FILTERING NETWORK DATA TRANSFERS

• US 20140283004A1
• Filed: 03/12/2013
• Published: 09/18/2014
• Est. Priority Date: 03/12/2013
• Status: Active Grant

• Current Assignee: Centripetal Networks, Inc.
• Original Assignee: Centripetal Networks, Inc.
• Inventors: Moore, Sean
• Granted Patent: US 9,124,552 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Aspects of this disclosure relate to filtering network data transfers. In some variations, multiple packets may be received. A determination may be made that a portion of the packets have packet header field values corresponding to a packet filtering rule. Responsive to such a determination, an operator specified by the packet filtering rule may be applied to the portion of packets having the packet header field values corresponding to the packet filtering rule. A further determination may be made that one or more of the portion of the packets have one or more application header field values corresponding to one or more application header field criteria specified by the operator. Responsive to such a determination, at least one packet transformation function specified by the operator may be applied to the one or more of the portion of the packets.

Claims

1. A method, comprising:

at a computing platform comprising at least one processor, memory, and communication interface;

receiving, via the communication interface, a plurality of packets;

determining, by the processor, that at least a portion of the plurality of packets have packet header field values corresponding to a packet filtering rule stored in the memory;

responsive to determining that the at least a portion of the plurality of packets have packet header field values corresponding to the packet filtering rule stored in the memory, applying an operator specified by the packet filtering rule to the at least a portion of the plurality of packets, wherein the operator specifies one or more application header field value criteria;

determining, by the processor, that one or more of the at least a portion of the plurality of packets have one or more application header field values corresponding to the one or more application header field value criteria specified by the operator; and

responsive to determining that the one or more of the at least a portion of the plurality of packets have one or more application header field values corresponding to the one or more application header field criteria specified by the operator, applying at least one packet transformation function specified by the operator to the one or more of the at least a portion of the plurality of packets.

2. The method of claim 1, wherein the at least a portion of the plurality of packets comprise Hypertext Transfer Protocol Secure (HTTPS) packets, and wherein the one or more application header field value criteria comprise one or more Transport Layer Security (TLS) version values.

3. The method of claim 2, wherein the one or more TLS version values specify one or more TLS versions for which packets should be allowed to continue toward their respective destinations, wherein the one or more application header field values corresponding to the one or more application header field criteria specified by the operator comprise one or more of the TLS versions, and wherein applying the packet transformation function specified by the operator to the one or more of the at least a portion of the plurality of packets comprises allowing each of the one or more of the at least a portion of the plurality of packets to continue toward their respective destinations.

4. The method of claim 2, wherein the one or more TLS version values specify one or more TLS versions for which packets should be blocked from continuing toward their respective destinations, wherein the one or more application header field values corresponding to the one or more application header field criteria specified by the operator comprise one or more of the TLS versions, and wherein applying the packet transformation function specified by the operator to the one or more of the at least a portion of the plurality of packets comprises blocking each of the one or more of the at least a portion of the plurality of packets from continuing toward their respective destinations.

5. The method of claim 1, wherein the at least a portion of the plurality of packets comprise Hypertext Transfer Protocol (HTTP) packets, and wherein the one or more application header field value criteria comprise one or more HTTP method values.

6. The method of claim 5, wherein the one or more HTTP method values specify one or more HTTP methods for which packets should be allowed to continue toward their respective destinations, wherein the one or more application header field values corresponding to the one or more application header field criteria specified by the operator comprise one or more of the HTTP methods, and wherein applying the packet transformation function specified by the operator to the one or more of the at least a portion of the plurality of packets comprises allowing each of the one or more of the at least a portion of the plurality of packets to continue toward their respective destinations.

7. The method of claim 5, wherein the one or more HTTP method values specify one or more HTTP methods for which packets should be blocked from continuing toward their respective destinations, wherein the one or more application header field values corresponding to the one or more application header field criteria specified by the operator comprise one or more of the HTTP methods, and wherein applying the packet transformation function specified by the operator to the one or more of the at least a portion of the plurality of packets comprises blocking each of the one or more of the at least a portion of the plurality of packets from continuing toward their respective destinations.

8. The method of claim 5, wherein the one or more of the at least a portion of the plurality of packets comprise a first portion of HTTP packets each of which comprises at least one GET method value and a second portion of HTTP packets each of which comprises one or more of PUT, POST, or CONNECT method values, and wherein applying the at least one packet transformation function specified by the operator to the one or more of the at least a portion of the plurality of packets comprises:

allowing each of the first portion of HTTP packets to continue toward their respective destinations; and

blocking each of the second portion of HTTP packets from continuing toward their respective destinations.

9. The method of claim 1, wherein determining that the at least a portion of the plurality of packets have packet header field values corresponding to the packet filtering rule stored in the memory comprises:

comparing a protocol of a data section of each of the at least a portion of the plurality of packets to a protocol specified by the packet filtering rule;

comparing a source Internet Protocol (IP) address of each of the at least a portion of the plurality of packets to one or more source IP addresses specified by the packet filtering rule;

comparing a source port of each of the at least a portion of the plurality of packets to one or more source ports specified by the packet filtering rule;

comparing a destination IP address of each of the at least a portion of the plurality of packets to one or more destination IP addresses specified by the packet filtering rule; and

comparing a destination port of each of the at least a portion of the plurality of packets to one or more destination ports specified by the packet filtering rule.

10. The method of claim 1, comprising:

receiving, via the communication interface, a second plurality of packets;

determining, by the processor, that the second plurality of packets do not have packet header field values corresponding to the packet filtering rule stored in the memory; and

responsive to determining that the second plurality of packets do not have packet header field values corresponding to the packet filtering rule, blocking each of the second plurality of packets from continuing toward their respective destinations without applying the operator specified by the packet filtering rule to the second plurality of packets.

11. An apparatus, comprising:

at least one processor; and

a memory storing instructions that when executed by the at least one processor cause the apparatus to;

receive a plurality of packets;

determine that at least a portion of the plurality of packets have packet header field values corresponding to a packet filtering rule;

responsive to determining that the at least a portion of the plurality of packets have packet header field values corresponding to the packet filtering rule, apply an operator specified by the packet filtering rule to the at least a portion of the plurality of packets, wherein the operator specifies one or more application header field value criteria;

determine that one or more of the at least a portion of the plurality of packets have one or more application header field values corresponding to the one or more application header field value criteria specified by the operator; and

responsive to determining that the one or more of the at least a portion of the plurality of packets have one or more application header field values corresponding to the one or more application header field criteria specified by the operator, apply at least one packet transformation function specified by the operator to the one or more of the at least a portion of the plurality of packets.

12. The apparatus of claim 11, wherein the at least a portion of the plurality of packets comprise Hypertext Transfer Protocol Secure (HTTPS) packets, and wherein the one or more application header field value criteria comprise one or more Transport Layer Security (TLS) version values.

13. The apparatus of claim 12, wherein the one or more TLS version values specify one or more TLS versions for which packets should be allowed to continue toward their respective destinations, wherein the one or more application header field values corresponding to the one or more application header field criteria specified by the operator comprise one or more of the TLS versions, and wherein the instructions when executed by the at least one processor cause the apparatus to allow each of the one or more of the at least a portion of the plurality of packets to continue toward their respective destinations.

14. The apparatus of claim 12, wherein the one or more TLS version values specify one or more TLS versions for which packets should be blocked from continuing toward their respective destinations, wherein the one or more application header field values corresponding to the one or more application header field criteria specified by the operator comprise one or more of the TLS versions, and wherein the instructions when executed by the at least one processor cause the apparatus to block each of the one or more of the at least a portion of the plurality of packets from continuing toward their respective destinations.

15. The apparatus of claim 11, wherein the at least a portion of the plurality of packets comprise Hypertext Transfer Protocol (HTTP) packets, and wherein the one or more application header field value criteria comprise one or more HTTP method values.

16. The apparatus of claim 15, wherein the one or more HTTP method values specify one or more HTTP methods for which packets should be allowed to continue toward their respective destinations, wherein the one or more application header field values corresponding to the one or more application header field criteria specified by the operator comprise one or more of the HTTP methods, and wherein the instructions when executed by the at least one processor cause the apparatus to allow each of the one or more of the at least a portion of the plurality of packets to continue toward their respective destinations.

17. The apparatus of claim 15, wherein the one or more HTTP method values specify one or more HTTP methods for which packets should be blocked from continuing toward their respective destinations, wherein the one or more application header field values corresponding to the one or more application header field criteria specified by the operator comprise one or more of the HTTP methods, and wherein the instructions when executed by the at least one processor cause the apparatus to block each of the one or more of the at least a portion of the plurality of packets from continuing toward their respective destinations.

18. The apparatus of claim 15, wherein the one or more of the at least a portion of the plurality of packets comprise a first portion of HTTP packets each of which comprises at least one GET method value and a second portion of HTTP packets each of which comprises one or more of PUT, POST, or CONNECT method values, and wherein the instructions when executed by the at least one processor cause the apparatus to:

allow each of the first portion of HTTP packets to continue toward their respective destinations; and

block each of the second portion of HTTP packets from continuing toward their respective destinations.

19. The apparatus of claim 11, wherein the instructions when executed by the at least one processor cause the apparatus to:

compare a protocol of a data section of each of the at least a portion of the plurality of packets to a protocol specified by the packet filtering rule;

compare a source Internet Protocol (IP) address of each of the at least a portion of the plurality of packets to one or more source IP addresses specified by the packet filtering rule;

compare a source port of each of the at least a portion of the plurality of packets to one or more source ports specified by the packet filtering rule;

compare a destination IP address of each of the at least a portion of the plurality of packets to one or more destination IP addresses specified by the packet filtering rule; and

compare a destination port of each of the at least a portion of the plurality of packets to one or more destination ports specified by the packet filtering rule.

20. One or more non-transitory computer-readable media having instructions stored thereon, that when executed by one or more computing devices, cause the one or more computing devices to:

receive a plurality of packets;

determine that at least a portion of the plurality of packets have packet header field values corresponding to a packet filtering rule;

responsive to determining that the at least a portion of the plurality of packets have packet header field values corresponding to the packet filtering rule, apply an operator specified by the packet filtering rule to the at least a portion of the plurality of packets, wherein the operator specifies one or more application header field value criteria;

determine that one or more of the at least a portion of the plurality of packets have one or more application header field values corresponding to the one or more application header field value criteria specified by the operator; and

responsive to determining that the one or more of the at least a portion of the plurality of packets have one or more application header field values corresponding to the one or more application header field criteria specified by the operator, apply at least one packet transformation function specified by the operator to the one or more of the at least a portion of the plurality of packets.