SYSTEMS AND METHODS FOR USING OBJECT ORIENTED EXPRESSIONS TO CONFIGURE APPLICATION SECURITY POLICIES

• US 20080225719A1
• Filed: 03/12/2007
• Published: 09/18/2008
• Est. Priority Date: 03/12/2007
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Chauhan, Abhishek, Mirani, Rajiv, Khemani, Prakash, Korrapati, Vamsi
• Granted Patent: US 7,870,277 B2
• Time in Patent Office: Days
• US Class Current: 370/235
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Systems and methods for configuring and evaluating policies that direct processing of one or more data streams are described. A configuration interface is described for allowing users to specify object oriented policies. These object oriented policies may allow any data structures to be applied with respect to a payload of a received packet stream, including any portions of HTTP traffic. A configuration interface may also allow the user to control the order in which policies and policy groups are executed, in addition to specifying actions to be taken if one or more policies are undefined. Systems and methods for processing the policies may allow efficient processing of object-oriented policies by applying potentially complex data structures to unstructured data streams. A device may also interpret and process a number of flow control commands and policy group invocation statements to determine an order of execution among a number of policies and policy groups. These policy configurations and processing may allow configuration and processing of complex network behaviors relating to load balancing, VPNs, SSL offloading, content switching, application security, acceleration, and caching.

Claims

1. In an appliance, a method of applying object-oriented expressions in a policy to specify structure in a payload of a packet stream received by the appliance, the method comprising:

(a) identifying, by an appliance, a policy comprising an object-oriented expression to evaluate with respect to a payload of a received packet stream;

(b) assigning, by the appliance, values to a data structure specified by the object-oriented expression based on a portion of the payload;

(c) performing, by the appliance, an evaluation of the expression based on the assigned values;

(d) altering, in response to the evaluation, a portion of the received packet stream; and

(e) transmitting, by the appliance, the altered packet stream.

2. The method of claim 1,wherein the policy identifies a protocol.

3. The method of claim 2, further comprising parsing a portion of the payload according to the identified protocol.

4. The method of claim 2, wherein the protocol is HTTP.

5. The method of claim 1, wherein the expression specifies an object class corresponding to an HTTP request.

6. The method of claim 1, wherein the expression specifies an object class corresponding to an HTTP request, and an object class corresponding to a URL.

7. The method of claim 1, wherein the expression specifies an object class corresponding to an HTTP response body, and an object class corresponding to a URL.

8. The method of claim 1, wherein step (d) comprises altering a portion of the packet stream specified by the data structure.

9. The method of claim 1, wherein step (d) comprises altering a portion of the packet stream specified a second object-oriented expression.

10. The method of claim 1, wherein step (d) comprises rewriting a URL in the body of an HTTP response contained in the packet stream.

11. The method of claim 1, wherein step (d) comprises obscuring a credit card number contained in the packet stream.

12. The method of claim 1, wherein step (d) comprises rewriting a URL in an HTTP request.

13. The method of claim 1, wherein step (d) comprises rewriting a form field value of an HTTP response.

14. An appliance for applying object-oriented expressions in a policy to specify structure in a payload of a packet stream received by the appliance, the appliance comprising:

a packet processor which receives a packet stream; and

a policy engine which identifies a policy comprising an object-oriented expression to evaluate with respect to a payload of the received packet stream;

assigns values to a data structure specified by the object-oriented expression based on a portion of the payload;

performs, by the appliance, an evaluation of the expression based on the assigned values;

alters, in response to the evaluation, a portion of the received packet stream; and

transmits the altered packet stream.

15. The system of claim 14,wherein the policy identifies a protocol.

16. The system of claim 15,further comprising parsing a portion of the payload according to the identified protocol.

17. The system of claim 15, wherein the protocol is HTTP.

18. The system of claim 14, wherein the expression specifies an object class corresponding to an HTTP request.

19. The system of claim 14, wherein the expression specifies an object class corresponding to an HTTP request, and an object class corresponding to a URL.

20. The system of claim 14, wherein the expression specifies an object class corresponding to an HTTP response body, and an object class corresponding to a URL.

21. The system of claim 14, wherein the policy engine alters a portion of the packet stream specified by the data structure.

22. The system of claim 14, wherein the policy engine alters a portion of the packet stream specified a second object-oriented expression.

23. The system of claim 14, wherein the policy engine rewrites a URL in the body of an HTTP response contained in the packet stream.

24. The system of claim 14, wherein the policy engine obscures a credit card number contained in the packet stream.

25. The system of claim 14, wherein the policy engine rewrites a URL in an HTTP request.

26. The system of claim 14, wherein the policy engine rewrites a form field value of an HTTP response.