Computerized system and method for advanced network content processing

• US 8,925,065 B2
• Filed: 06/17/2013
• Issued: 12/30/2014
• Est. Priority Date: 01/13/2006
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Krywaniuk, Andrew
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US13/919,488
• Publication Number:
  US 20130305346A1
• Time in Patent Office: 561 Days
• Field of Search: 726/11
• US Class Current: 726/11
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computerized system and method for processing network content in accordance with at least one content processing rule. In accordance with the inventive method, the network content is received at a first interface. The inventive system identifies a transmission protocol information of the received network content and uses the identified transmission protocol information to intercept at least a portion of the received network content formatted in accordance with a transmission protocol. The intercepted portion of the network content is redirected to a proxy, which buffers the redirected portion of network content. The buffered network content is scanned in accordance with a scanning criterion and processed in accordance with the at least one content processing rule based on the result of the scanning. The processed portion of network content may be forwarded using the second interface.

Claims

1. A computer-implemented method comprising:

receiving a plurality of packets at a first interface of a multi-purpose network protection firewall device including one or more processors and a memory;

identifying a first transmission protocol according to which network content distributed among a first subset of packets of the plurality of packets is formatted;

using information regarding the identified first transmission protocol to redirect the first subset of packets to a first proxy module integrated within the multi-purpose protection firewall device;

extracting the network content from the first subset of packets and buffering at least a portion of the network content by the first proxy module;

processing, by the first proxy module, the buffered portion of the network content in accordance with at least one content processing rule selected from a plurality of content processing rules based on the identified first transmission protocol, wherein the plurality of content processing rules includes one or more content filtering rules;

identifying a second transmission protocol distinct from the first transmission protocol according to which network content distributed among a second subset of packets of the plurality of packets is formatted; and

using information regarding the identified second transmission protocol to redirect the second subset of packets to a second proxy module integrated within the multi-purpose protection firewall device,

wherein the first and second proxy modules are implemented at least in part by the one or more processors and the memory, the memory having instructions tangibly embodied therein representing at least a portion of the first and second proxy modules that are executable by the one or more processors.

2. The computer-implemented method of claim 1, wherein the processing comprises filtering the buffered portion of the network content.

3. The computer-implemented method of claim 1, wherein an additional content processing rule is selected from the plurality of content processing rules based on traffic selectors associated with the network content.

4. The computer-implemented method of claim 1, further comprising forwarding the processed portion of the network content to a destination using a second interface.

5. The computer-implemented method of claim 4, wherein at least one of the first and second interfaces are networking interfaces selected from a group consisting of a Virtual Local Area Network (VLAN) interface, a Point-to-Point Protocol over Ethernet (PPPoE) interface and an Internet Protocol Security (IPsec) tunnel interface.

6. The computer-implemented method of claim 1, wherein the second transmission protocol is an (IM) protocol type, a peer-to-peer protocol type, an e-mail protocol type, a web browsing protocol type, a file sharing protocol type or a network news protocol type.

7. The computer-implemented method of claim 1, wherein the second transmission protocol is Simple Mail Transfer Protocol (SMTP), Post Office Protocol (POP), Internet Message Access Protocol (IMAP), Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP) or telnet protocol.

8. The computer-implemented method of claim 1, further comprising anti-malware scanning of network content distributed among the second subset of packets.

9. The computer-implemented method of claim 1, further comprising scanning network content distributed among the second subset of packets.

10. The computer-implemented method of claim 9, wherein the processing further comprises blocking content that has been identified during the scanning operation.

11. A multi-purpose network protection firewall device comprising:

a first interface operable to receive a plurality of packets formatted in accordance with a plurality of transmission protocols;

a first proxy module and a second proxy module, each integrated within the multi-purpose network protection firewall device and coupled in communication with the first interface; and

a networking subsystem, coupled in communication with the first proxy module and the second proxy module, operable to;

identify a first transmission protocol of the plurality of transmission protocols according to which network content distributed among a first subset of packets of the plurality of packets is formatted,

use information regarding the identified first transmission protocol to redirect the first subset of packets to the first proxy module;

identify a second transmission protocol distinct from the first transmission protocol according to which network content distributed among a second subset of packets of the plurality of packets is formatted;

use information regarding the identified second transmission protocol to redirect the second subset of packets to a second proxy module,

wherein the first proxy module is configured to extract the network content from the first subset of packets, buffer at least a portion of the network content, and process the buffered portion of the network content in accordance with the at least one content processing rule selected from a plurality of content processing rules including one or more content filtering rules based on the identified transmission protocol.

12. The multi-purpose network protection firewall device of claim 11, wherein the first proxy module is operable to scan the buffered portion of the network content in accordance with at least one scanning criterion.

13. The multi-purpose network protection firewall device of claim 11, wherein the first proxy module further comprises:

a first proxy buffering engine operable to buffer the portion of the network content;

at least one scanning engine operable to process the buffered portion of the network content in accordance with the at least one content processing rule; and

a proxy forwarding engine operable to forward the processed portion of the network content to a second interface.

14. The multi-purpose network protection firewall device of claim 11, further comprising a rule server operable to provide the at least one content processing rule to the proxy module via a network.

15. The multi-purpose network protection firewall device of claim 11, further comprising a second interface operable to forward the processed portion of the network content to a destination.

16. The multi-purpose network protection firewall device of claim 15, wherein at least one of the first and second interfaces are networking interfaces selected from a group consisting of a Virtual Local Area Network (VLAN) interface, a Point-to-Point Protocol over Ethernet (PPPoE) interface and an Internet Protocol Security (IPsec) tunnel interface.

17. The multi-purpose network protection firewall device of claim 11, wherein the second transmission protocol is an (IM) protocol type, a peer-to-peer protocol type, an e-mail protocol type, a web browsing protocol type, or a file sharing protocol type.

18. The multi-purpose network protection firewall device of claim 11, wherein the second transmission protocol is Simple Mail Transfer Protocol (SMTP), Post Office Protocol (POP), Internet Message Access Protocol (IMAP), Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP) or telnet protocol.

19. The multi-purpose network protection firewall device of claim 11, wherein the first proxy module is operable to filter the buffered portion of the network content.

20. A non-transitory computer-readable storage medium tangibly embodying one or more sequences of instructions, which when executed by one or more processors of a multi-purpose network protection firewall device, causes the one or more processors to perform a method comprising:

receiving a plurality of packets formatted in accordance with a plurality of transmission protocols at a first interface of the multi-purpose network protection firewall device;

identifying a first transmission protocol according to which network content distributed among a first subset of packets of the plurality of packets is formatted;

using information regarding the identified first transmission protocol to redirect the first subset of packets to a first proxy module integrated within the multi-purpose protection firewall device;

extracting the network content from the first subset of packets and buffering at least a portion of the network content by the first proxy module;

processing, by the first proxy module, the buffered portion of the network content in accordance with the at least one content processing rule selected from a plurality of content processing rules based on the identified transmission protocol, wherein the plurality of content processing rules includes one or more content filtering rules;

identifying a second transmission protocol distinct from the first transmission protocol according to which network content distributed among a second subset of packets of the plurality of packets is formatted; and

using information regarding the identified second transmission protocol to redirect the second subset of packets to a second proxy module integrated within the multi-purpose protection firewall device.