Methods and systems for context-based application firewalls

• US 9,736,117 B2
• Filed: 06/27/2016
• Issued: 08/15/2017
• Est. Priority Date: 06/25/2010
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Gluck, Yoel
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): NGUYEN, NGOC THACH D
• Application Number:
  US15/194,429
• Publication Number:
  US 20160308835A1
• Time in Patent Office: 414 Days
• Field of Search: None
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Context-based application firewall functionality. A user session is initiated with a client device. The user session allows access a remote resource on a server device coupled with the client device over a network. The connection between the client device and the remote resource is through an application firewall. An application firewall context setup is performed with the application firewall in response to the user session. The application firewall context comprises firewall context information to be used during the user session to perform network and application security operations with the application firewall. A response is created to provide information from the remote resource to the client device. The response includes metadata to be used to update the firewall context information. The firewall context information is updated with the application firewall based on the metadata. The response is transmitted to the client device.

Claims

1. A method comprising:

running an application level firewall on a hardware computing device in response to initiation of a user session with a remote resource to provide application level or higher analysis of network traffic and to utilize context information shared between the application level firewall and one or more applications to be used during the user session to perform network and application security operations with the application level firewall and at least one of the one or more applications to make security evaluations;

receiving, with the application level firewall, a response to provide information from at least one application to at least one client hardware computing device, the response having at least metadata to be used to update the firewall context information;

updating the context information using the application level firewall based on the metadata; and

transmitting, with the application level firewall, the response to the client hardware computing device.

2. The method of claim 1, wherein the remote resource comprises a resource that is available in a multitenant environment.

3. The method of claim 1 wherein the firewall context information comprises one or more of:

translation information, field validation information and/or request/response validation information.

4. The method of claim 1 wherein the firewall context information comprises one or more of:

traffic policy information, user information and/or organization information.

5. The method of claim 1 wherein the firewall context information comprises one or more of:

session information and/or score information.

6. The method of claim 1 wherein the application context information comprises one or more of:

translation information, field validation information and/or request/response validation information.

7. The method of claim 1 wherein the application context information comprises one or more of:

traffic policy information, user information and/or organization information.

8. The method of claim 1 wherein the application context information comprises one or more of:

session information and/or score information.

9. An article comprising a non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to:

run an application level firewall on a hardware computing device in response to initiation of a user session with a remote resource to provide application level or higher analysis of network traffic and to utilize context information shared between the application level firewall and one or more applications to be used during the user session to perform network and application security operations with the application level firewall and at least one of the one or more applications to make security evaluations;

receive, with the application level firewall, a response to provide information from at least one application to at least one client hardware computing device, the response having at least metadata to be used to update the firewall context information;

update the context information using the application level firewall based on the metadata; and

transmit, with the application level firewall, the response to the client hardware computing device.

10. The article of claim 9, wherein the remote resource comprises a resource that is available in a multitenant environment.

11. The article of claim 9 further comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform an application context setup with the remote resource on the server device in response to the user session, the application context information to be used during the user session to perform network and application security operations with the remote resource.

12. The article of claim 9 wherein the firewall context information comprises one or more of:

translation information, field validation information and/or request/response validation information.

13. The article of claim 9 wherein the firewall context information comprises one or more of:

traffic policy information, user information and/or organization information.

14. The article of claim 9 wherein the firewall context information comprises one or more of:

session information and/or score information.

15. The article of claim 9 wherein the application context information comprises one or more of:

translation information, field validation information and/or request/response validation information.

16. The article of claim 9 wherein the application context information comprises one or more of:

traffic policy information, user information and/or organization information.

17. The article of claim 9 wherein the application context information comprises one or more of:

session information and/or score information.

18. A system comprising:

at least one memory device; and

one or more server hardware computing systems communicatively coupled with the at least one memory device, the server systems to run an application level firewall in response to initiation of a user session with a remote resource to provide application level or higher analysis of network traffic and to utilize context information shared between the application level firewall and one or more applications to be used during the user session to perform network and application security operations with the application level firewall and at least one of the one or more applications to make security evaluations, to receive a response to provide information from at least one application to at least one client hardware computing device, the response having at least metadata to be used to update the firewall context information, to update the context information based on the metadata, and to transmit the response to the client hardware computing device.

19. The system of claim 18 wherein the firewall context information comprises one or more of:

translation information, field validation information and/or request/response validation information.

20. The system of claim 18 wherein the firewall context information comprises one or more of:

traffic policy information, user information and/or organization information.

21. The system of claim 18 wherein the firewall context information comprises one or more of:

session information and/or score information.

22. The system of claim 18 wherein the application context information comprises one or more of:

translation information, field validation information and/or request/response validation information.

23. The system of claim 18 wherein the application context information comprises one or more of:

traffic policy information, user information and/or organization information.

24. The system of claim 23 wherein the application context information comprises one or more of:

session information and/or score information.