METHOD, APPARATUS, SIGNALS, AND MEDIUM FOR MANAGING TRANSFER OF DATA IN A DATA NETWORK

• US 20120023557A1
• Filed: 09/30/2011
• Published: 01/26/2012
• Est. Priority Date: 09/06/2005
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Bevan, Stephen John, Xie, Michael, Li, Hongwei, Luo, Wenping, Wei, Shaohong
• Granted Patent: US 8,856,884 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/43 Assembling or disassembling of packets, e.g. segmentation and reassembly [SAR]
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

A method and apparatus for managing a transfer of data in a data network identifies data associated with a communication session between a first node and a second node in the data network. Further processing of the communication session occurs when a portion of the communication session meets a criterion and the communication session is permitted to continue when the portion of the communication session does not meet the criterion.

Claims

1. A method for managing a transfer of data between a first node and a second node in a data network, the method comprising:

identifying data associated with a communication session between the first node and the second node;

identifying a signature associated with said data associated with said communication session;

further processing said communication session when a portion of said communication session meets a criterion; and

permitting said communication session to continue when said portion of said communication session does not meet said criterion.

2. The method of claim 1, wherein identifying said signature comprises identifying a pattern in said data associated with said communication session.

3. The method of claim 1, wherein identifying said signature comprises performing signature analysis on said data associated with said communication session.

4. The method of claim 1, wherein identifying said signature comprises determining whether said data associated with said communication session complies with a data transfer protocol.

5. The method of claim 1, wherein identifying said signature comprises determining whether said data associated with said communication session is addressed to a particular destination.

6. An apparatus for managing a transfer of data in a data network, the apparatus comprising:

means for identifying data associated with a communication session between a first node and a second node in the data network;

means for identifying a signature associated with said data associated with said communication session;

means for further processing said communication session when a portion of said communication session meets a criterion; and

means for permitting said communication session to continue when said portion of said communication session does not meet said criterion.

7. The apparatus of claim 6, wherein said means for identifying said signature comprises means for identifying a pattern in said data associated with said communication session.

8. The apparatus of claim 6, wherein said means for identifying said signature comprises means for performing signature analysis on said data associated with said communication session.

9. The apparatus of claim 6, wherein said means for identifying said signature comprises means for determining whether said data associated with said communication session complies with a specific data transfer protocol.

10. The apparatus of claim 6, wherein said means for identifying said signature comprises means for determining whether said data associated with said communication session is addressed to a specific destination.

11. An apparatus for managing a transfer of data in a data network, the apparatus comprising:

a session identifier operably configured to identify data associated with a communication session between a first node and a second node in the data network;

a session controller having an input for receiving a control signal indicating whether said communication session meets a criterion, said session controller responsive to said control signal to produce a signal to indicate whether or not said communication session should be permitted to continue or should be subjected to further processing; and

a signature analyzer operably configured to produce said control signal in response to identifying a signature associated with said data associated with said communication session.

12. The apparatus of claim 11, further comprising a signature analyzer operably configured to produce said control signal in response to identifying a signature associated with said data associated with said communication session.

13. The apparatus of claim 12, wherein said signature comprises a pattern characteristic of a particular type of data transfer.

14. The apparatus of claim 12, wherein said signature comprises a data protocol identifier.

15. The apparatus of claim 12, wherein said signature comprises an address field.

16. The apparatus of claim 12, wherein said signature analyzer comprises a hardware circuit comprising discrete logic components.

17. The apparatus of claim 12, wherein said signature analyzer comprises an application specific integrated circuit (ASIC).