SYSTEMS AND METHODS FOR MANAGING APPLICATION SECURITY PROFILES

• US 20130298190A1
• Filed: 07/03/2013
• Published: 11/07/2013
• Est. Priority Date: 03/12/2007
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Sikka, Namit, Reddy, Anoop, Mirani, Rajiv, Chauhan, Abhishek
• Granted Patent: US 9,160,768 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems and methods for configuring and evaluating policies that direct processing of one or more data streams are described. A configuration interface is described for allowing users to specify object oriented policies. These object oriented policies may allow any data structures to be applied with respect to a payload of a received packet stream, including any portions of HTTP traffic. A configuration interface may also allow the user to control the order in which policies and policy groups are executed, in addition to specifying actions to be taken if one or more policies are undefined. Systems and methods for processing the policies may allow efficient processing of object-oriented policies by applying potentially complex data structures to unstructured data streams. A device may also interpret and process a number of flow control commands and policy group invocation statements to determine an order of execution among a number of policies and policy groups. These policy configurations and processing may allow configuration and processing of complex network behaviors relating to load balancing, VPNs, SSL offloading, content switching, application security, acceleration, and caching.

Claims

1-34. -34. (canceled)

35. A method for executing by an application firewall an application security profile for a type of network traffic, the method comprising:

(a) identifying, by an application firewall executing on a device intermediary to a plurality of clients and one or more servers, an application security profile specifying a type of network traffic the firewall profile applies to and one or more application firewall security checks selected from a plurality of application firewall security checks to apply to the type of network traffic;

(b) identifying, by the application firewall, a firewall policy that specifies the application security profile as an action to take as a result of evaluating a rule of the firewall policy;

(c) applying, by the application firewall, the firewall policy to a packet received by the device corresponding to the type of network traffic; and

(d) processing, by the application firewall responsive to evaluation of the rule of the firewall policy, the one or more application firewall security checks of the application security profile to the packet.

36. The method of claim 35, wherein the application security profile specifies for each of the one or more application firewall security checks whether to block or log corresponding network traffic.

37. The method of claim 36, wherein step (d) further comprises one of blocking or logging, the application firewall, the packet in accordance with the one or more application firewall security checks.

38. The method of claim 35, wherein the rule of the firewall policy comprises an object oriented expression that specifies a user selected data structure to explicitly typecast application layer data within a packet into a predetermined user selected data type.

39. The method of claim 38, wherein step (c) further comprises determining, by the application firewall, that the packet evaluates the object oriented expression of the rule to true.

40. The method of claim 35, wherein the rule of the firewall policy comprises an object oriented expression that specifies a device defined data structure to explicitly typecast application layer data within a packet into a predetermined device defined data type.

41. The method of claim 40, wherein step (c) further comprises determining, by the application firewall, that the packet evaluates the object oriented expression of the rule to true.

42. The method of claim 35, wherein each of the one or more application firewall security checks performs one of the following:

SQL injection blocking, invalid starting URL blocking, cookie tampering blocking, inconsistent form field blocking, buffer overflow blocking, cross-site scripting blocking, credit card number blocking and invalid URL blocking.

43. The method of claim 35, wherein step (d) further comprising determining, by the application firewall, that a uniform resource locator of a packet in the packet stream matches a setting in an application firewall security check of the one or more application firewall security checks.

44. The method of claim 35, wherein step (d) further comprises processing, by the application firewall, each of the one or more application firewall security checks in accordance with user selected settings configured for each of the one or more application firewall security checks.

45. A system for executing by an application firewall an application security profile for a type of network traffic, the system comprising:

a device intermediary to a plurality of clients and one or more servers;

an application firewall executable on the device and configured to identify an application security profile specifying a type of network traffic the firewall profile applies to and one or more application firewall security checks selected from a plurality of application firewall security checks to apply to the type of network traffic and to identify a firewall policy that specifies the application security profile as an action to take as a result of evaluating a rule of the firewall policy;

wherein the application firewall is configured to apply the firewall policy to a packet received by the device corresponding to the type of network traffic and responsive to evaluation of the rule of the firewall policy process the one or more application firewall security checks of the application security profile to the packet.

46. The system of claim 45, wherein the application security profile specifies for each of the one or more application firewall security checks whether to block or log corresponding network traffic.

47. The system of claim 46, wherein the application firewall is configured to one of block or log the packet in accordance with the one or more application firewall security checks.

48. The system of claim 45, wherein the rule of the firewall policy comprises an object oriented expression that specifies a user selected data structure to explicitly typecast application layer data within a packet into a predetermined user selected data type.

49. The system of claim 48, wherein the application firewall is further configured to determine that the packet evaluates the object oriented expression of the rule to true.

50. The system of claim 45, wherein the rule of the firewall policy comprises an object oriented expression that specifies a device defined data structure to explicitly typecast application layer data within a packet into a predetermined device defined data type.

51. The system of claim 50, wherein the application firewall is further configured to determine that the packet evaluates the object oriented expression of the rule to true.

52. The system of claim 45, wherein each of the one or more application firewall security checks is configured to perform one of the following:

SQL injection blocking, invalid starting URL blocking, cookie tampering blocking, inconsistent form field blocking, buffer overflow blocking, cross-site scripting blocking, credit card number blocking and invalid URL blocking.

53. The system of claim 45, wherein the application firewall is further configured to determine that a uniform resource locator of a packet in the packet stream matches a setting in an application firewall security check of the one or more application firewall security checks.

54. The system of claim 45, wherein the application firewall is further configured to process each of the one or more application firewall security checks in accordance with user selected settings configured for each of the one or more application firewall security checks.