Hash-Based Resource Matching

• US 20100064042A1
• Filed: 09/09/2008
• Published: 03/11/2010
• Est. Priority Date: 09/09/2008
• Status: Active Grant

• Current Assignee: Actiance, Inc.
• Original Assignee: Facetime Communications Incorporated
• Inventors: Paster, Steven B.
• Granted Patent: US 8,122,129 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 15/173 using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

In various embodiments, techniques can be provided for identifying and filtering network resources. The filtering may occur not only on the type of network traffic (e.g., HTTP traffic) but also with resources identified by the network traffic. In some embodiments, one or more hash functions may be used to facilitate the identification, searching, and matching of network resources. The network resources may be identified as a unique domain, unique network host, unique URL, or the like.

Claims

1. A method for filtering network traffic, the method comprising:

receiving network traffic;

determining a URL associated with the network traffic;

generating a hash value for a portion of the URL;

determining whether an originator of the network traffic is permitted to access the URL based on the hash value;

blocking the network traffic based on whether the originator is allowed to access the URL.

2. The method of claim 1 wherein generating the hash value for a portion of the URL comprises generating the hash value for a domain name associated with the URL.

3. The method of claim 2 wherein blocking the network traffic comprises blocking the network traffic based on the domain name.

4. The method of claim 1 wherein generating the hash value for a portion of the URL comprises generating the hash value for a hostname associated with the URL.

5. The method of claim 4 wherein blocking the network traffic comprises blocking the network traffic based on the hostname.

6. The method of claim 1 wherein generating the hash value for a portion of the URL comprises generating the hash value for a path associated with the URL.

7. The method of claim 6 wherein blocking the network traffic comprises blocking the network traffic based on the path associated with the URL.

8. The method of claim 1 further comprising:

receiving a list of permitted URLs; and

wherein determining whether an originator of the network traffic is permitted to access the URL based on the hash value comprises determining a match between the hash value and information associated with at least one URL in the list of URLs.

9. The method of claim 8 further comprising:

sorting the list of permitted URLs based on the length on a path associated with each URL in the list; and

wherein determining whether an originator of the network traffic is permitted to access the URL based on the hash value comprises determining a match between the hash value and information associated with at least one URL in the sorted list of URLs.

10. The method of claim 8 further comprising:

generating a CRC value for the portion of the URL; and

determining whether at least one URL in the list of URLs is the same as the URL associated with the network traffic based on the CRC value.

11. A computer-readable storage medium configured to store program code for a network filtering device, the computer-readable storage medium comprising:

code for receiving network traffic;

code for determining a URL associated with the network traffic;

code for generating a hash value for a portion of the URL;

code for determining whether an originator of the network traffic is permitted to access the URL based on the hash value;

code for blocking the network traffic based on whether the originator is allowed to access the URL.

12. The computer-readable storage medium of claim 11 wherein the code for generating the hash value for a portion of the URL comprises code for generating the hash value for a domain name associated with the URL.

13. The computer-readable storage medium of claim 12 wherein the code for blocking the network traffic comprises code for blocking the network traffic based on the domain name.

14. The computer-readable storage medium of claim 11 wherein the code for generating the hash value for a portion of the URL comprises code for generating the hash value for a hostname associated with the URL.

15. The computer-readable storage medium of claim 14 wherein the code for blocking the network traffic comprises code for blocking the network traffic based on the hostname.

16. The computer-readable storage medium of claim 11 wherein the code for generating the hash value for a portion of the URL comprises code for generating the hash value for a path associated with the URL.

17. The computer-readable storage medium of claim 16 wherein blocking the network traffic comprises blocking the network traffic based on the path associated with the URL.

18. The computer-readable storage medium of claim 11 further comprising:

cod for receiving a list of permitted URLs; and

wherein the code for determining whether an originator of the network traffic is permitted to access the URL based on the hash value comprises code for determining a match between the hash value and information associated with at least one URL in the list of URLs.

19. The computer-readable storage medium of claim 11 further comprising:

code for sorting the list of permitted URLs based on the length on a path associated with each URL in the list; and

wherein the code for determining whether an originator of the network traffic is permitted to access the URL based on the hash value comprises code for determining a match between the hash value and information associated with at least one URL in the sorted list of URLs.

20. The computer-readable storage medium of claim 11 further comprising:

code for generating a CRC value for the portion of the URL; and

code for determining whether at least one URL in the list of URLs is the same as the URL associated with the network traffic based on the CRC value.

21. A network filtering appliance comprising:

a communications interface configured receive network traffic associated with a communications network; and

a processor configured to;

determine a URL associated with the network traffic;

generate a hash value for a portion of the URL;

determine whether an originator of the network traffic is permitted to access the URL based on the hash value;

block the network traffic based on whether the originator is allowed to access the URL.

22. The network filtering appliance of claim 21 wherein the processor is configured to generate the hash value for a domain name associated with the URL.

23. The network filtering appliance of claim 21 wherein the processor is configured to generate the hash value for a hostname associated with the URL.

24. The network filtering appliance of claim 21 wherein the processor is configured to generate the hash value for a path associated with the URL.

25. The network filtering appliance of claim 21 wherein the processor is further configured to:

receive a list of permitted URLs; and

determine a match between the hash value and information associated with at least one URL in the list of URLs to determine whether the originator is permitted to access the URL.

26. The network filtering appliance of claim 21 wherein the processor is further configured to:

sort the list of permitted URLs based on the length on a path associated with each URL in the list; and

determine a match between the hash value and information associated with at least one URL in the sorted list of URLs to determine whether the originator is permitted to access the URL.

27. The network filtering appliance of claim 21 wherein the processor is further configured to:

generate a CRC value for the portion of the URL; and

determine whether at least one URL in the list of URLs is the same as the URL associated with the network traffic based on the CRC value.