Stateful application firewall

• US 8,161,538 B2
• Filed: 09/08/2005
• Issued: 04/17/2012
• Est. Priority Date: 09/13/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Kausik, Balas Natarajan
• Primary Examiner(s): Homayounmehr, Farid
• Application Number:
  US11/222,402
• Publication Number:
  US 20060059550A1
• Time in Patent Office: 2,413 Days
• Field of Search: 726/11
• US Class Current: 726/11
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method and system to protect web applications from malicious attacks is described. A stateful means of distinguishing between valid (e.g., harmless) and invalid (e.g., harmful) accesses is provided. A request from a content browser for content from an application server is forwarded by a firewall to the application server if it includes a URL that was previously transmitted from the application server. The firewall performs a security evaluation of the request if the URL of the request was not previously transmitted from the application server.

Claims

1. A method comprising:

receiving a request for content from an application server by a remote browser, the request corresponding to a session of the remote browser;

at an application firewall located between the application server and the remote browser determining that a Uniform Resource Locator (URL) included in the request is absent from, a list of URL'"'"'s previously sent from the application server in responding to previously received requests;

performing a security evaluation of the request in response to the determining that the URI, is absent from the list, the security evaluation being based on an attribute of the request, the security evaluation being performed by a computer using a processor of the computer; and

processing the request with a particular operation and a plurality of requests with the particular operation, the particular operation being based on the security evaluation of the request, the plurality of requests corresponding to the session of the remote browser and being received subsequent to the receiving of the request.

2. The method of claim 1, wherein the attribute is selected from a group consisting of:

the URL included in the request;

a parameter of the request;

a source Internet Protocol (IP) address of the request;

a Multipurpose Event Mail Extension (MIME) type of the request;

a browser cookie of the request;

a header of the request;

a Hypertext Transferred Protocol (HTTP) method of the request; and

information included in a body of the request.

3. The method of claim 1, wherein the particular operation includes es at least one of

blocking the request from the application server,

pausing the request for a predetermined time, or

redirecting the request to a different location.

12. The method of claim 1, further comprising

determining a classification of the request, the classification being determined based on the security evaluation of the request;

and wherein

the particular operation is based on the classification of the request.

4. A non-transitory machine-readable medium embodying instructions which, when executed by one or more processors of a machine, cause the machine to perform operations comprising:

receiving a request for content from an application server by a remote browser, the request corresponding to a session of the remote browser;

at an application firewall located between the application server and the remote browser, determining that a Uniform Resource Locator (URL) included in the request is absent from the list of URL'"'"'s previously sent from the application server in responding to previously received requests;

performing a security evaluation of the request in response to the determining that the URL is absent from the list, the security evaluation being based on an attribute of the request;

processing the request with a particular operation and a plurality of subsequent requests with the particular operation, the particular operation being based on the security evaluation, the plurality of subsequent requests corresponding to the session of the remote browser and being received subsequent to the receiving of the request.

6. The method of claim 4, wherein the attribute is selected from a group consisting of:

the URL included in the HTTP request;

a parameter of the HTTP request;

a source IP address of the HTTP request;

a MIME type of the HTTP request;

a browser cookie of the HTTP request;

a header of the HTTP request;

an HTTP method of the HTTP request; and

information included in a body of the HTTP request.

7. The method of claim 4, wherein the particular operation includes at least one of

blocking the request from the application server,

pausing the HTTP request for a predetermined time, or

redirecting the HTTP request to a different location.

5. A method comprising:

maintaining a list of Uniform Resource Locators (URL'"'"'s), the URL'"'"'s being previously sent from an application server in responding to previously received requests;

receiving a Hyper Text Transfer Protocol (HTTP) request from a remote browser to access the application server, the HTTP request corresponding to a session of the remote browser;

at an application firewall located between the application server and the remote browser, determining that a URL included in the HTTP request is absent from the list of URL'"'"'s previously sent from the application server;

performing a security evaluation of the HTTP request in response to the determining that the URL is absent from the list, the security evaluation being based on an attribute of the HTTP request, the security evaluation being performed by a computer using a processor of the computer; and

processing the HTTP request with a particular operation and a subsequent plurality of requests with the particular operation, the particular operation being based on the security evaluation of the HTTP request, the subsequent plurality of requests corresponding to the session of the remote browser and being received subsequent to the receiving of the HTTP request.

8. A non-transitory machine-readable medium embodying instructions which, when executed by one or more processors of a machine, cause the machine to perform operations comprising:

maintaining a list of URL'"'"'s, the URL'"'"'s being previously sent from an application server in responding to previously received requests;

receiving an HTTP request from a remote browser to access the application server, the HTTP request corresponding to a session of the remote browser;

at an application firewall located between the application server and the remote browser, determining that a URL included in the HTTP request is absent from the list of URL'"'"'s previously sent from the application server;

performing a security evaluation of the HTTP request in response to the determining that the URL is absent from the list, the security evaluation being based on an attribute of the HTTP request; and

processing the HTTP request with a particular operation and a subsequent plurality of requests with the particular operation, the particular operation being based on the security evaluation of the HTTP request, the subsequent plurality of requests corresponding to the session of the remote browser and being received subsequent to the receiving of the HTTP request.

9. An application firewall system comprising:

a processor coupled to communicate with a content browser and coupled to communicate with an application server, wherein the processor is configured to;

maintain a list of Uniform Resource Locators (URL'"'"'s), the URL'"'"'s being previously sent from the application server in responding to previously received requests;

receive an HTTP request from a remote browser to access the application server, the HTTP request corresponding to a session of the remote browser;

determine that a URL included in the HTTP request is absent from the list of URL'"'"'s;

perform a security evaluation of the HTTP request in response to the determining that the URL is absent from the list, the security evaluation being based on an attribute of the HTTP request; and

process the HTTP request with a particular operation and a plurality of requests with the particular operation, the particular operation being based on the security evaluation of the HTTP request, the plurality of requests corresponding to the session of the remote browser and being received subsequent to the receiving of the HTTP request.

10. The application firewall of claim 9 wherein the processor is shared with the application server.

11. A server comprising:

a network interface to interface the server to a network; and

a processor configured to;

maintain a list of Uniform Resource Locators (URL'"'"'s), the URL'"'"'s being previously sent from the application server in responses to previously received requests;

receive a Hyper Text Transfer Protocol (HTTP) request from a remote browser to access the application server, the HTTP request corresponding to a session of the remote browser;

at an application firewall located between the application server and the remote browser, determine that a URL included in the HTTP request is absent from the list of URL'"'"'s;

perform a security evaluation of the HTTP request in response to the determining that the URL is absent from the list, the security evaluation being based on an attribute of the HTTP request; and

process the HTTP request with a particular operation and a plurality of requests with the particular operation, the particular operation being based on the security evaluation of the HTTP request, the plurality of requests corresponding to the session of the remote browser and being received subsequent to the receiving of the HTTP request.