Method, apparatus, signals, and medium for managing transfer of data in a data network

• US 9,118,719 B2
• Filed: 09/30/2011
• Issued: 08/25/2015
• Est. Priority Date: 09/06/2005
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Bevan, Stephen John, Xie, Michael, Li, Hongwei, Luo, Wenping, Wei, Shaohong
• Primary Examiner(s): Siddiqi, Mohammad A
• Application Number:
  US13/250,364
• Publication Number:
  US 20120023228A1
• Time in Patent Office: 1,425 Days
• Field of Search: 726 11- 13
• US Class Current: 1/1
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/43 Assembling or disassembling of packets, e.g. segmentation and reassembly [SAR]
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

A method and apparatus for managing a transfer of data in a data network identifies data associated with a communication session between a first node and a second node in the data network. Further processing of the communication session occurs when a portion of the communication session meets a criterion and the communication session is permitted to continue when the portion of the communication session does not meet the criterion.

Claims

1. An apparatus for managing a transfer of data in a data network, the apparatus comprising:

a session identifier operably configured to identify data associated with a communication session between a first node and a second node in the data network, the identifying of data associated with the communication session including;

performing signature analysis on an initial portion of the data associated with the communication session to identify further processing to apply to data of the communication session, the further processing identifying at least one data processing action to be performed with regard to data of the communication session;

storing an identifier of the communication session in association with an identifier of the identified further processing;

processing subsequently received data of the communication session according to the identified further processing; and

prior to and until identifying the further processing, permitting data associated with the communication session to pass between the first node and the second node;

a session controller having an input for receiving a control signal indicating whether said communication session meets a criterion, said session controller responsive to said control signal to produce a signal to indicate whether or not said communication session should be permitted to continue or should be subjected to further processing, the session controller permitting said communication session to continue without further processing when the control signal indicates the communication session does not meet the criterion; and

a further processing module operably configured to perform said further processing as identified through performance of the signature analysis on the initial portion of data associated with the communication session and subsequently received data of the communication session, said further processing module including;

a third node operably configured to divide said communication session into a first communication session between the first node and said third node and a second communication session between said third node and said second node, said third node acting as a proxy node; and

altering data of the communication session prior to transmitting the data to at least one of the first and second nodes within the first and second communication sessions, respectively.

2. A method of managing a transfer of data in a data network, the method comprising:

identifying data associated with a communication session between a first node and a second node in the data network, the identifying of data associated with the communication session including;

performing signature analysis on an initial portion of the data associated with the communication session to identify further processing to apply to data of the communication session, the further processing identifying at least one data processing action to be performed with regard to data of the communication session;

storing an identifier of the communication session in association with an identifier of the identified further processing;

processing subsequently received data of the communication session according to the identified further processing; and

prior to and until identifying the further processing, permitting data associated with the communication session to pass between the first node and the second node;

performing the further processing data of said communication session when a portion of said communication session meets a criterion as identified through performance of the signature analysis on the initial portion of data associated with the communication session and subsequently received data of the communication session, said further processing comprises;

terminating said communication session at a third node;

dividing said communication session into a first communication session between the first node and said third node and a second communication session between said third node and the second node, said third node acting as a proxy node; and

altering data of said communication session prior to transmitting the data to at least one of the first and second nodes within the first and second communication sessions, respectively; and

permitting said communication session to continue when said portion of said communication session does not meet said criterion.

3. The method of claim 2, wherein said permitting said communication session to continue comprises permitting said communication session to continue on a first data transfer path and wherein said further processing said communication session comprises diverting said communication session to a second data transfer path, said second data transfer path being slower than said first data transfer path.

4. The method of claim 2, wherein said permitting said communication session to continue when said portion of said communication session does not meet said criterion comprises permitting a first portion of said communication session to continue while determining whether another portion of said communication session meets said criterion.

5. The method of claim 4, wherein the transfer of data comprises a plurality of data packets and wherein said permitting a first portion of said communication session to continue comprises permitting a first plurality of data packets associated with said communication session to be transferred while determining whether at least one subsequent data packet associated with said communication session meets said criterion.

6. The method of claim 2, wherein said communication session is a first communication session and wherein the third node splits the first communication session into the first and the second communication session including originating the second communication session.

7. The method of claim 2, further comprising associating a label with said data associated with said communication session in accordance with whether said portion of said communication session meets said criterion or does not meet said criterion.

8. A non-transitory device-readable medium, with instructions stored thereon, which when executed by at least one processor, causes a device to perform a method comprising:

identifying data associated with a communication session between a first node and a second node in the data network, the identifying of data associated with the communication session including;

performing signature analysis on an initial portion of the data associated with the communication session to identify further processing to apply to data of the communication session, the further processing identifying at least one data processing action to be performed with regard to data of the communication session;

storing an identifier of the communication session in association with an identifier of the identified further processing;

processing subsequently received data of the communication session according to the identified further processing; and

prior to and until identifying the further processing, permitting data associated with the communication session to pass between the first node and the second node;

performing the further processing data of said communication session when a portion of said communication session meets a criterion as identified through performance of the signature analysis on the initial portion of data associated with the communication session and subsequently received data of the communication session, said further processing comprises;

terminating said communication session at a third node;

dividing said communication session into a first communication session between the first node and said third node and a second communication session between said third node and the second node, said third node acting as a proxy node; and

altering data of said communication session prior to transmitting the data to at least one of the first and second nodes within the first and second communication sessions, respectively; and

permitting said communication session to continue when said portion of said communication session does not meet said criterion.

9. The non-transitory device-readable medium of claim 8, wherein said permitting said communication session to continue comprises permitting said communication session to continue on a first data transfer path and wherein said further processing said communication session comprises diverting said communication session to a second data transfer path, said second data transfer path being slower than said first data transfer path.

10. The non-transitory device-readable medium of claim 8, wherein said permitting said communication session to continue when said portion of said communication session does not meet said criterion comprises permitting a first portion of said communication session to continue while determining whether another portion of said communication session meets said criterion.

11. The non-transitory device-readable medium of claim 10, wherein the transfer of data comprises a plurality of data packets and wherein said permitting a first portion of said communication session to continue comprises permitting a first plurality of data packets associated with said communication session to be transferred while determining whether at least one subsequent data packet associated with said communication session meets said criterion.

12. The non-transitory device-readable medium of claim 8, wherein said communication session is a first communication session and wherein the third node splits the first communication session into the first and the second communication session including originating the second communication session and further comprising further processing said second communication session regardless of whether said second communication session meets said criterion.

13. The non-transitory device-readable medium of claim 8, further comprising associating a label with said data associated with said communication session in accordance with whether said portion of said communication session meets said criterion or does not meet said criterion.