Managing transfer of data in a data network

• US 9,729,655 B2
• Filed: 03/17/2016
• Issued: 08/08/2017
• Est. Priority Date: 09/06/2005
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Bevan, Stephen John, Xie, Michael, Luo, Wenping, Wei, Shaohong, Li, Hongwei
• Primary Examiner(s): ZHAO, DON GORDON
• Application Number:
  US15/073,459
• Publication Number:
  US 20170013077A1
• Time in Patent Office: 509 Days
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/43 Assembling or disassembling of packets, e.g. segmentation and reassembly [SAR]
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

A method and apparatus for managing a transfer of data in a data network identifies data associated with a communication session between a first node and a second node in the data network. Further processing of the communication session occurs when a portion of the communication session meets a criterion and the communication session is permitted to continue when the portion of the communication session does not meet the criterion.

Claims

1. A network gateway device, implemented at least partially in hardware, for managing a transfer of data over the data network, the network gateway device comprising:

a processor;

a signature analyzer comprising a policy manager to store policies and associated signatures, including a first policy that diverts data transfers between a plurality of nodes on the data network to a proxy server which scans for malicious code associated with at least one signature;

a network interface, communicatively coupled to the processor and the data network, to receive packets transmitted between the plurality of nodes of the data network;

a session identifier communicatively coupled to receive the packet from the network interface and to identify data associated with a first communication session between a first node and a second node of the data network,

wherein the signature analyzer further comprises a comparator, the signature analyzer to receive the identified data of the first communication session and the comparator comparing the identified data against signatures from a signature database, the signature analyzer to produce a control signal responsive to a policy associated with a signature matching the identified data; and

a session controller, responsive to receiving the control signal indicating the signature match, to perform further processing of the identified data, and responsive to the second input not receiving the control signal, the session controller sending the identified data over the second output without further processing.

2. The network gateway device of claim 1, wherein the signature analyzer does not produce the control signal if the amount of identified data received falls below a predetermined threshold, wherein the signature analyzer produces the control signal responsive to receiving enough data to meet the predetermined threshold in addition to finding the signature match.

3. The network gateway device of claim 1, wherein the signature analyzer does not produce the control signal responsive to not finding a signature matching the identified data, thereby allowing the data transfer without further processing.

4. The network gateway device of claim 1, wherein the signature analyzer produces the control signal comprising a first control signal, wherein the session controller further processes the identified data by dropping associated packets.

5. The network gateway device of claim 1, wherein the signature analyzer produces the control signal comprising a second control signal, wherein the session controller further processes the identified data by sending associated packets from the first node to the proxy server for virus scanning prior to forwarding to the second node.

6. The network gateway device of claim 1, wherein the session identifier identifies a second communication session that is distinct from the first communication session but is determined to be related to the first communication session, wherein the signature analyzer applies the first policy associated with the identified data of the first communication session.

7. The network gateway device of claim 1, wherein the signature comprises a pattern characteristic of a particular type of data transfer.

8. The network gateway device of claim 1, wherein said signature comprises a data protocol identifier.

9. The network gateway device of claim 1, wherein the signature comprises an address field.

10. The network gateway device of claim 1, wherein the signature analyzer comprises a hardware circuit comprising discrete logic components.

11. The network gateway device of claim 1, wherein the signature analyzer comprises an application specific integrated circuit (ASIC).

12. A computer-implemented method in a network gateway device, for managing a transfer of data over the data network, the method comprising:

storing policies and associated signatures in a policy manager of the gateway device, including a first policy that diverts data transfers between a plurality of nodes on the data network to a proxy server which scans for malicious code associated with at least one signature;

receiving, at a network interface of the network gateway device, packets transmitted between the plurality of nodes of the data network;

receiving, in a session identifier of the network gateway device, the packet from the network interface and identifying data associated with a first communication session between a first node and a second node of the data network,

receiving the identified data of the first communication session and comparing the identified data against signatures from a signature database with a comparator

producing a control signal responsive to a policy associated with a signature matching the identified data; and

responsive to receiving the control signal indicating the signature match, performing further processing of the identified data, and responsive to the second input not receiving the control signal, sending the identified data over the second output without further processing.