Method and system for extracting application protocol characteristics

• US 20050044420A1
• Filed: 08/02/2004
• Published: 02/24/2005
• Est. Priority Date: 09/09/1998
• Status: Active Grant

• Current Assignee: F5 Networks, Inc. (F5 Incorporated)
• Original Assignee: F5 Networks, Inc. (F5 Incorporated)
• Inventors: Moran, Tal, Galant, Yaron, El-Hanani, Yuval, Raanan, Gil, Reshef, Eran
• Granted Patent: US 7,774,835 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion

Abstract

A method and computer program for automatically and continually extracting application protocols (i.e., defining a set of allowable or authorized actions) for any application. The method involves receiving a message from a server before it is sent or in parallel with sending to a client. The message may be in response to a specific request for it from the client. The program then extracts the application protocol data from the server message. Working with a copy of the message, the program strips off the communications protocol(s) from the message and parses the remaining message to identify user-selectable options contained in the message such as commands, fields, etc. These items represent the set of allowable or authorized user actions for the particular “stage” of the current version of the application as set forth in the message. The set of allowable user actions is then stored by the extraction program in a protocol database accessible to a gateway or filter module.

Claims

1. (canceled)

2. A method for defining a set of allowable actions for an application program residing on a server, the method comprising:

receiving a server communication addressed to a client;

extracting application protocol data from the server communication to thereby retrieve a set of allowable actions which may be taken in response to the server communication;

stripping communication protocol data from the server communication;

parsing the stripped communication protocol data to extract the network address of the client; and

storing the extracted application protocol data in a protocol database in association with the communication protocol data representing the address of the client to thereby enable a session with the client.