Systems and methods for implementing protocol enforcement rules

• US 20070124577A1
• Filed: 12/06/2005
• Published: 05/31/2007
• Est. Priority Date: 06/10/2002
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Akonix
• Inventors: Scott, Robert, Nielsen, Mary
• Granted Patent: US 7,774,832 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A protocol management system is capable of detecting certain message protocols and applying policy rules to the detected message protocols that prevent intrusion, or abuse, of a network'"'"'s resources. In one aspect, a protocol message gateway is configured to apply policy rules to high level message protocols, such as those that reside at layer 7 of the ISO protocol stack.

Claims

1. A protocol management system coupled with a local network, the local network interfaced with an external network, the protocol management system comprising a protocol enforcers, the protocol enforcers comprising:

a plurality of protocol inspectors each configured to inspect packets as they enter and exit the local network, each of the plurality of protocol inspectors including a state machine configured to execute a plurality of inspection primitives, each of the plurality of inspection primitives configured to analyze a particular packet for one type of signature or pattern;

a protocol inspection manager configured to merge the state machines for each of the plurality of protocol inspectors into a composite state machine; and

a protocol state machine configured to maintain the state of all connections of interest.

2. The protocol management system of claim 1, wherein each of plurality of protocol inspectors has knowledge of one network protocol.

3. The protocol management system of claim 1, wherein each of the plurality of protocol inspectors is further configured to examine a header of a packet using the inspection primitives within the associated state machine.

4. The protocol management system of claim 1, wherein each of the plurality of protocol inspectors is further configured to examine a data segments of a packet using the inspection primitives within the associated state machine.

5. The protocol management system of claim 1, wherein each inspection primitive is configured to return a result, wherein the results can include success, failure, and not applicable.

6. The protocol management system of claim 5, wherein each of the results is mapped to a state or an exit code.

7. The protocol management system of claim 1, wherein the results of the analysis by each of the inspection primitives determines which inspection primitive within the state machine is executed next or if the protocol has been identified.

8. The protocol management system of claim 1, wherein each state machine associated with the plurality of protocol inspectors can comprise between and 100 inspection primitives.

9. The protocol management system of claim 1, wherein the protocol inspection manager is configured to remove any duplicate states from the composite state machine.

10. The protocol management system of claim 1, further comprising a tokenizer configured to identify a specified sequence of bytes within a packet.

11. The protocol management system of claim 10, wherein the tokenizer is configured to inform the protocol inspection manger when it has identified the specified sequence of bytes.

12. The protocol management system of claim 10, wherein the protocol inspection manager is configured to inform the tokenizer of the specified sequence of bytes.

13. The protocol management system of claim 10, wherein the tokenizer is configured to perform a single pass, lexigraphical scan of the packet when instructed to do so by the protocol inspection manager.

14. The protocol management system of claim 1, wherein the protocol state machine is configured to maintain the source IP address for each connection of interest.

15. The protocol management system of claim 1, wherein the protocol state machine is configured to maintain the destination IP address for each connection of interest.

16. The protocol management system of claim 1, wherein the protocol state machine is configured to maintain the source port for each connection of interest.

17. The protocol management system of claim 1, wherein the protocol state machine is configured to maintain the destination port for each connection of interest.

18. The protocol management system of claim 1, wherein the protocol state machine is configured to maintain the source sequence number for each connection of interest.

19. The protocol management system of claim 1, wherein the protocol state machine is configured to maintain the destination sequence number for each connection of interest.

20. The protocol management system of claim 1, wherein the protocol state machine is configured to maintain the protocol for each connection of interest.

21. The protocol management system of claim 1, wherein the protocol state machine is configured to maintain the protocol state number for each connection of interest.

22. The protocol management system of claim 1, wherein the protocol enforcer is configured to execute actions defined by rules associated with each identified network protocol.

23. The protocol management system of claim 22, wherein the rules for each network protocol include enforce, allow, log, and alert.

24. The protocol management system of claim 22, wherein each rule includes a network criteria and a rule actions.

25. The protocol management system of claim 24, wherein the network criteria for each rule include the set of IP addresses, ports, and protocols that are compared with each packet.

26. protocol management system of claim 24, wherein the rule actions comprise the events that are executed when a packet is matched with the rules network criteria.