Method for detecting, monitoring, and controlling web services

• US 20070150574A1
• Filed: 12/06/2006
• Published: 06/28/2007
• Est. Priority Date: 12/06/2005
• Status: Abandoned Application

• Current Assignee: Crosscheck Networks, Inc.
• Original Assignee: Crosscheck Networks, Inc.
• Inventors: Yunus, Mamoon, Mallal, Rizwan
• Application Number:
  US11/634,518
• Publication Number:
  US 20070150574A1
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A method scans SOAP and/or XML messages over TCP/IP and performs detection, monitoring, validation, and/or prevention from a monitoring, compliance, security, or integrity perspective. The method achieves these goals through a combination of scanning SOAP and/or XML non-intrusively, without reliance on Web Service Definition Language (WSDL), and providing external enforcement. The combination of non-intrusiveness, WSDL-blindness, and external enforcement techniques truly provides a scalable and reliable deployment of Web Services at the enterprise level.

Claims

1. A method for providing security and monitoring, comprising the steps of:

dynamically generating signatures;

passively scanning data packets in a network based on the signatures; and

processing structured data within the data packets.

2. The method of claim 1, wherein the signatures are created by actively scanning a web service.

3. The method of claim 1, wherein the signatures are created from web service definition language (WSDL) files in the network, the files being passively scanned.

4. The method of claim 1, wherein processing the structured data includes providing statistics based on the structured data.

5. The method of claim 1, wherein processing the structured data includes providing security for the structured data.

6. The method of claim 1, further comprising the step of:

passively scanning the data packets for audit in an intrusion detection system (IDS) or an intrusion prevention system (IPS).

7. The method of claim 1, further comprising the step of:

passively scanning the data packets for analytics.

8. The method of claim 1, further comprising the step of:

generating an exposure risk severity level based on the data packets.

9. The method of claim 8, further comprising the step of:

reporting the exposure risk severity level.

10. The method of claim 1 wherein the network is connected to the Internet.

11. A method for providing security and monitoring, comprising the steps of:

passively scanning data packets in a network;

validating structured data in the data packets based on a schema; and

notifying an external enforcement point if the structured data fails validation.

12. The method of claim 11, further comprising the step of:

dynamically generating signatures; and

wherein passively scanning the data packets includes passively scanning the data packets based on the signatures.

13. The method of claim 12, wherein the signatures are generated based on the schema.

14. The method of claim 12, further comprising the step of:

providing statistics based on the structured data.

15. The method of claim 12, further comprising the step of:

providing security for the structured data.

16. A method for providing security and monitoring, comprising the steps of:

passively scanning data packets in a network, the data packets comprising interface definition of structured data; and

generating signatures based on the interface definition.

17. The method of claim 16, wherein the interface definition is a web service definition language (WSDL) file.

18. The method of claim 16, further comprising the step of:

passively scanning the data packets based on the signatures.

19. The method of claim 18, further comprising the steps of:

determining whether the data packets violate rules, the rules based on the signatures; and

notifying at least one external enforcement point to block subsequent traffic if the data packets violate the rules.

20. A method for providing security and monitoring, comprising the steps of:

communicating structured data to an application service via a network;

receiving response structured data from the application service; and

dynamically generating signatures based on the request and response structure data.

21. The method of claim 20, further comprising the step of:

passively scanning data packets in the network based on the signatures.

22. The method of claim 21, further comprising the step of:

determining whether the data packets violate a policy, the policy being based on the signatures.

23. The method of claim 22, further comprising the step of:

if a data packet violates the policy, notifying at least one external enforcement point to block data packets that match signatures corresponding to the policy.

24. A method for providing security and monitoring, comprising the steps of:

dynamically generating signatures;

passively scanning data packets in a network based on the signatures;

providing statistics on structured data within the data packets;

validating structured data in the data packets based on a schema; and

notifying an external enforcement point if the structured data fails validation.