Method, apparatus, signals, and medium for managing a transfer of data in a data network

• US 8,166,547 B2
• Filed: 09/06/2005
• Issued: 04/24/2012
• Est. Priority Date: 09/06/2005
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Bevan, Stephen John, Xie, Michael, Li, Hongwei, Luo, Wenping, Wei, Shaohong
• Primary Examiner(s): Homayounmehr, Farid
• Application Number:
  US11/220,762
• Publication Number:
  US 20070053382A1
• Time in Patent Office: 2,422 Days
• Field of Search: 726/24, 703/150
• US Class Current: 726/24
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/43 Assembling or disassembling of packets, e.g. segmentation and reassembly [SAR]
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

A method and apparatus for managing a transfer of data in a data network identifies data associated with a communication session between a first node and a second node in the data network. Further processing of the communication session occurs when a portion of the communication session meets a criterion and the communication session is permitted to continue when the portion of the communication session does not meet the criterion.

Claims

1. A method for managing a transfer of data between a first node device and a second node device in a data network, the method comprising:

identifying data associated with a communication session over a first data transfer path on the data network between the first node device and the second node device, the identifying of data associated with the communication session including;

performance of signature analysis on an initial portion of the data associated with the communication session to identify a policy to apply to data of the communication session, the policy identifying at least one data processing action to be performed with regard to data of the communication session;

storing, in memory, an identifier of the communication session in association with an identifier of the identified policy;

processing subsequently received data of the communication session according to the identified policy; and

prior to identifying the policy, permitting data associated with the communication session to pass over the first data transfer path between the first node device and the second node device;

further processing, on a processor circuit, data of said communication session when a portion of said communication session meets a criterion as identified though performance of the signature analysis on the initial portion of data associated with the communication session and subsequently received data of the communication session, the further processing including at least one data processing action of the identified policy, the data processing action including originating a second communication session over a second data transfer path and diverting said communication session to the second communication session via the second data transfer path which is slower than the first data transfer path; and

permitting said communication session to continue on the first data transfer path when said portion of said communication session does not meet said criterion.

2. The method of claim 1 wherein the transfer of data comprises a plurality of data packets and wherein identifying data associated with said communication session comprises identifying particular data packets associated with said communication session.

3. The method of claim 2 wherein identifying particular data packets associated with said communication session comprises reading data packets transmitted by at least one of the first node and the second node.

4. The method of claim 2 wherein identifying particular data packets associated with said communication session comprises reading a header associated with each of said plurality of data packets.

5. The method of claim 4 wherein reading said header comprises reading at least one of a source address field, a destination address field, a source port field, a destination port field, and a protocol field.

6. The method of claim 2 further comprising labeling said particular data packets to indicate that said particular data packets are associated with said communication session.

7. The method of claim 6 wherein labeling said particular data packets comprises associating a data label with said particular data packets.

8. The method of claim 2 further comprising determining whether said data packets comply with an Internet Protocol (IP).

9. The method of claim 2 further comprising determining whether said data packets comply with a Transport Control Protocol (TCP).

10. The method of claim 1 wherein said further processing comprises dropping said communication session.

11. The method of claim 1 wherein said further processing comprises at least one of:

logging at least a portion of said communication session;

altering at least a portion of said data associated with said communication session;

configuring a network resource to permit said communication session to proceed; and

scanning said data associated with said communication session for data patterns that indicate the presence of malicious code.

12. A computer readable medium encoded with codes to direct a processor circuit to carry out the method of claim 1.

13. An apparatus for managing a data transfer between a first node and a second node in a data network, the apparatus comprising:

a processor circuit; and

a memory encoded with codes for directing said processor circuit to perform the method of claim 1.