claim 1, wherein the policy rule is based on the size of the received message.

8. The method of claim 1, wherein the policy rule is based on whether the received message includes an attachment.

9. The method of claim 1, wherein the policy rule is based on whether the received message includes a virus.

10. The method of claim 1, further comprising recording information associated with the received message.

11. The method of claim 1, further comprising creating a log comprising information associate with the received message and any related messages.

12. The method of claim 11, further comprising encrypting the log.

13. The method of claim 11, further comprising restricting access to the log.

14. The method of claim 11, further comprising generating a report form the information stored in the log.

15. The method of claim 1, wherein the received message comprises a specific screen name associated with a source within the network, and wherein the method further comprises:

determining a unique user name for the source;

associating the screen name with the unique user name; and

storing the association between the screen name and the unique user name.

16. The method of claim 15, further comprising determining if a session associated with the received message is still in progress before applying the policy rule.

17. The method of claim 15, wherein the received massage is associated with a network address, and wherein determining a unique user name comprises identifying the source using the network address.

18. The method of claim 17, wherein determining a unique user name further comprises determining a global user identification associated with the source.

19. The method of claim 18, wherein determining a global user identification comprises interrogating a registry associated with the source.

20. The method of claim 15, further comprising determining if the screen name has previously been associated with a unique user name, and if so, then applying a policy enforcement rule to the message based on the unique user name.

21. The method of claim 1, further comprising:

receiving the message;

inspecting the message protocol associated with the message to determine if the message protocol matches a message protocol template; and

when a match occurs, applying a policy enforcement rule associated with the message protocol template that overrides aspects of the message protocol associated with the intercepted message.

22. The method of claim 21, wherein applying the policy enforcement rule comprises forcing the intercepted message to use a defined communication connection when flowing into or out of the network.

23. The method of claim 22, wherein the defined communication connection is a defined port on a gateway associated with the network.

24. The method of claim 21, wherein applying the policy enforcement rule comprises terminating a communication connection associated with the intercepted message.

25. The method of claim 21, wherein applying the policy enforcement rule comprises resetting a communication connection associated with the intercepted message.

26. The method of claim 21, wherein applying the policy enforcement rule comprises recording information associated with the intercepted message.

27. The method of claim 21, wherein applying the policy enforcement rule comprises creating a log comprising information associate with the intercepted message and any related messages.

28. The method of claim 21, wherein the message protocol template is associated with instant messaging messages.

29. The method of claim 21, wherein the message protocol template is associated with peer-to-peer messages.

30. The method of claim 21, wherein the message protocol template is associated with file sharing messages.

45. The protocol message gateway of claim 1, further comprising an authentication module, and wherein the received message comprises a specific screen name associated with a source within the network, the authentication module configured to:

determine a unique user name for the source;

associate the screen name with the unique user name; and

store the association between the screen name and the unique user name.

46. The protocol message gateway of claim 45, wherein the received massage is associated with a network address, and wherein determining a unique user name comprises identifying the source using the network address.

47. The protocol message gateway of claim 46, wherein determining a unique user name further comprises determining a global user identification associated with the source.

48. The protocol message gateway of claim 47, wherein determining a global user identification comprises interrogating a registry associated with the source.

49. The protocol message gateway of claim 45, wherein the authentication module is further configured to determine if the screen name has previously been associated with a unique user name.

54. The protocol message gateway of claim 21, wherein applying the policy enforcement rule comprises resetting a communication connection associated with the intercepted message.

31. A protocol message gateway, comprising:

a network interface configured to interface the protocol message gateway with a network;

a policy enforcer configured to apply a policy rule; and

a gateway manager coupled the network interface, the gateway manager configured to receive a message comprising a message protocol, determine whether a policy rule should be applied to the message based on the protocol associated with the message, and when it is determined that a policy rule should be applied to the message, then forwarding the message to the policy enforcer.

32. The protocol message gateway of claim 31, further comprising a protocol adapter configure to implement message protocols, and wherein the gateway manger is configured to forward the message to the protocol adapter when it is determined that a policy rule should not be applied to the message.

33. The protocol message gateway of claim 31, wherein the policy rule is based on the source of the received message.

34. The protocol message gateway of claim 31, wherein the policy rule is based on the intended destination of the received message.

35. The protocol message gateway of claim 31, wherein the policy rule is based on information included in the received message.

36. The protocol message gateway of claim 31, wherein the policy rule is based on when the received message is sent or intended to be received.

37. The protocol message gateway of claim 31, wherein the policy rule is based on the size of the received message.

38. The protocol message gateway of claim 31, wherein the policy rule is based on whether the received message includes an attachment.

39. The protocol message gateway of claim 31, wherein the policy rule is based on whether the received message includes a virus.

40. The protocol message gateway of claim 31, further comprising a logging module configured to record information associated with the received message.

41. The protocol message gateway of claim 40, wherein the logging module is further configured to create a log comprising information associate with the received message and any related messages.

42. The protocol message gateway of claim 41, wherein the logging module is further configured to encrypt the log.

43. The protocol message gateway of claim 42, wherein the logging module is further configured to restrict access to the log.

44. The protocol message gateway of claim 42, wherein the logging module is further configured to generate a report from the information stored in the log.

50. The protocol message gateway of claim 31, further comprising a policy enforcer configured to intercept a message being communicated over the network, inspect the message protocol associated with the message to determine if the message protocol matches a message protocol template, and when a match occurs, apply a policy enforcement rule associated with the message protocol template that overrides aspects of the message protocol associated with the intercepted message.

51. The protocol message gateway of claim 50, wherein applying the policy enforcement rule comprises forcing the intercepted message to use a defined communication connection when flowing into or out of the network.

52. The protocol message gateway of claim 51, wherein the defined communication connection is a defined port on a gateway associated with the network.

53. The protocol message gateway of claim 50, wherein applying the policy enforcement rule comprises terminating a communication connection associated with the intercepted message.