Enhanced server to client session inspection

• US 8,037,528 B2
• Filed: 09/17/2007
• Issued: 10/11/2011
• Est. Priority Date: 09/17/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Williams, Craig Allen, Lathem, Gerald S.
• Primary Examiner(s): SHAN, APRIL YING
• Application Number:
  US11/856,562
• Publication Number:
  US 20080098477A1
• Time in Patent Office: 1,485 Days
• Field of Search: 713/151, 713/153, 713/154, 713/188, 713/170, 713/187, 726/11, 726/22, 726/23, 726/3, 726/12, 709/246, 709/247, 380/217, 380/236, 380/269, 380/270
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

In one embodiment, a technique for enhancing the inspection of data sent from a server is provided. By modifying a client request in an effort to prevent the transformation (e.g., encoding and/or compression) of data by the server, unencoded data may be received, which can be inspected without the overhead associated with first decoding the data. Further, in the event the data is encoded despite modifying the client request to prevent such encoding, the server may be untrustworthy and one or more appropriate actions may be taken.

Claims

1. A method comprising:

receiving, by an inspection device positioned in a network between a client and a server, a request from the client for response data from the server, the request including a specification of one or more forms of transforming the response data sent by the server in response to the request, wherein the one or more forms of transforming comprise at least one of encrypting the response data or compressing the response data;

modifying, by the inspection device, the request in a manner designed to prevent the server from transforming the response data in accordance with the specification;

sending, by the inspection device, the modified request to the server;

receiving, by the inspection device, the response data from the server;

determining, by the inspection device, if the response data is transformed in accordance with the specification despite the modification of the request;

if the response data is not transformed in accordance with the specification, inspecting, by the inspection device, the response data for malicious content; and

if the response data is transformed in accordance with the specification, concluding, by the inspection device, the server is untrustworthy and taking one or more predetermined actions.

2. The method of claim 1, further comprising, if the response data is not transformed in accordance with the specification and malicious content is found in the response data, removing the malicious content from the response data prior to forwarding the response data.

3. The method of claim 1, further comprising, if the response data is not transformed in accordance with the specification and malicious content is found in the response data, preventing the response data from being forwarded.

4. The method of claim 1, wherein:

the specification comprises one or more fields in a Hypertext Transfer Protocol (HTTP) header; and

modifying the request in a manner designed to prevent the server from transforming the response data in accordance with the specification comprises at least one of modifying or deleting the fields.

5. The method of claim 1, wherein taking one or more predetermined actions comprises preventing the response data from reaching the client.

6. The method of claim 1, wherein taking one or more predetermined actions comprises decoding the response data to generate untransformed response data and inspecting the untransformed response data.

7. The method of claim 6, further comprising:

detecting malicious content in the untransformed response data;

modifying the response data to remove the malicious content; and

forwarding the modified response data.

8. A method comprising:

receiving, by an inspection device positioned in a network between a client and a server, a request from the client, the request including a specification of one or more forms of transforming response data sent by the server in response to the request, wherein the one or more forms of transforming comprise at least one of encrypting the response data or compressing the response data;

modifying, by the inspection device, the request to remove at least one of the forms of transforming from the specification;

sending, by the inspection device, the modified request to the server;

determining, by the inspection device, if the response data is transformed in accordance with the specification despite the modification of the request;

inspecting, by the inspection device, the response data from the server for malicious content if the response data is not transformed or is transformed using a form of transforming specified in the modified request; and

concluding, by the inspection device, the server is untrustworthy and taking one or more predetermined actions if the response data is transformed using a form of transforming that is not specified in the modified request.

9. The method of claim 8, wherein:

the specification comprises one or more fields in a Hypertext Transfer Protocol (HTTP) header; and

modifying the request comprises at least one of modifying or deleting the fields in the HTTP header.

10. The method of claim 8, wherein taking one or more predetermined actions comprises decoding the response data and inspecting the decoded response data.

11. The method of claim 8, wherein taking one or more predetermined actions comprises sending a notification to a user.

12. The method of claim 11, further comprising receiving an identification of the user via an interface.