Method and apparatus for processing web service messages

• US 20060047832A1
• Filed: 05/19/2005
• Published: 03/02/2006
• Est. Priority Date: 05/21/2004
• Status: Abandoned Application

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Betts, Christopher, Rogers, Tony
• Application Number:
  US11/132,632
• Publication Number:
  US 20060047832A1
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 12/22 Arrangements for preventing the taking of data from a data transmission channel without authorisation means for verifying the identity or the authority of a user of a secure or secret communication system H04L9/32
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Methods and apparatuses for processing a web service message are provided. The apparatus includes a data store and firewall logic means. The data store stores configurable firewall criteria. An interface can optionally be provided for configuring the firewall criteria. A web service message is processed through the firewall logic means which applies the firewall criteria stored in the data store.

Claims

1. An apparatus for processing a web service message, comprising:

a data store for storing configurable firewall criteria;

firewall logic means for processing a web service message according to the firewall criteria stored in the data store.

2. The apparatus of claim 1, wherein said configurable firewall criteria include parameters for one or more of the following firewall functionalities:

(a) scanning ports and detecting denial of service attacks;

(b) checking for valid XML in the web service message;

(c) translating and verifying a destination address of the web service message;

(d) placing the web service message in a canonicalized form;

(e) translating and verifying the data of the web service message; and

(f) checking for correctly formatted packets in the web service message.

3. The apparatus of claim 1, wherein said configurable firewall criteria include parameters for one or more of the following firewall functionalities:

(i) checking a signature of the web service message;

(ii) identifying a source of the web service message; and

(iii) determining whether access to a particular resource requested by the web service message is restricted.

4. A firewall hardware device including the apparatus of claim 1.

5. An apparatus for processing a web service message, comprising:

a data repository for storing parameters to be used by a firewall;

means for enabling a user to configure the parameters stored in the data repository;

means for processing the web service message;

means for determining whether data in the web service message is valid;

means for determining whether a source of the web service message is authorized to pass through the firewall; and

means for allowing the web service message to pass through the firewall if it is determined that the web service message is authorized to pass through the firewall.

6. The apparatus of claim 5, further comprising:

scanning means for scanning ports and detecting denial of service attacks;

checking means for checking for correctly formatted SOAP packets and valid XML;

translating means for translating and verifying a destination address of the web service message;

formatting means for placing the web service message in a canonicalized form; and

verification means for translating and verifying the data of the web service message.

7. The apparatus of claim 6, further comprising means for creating an audit log recording information from at least one of said scanning means, checking means, translating means, formatting means and verification means.

8. The apparatus of claim 5, further comprising:

checking means for checking a signature of the web service message;

identifying means for identifying a source of the web service message; and

determining means for determining whether access to a particular resource is restricted.

9. The apparatus of claim 8, further comprising means for creating an audit log recording information from at least one of said checking means, identifying means and determining means.

10. The apparatus of claim 5, further comprising means for providing real time monitoring information.

11. The apparatus of claim 5, further comprising an interface layer enabling the web service message to be further processed.

12. A firewall hardware device including the apparatus of claim 5.

13. A method for processing a web service message, comprising:

providing a data store for storing configurable firewall criteria;

providing an interface for configuring the firewall criteria;

processing a web service message through firewall logic means which applies the firewall criteria stored in the data store.

14. The method of claim 13, wherein said configurable firewall criteria include parameters for one or more of the following steps:

(a) scanning ports and detecting denial of service attacks;

(b) checking for valid XML;

(c) translating and verifying a destination address of the web service message;

(d) placing the web service message in a canonicalized form;

(e) translating and verifying the data of the web service message; and

(f) checking for correctly formatted packets.

15. The method of claim 13, further comprising:

(i) checking a signature of the web service message;

(ii) identifying a source of the web service message; and

(iii) determining whether access to a particular resource is restricted,

wherein said configurable firewall criteria include parameters for at least one of steps (i) through (iii).

16. A computer system comprising:

a processor; and

a program storage device readable by the computer system, tangibly embodying a program of instructions executable by the processor to perform the method claimed in claim 13.

17. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform the method claimed in claim 13.

18. A computer data signal transmitted in one or more segments in a transmission medium which embodies instructions executable by a computer to perform the method claimed in claim 13.

19. A method for processing a web service message, comprising:

providing a data repository for storing parameters to be used by a firewall;

providing an interface for configuring the parameters stored in the data repository;

providing means for processing the web service message;

determining whether data in the web service message is valid;

determining whether a source of the web service message is authorized to pass through the firewall; and

allowing the web service message to pass through the firewall if it is determined that the web service message is authorized to pass through the firewall.

20. The method of claim 19, further comprising:

(a) scanning ports and detecting denial of service attacks;

(b) checking for correctly formatted SOAP packets and valid XML;

(c) translating and verifying a destination address of the web service message;

(d) placing the web service message in a canonicalized form; and

(e) translating and verifying the data of the web service message.

21. The method of claim 20, further comprising creating an audit log recording information from at least one of (a) through (e).

22. The method of claim 19, further comprising:

(i) checking a signature of the web service message;

(ii) identifying a source of the web service message; and

(iii) determining whether access to a particular resource is restricted.

23. The method of claim 22, further comprising creating an audit log recording information from at least one of (i) through (iii).

24. The method of claim 19, further comprising providing real time monitoring information.

25. The method of claim 19, further comprising providing an interface layer enabling the web service message to be further processed.

26. The method of claim 19, further comprising verifying the data of the web service message against limits set in a WSDL file.

27. The method of claim 20, wherein the destination address is checked by using a Universal Description, Discovery and Integration server.

28. A computer system comprising:

a processor; and

a program storage device readable by the computer system, tangibly embodying a program of instructions executable by the processor to perform the method claimed in claim 19.

29. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform the method claimed in claim 19.

30. A computer data signal transmitted in one or more segments in a transmission medium which embodies instructions executable by a computer to perform the method claimed in claim 19.