Hierarchical rule development and binding for web application server firewall

Patent metadata

Field	Value
Publication number	US-9237130-B2
Application number	US-201414147857-A
Country	US
Kind code	B2
Filing date	Jan 6, 2014
Priority date	May 24, 2011
Publication date	Jan 12, 2016
Grant date	Jan 12, 2016

Abstract

At least one of an HTTP request message and an HTTP response message is intercepted. A corresponding HTTP message model includes a plurality of message model sections. A representation of the at least one of an HTTP request message and an HTTP response message is parsed into message sections in accordance with the message model sections of the HTTP message model. A plurality of security rules are bounds to the message model sections. The plurality of security rules each specify at least one action to be taken in response to a given condition, which is based, at least in part, on a corresponding given one of the message sections. The at least one of an HTTP request message and an HTTP response message is processed in accordance with the plurality of security rules. Techniques for developing rules for a web application server firewall are also provided.

First claim

What is claimed is:

1. A method of operating a central processor configuring a web application server firewall, which enabled inside a web application server, to process HTTP request messages and HTTP response messages received from at least one client computer in accordance with a plurality of security rules, said method comprising the steps of:
building a plurality of HTTP message models having parent portions and child portions, said plurality of HTTP message models including a first HTTP message model configured to process said HTTP request messages and a second HTTP message model configured to process said HTTP response messages, each of said first and second HTTP message models comprising a plurality of message model sections;
developing said plurality of security rules, each security rule specifying at least one action responsive to a given condition, said given condition being based, at least in part, on a corresponding section of a message intercepted by said web application server firewall; and
binding said plurality of security rules to said message model sections, wherein said binding comprises inheriting, by at least one child portion of at least one of the plurality of HTTP message models, at least one of said plurality of security rules from at least one of the parent portions of said at least one of the plurality of HTTP message models.

2. The method of claim 1 , wherein said building and developing steps further comprise causing at least one given one of said plurality of security rules which is written for a parent portion of at least one of said first and second HTTP message models to be inherited for a respective child portion of said at least one of said first and second HTTP message models.

3. The method of claim 2 , wherein said building and developing steps further comprise chaining at least two given ones of said plurality of security rules together based on at least said given condition being common to both of said at least two given ones of said plurality of security rules.

4. The method of claim 1 , wherein said building said plurality of HTTP message models is performed in a Unified Modeling Language.

5. The method of claim 2 , further comprising providing a rule development tool system, wherein said rule development tool system comprises distinct software modules, each of said distinct software modules being embodied on a computer-readable storage medium, and wherein said distinct software modules comprise a message modeling module, a rule modeling module, and a message rule binding module;
wherein:
said building of said plurality of HTTP message models is carried out by said message modeling module executing on at least one hardware processor;
said developing of said plurality of security rules is carried out by said rule modeling module executing on said at least one hardware processor; and
said binding is carried out by said message rule binding module executing on said at least one hardware processor.

6. An article of manufacture comprising a computer program product for configuring a web application server firewall, which enabled inside a web application server, to process HTTP request messages and HTTP response messages received from at least one client computer in accordance with a plurality of security rules, said computer program product comprising:
a non-transitory computer readable storage medium storing computer readable program code, said computer readable program code comprising:
computer readable program code configured to build a plurality of HTTP message models having parent portions and child portions, said plurality of HTTP message models including a first HTTP message model configured to process said HTTP request messages and a second HTTP message model configured to process said HTTP response messages, each of said first and second HTTP message models comprising a plurality of message model sections;
computer readable program code configured to develop said plurality of security rules, each security rule specifying at least one action responsive to a given condition, said given condition being based, at least in part, on a corresponding section of a message intercepted by said web application server firewall; and
computer readable program code configured to bind said plurality of security rules to said message model sections, wherein said binding comprises inheriting, by at least one child portion of at least one of the plurality of HTTP message models, at least one of said plurality of security rules from at least one of the parent portions of said at least one of the plurality of HTTP message models.

7. The article of manufacture of claim 6 , wherein said computer readable program code configured to build and said computer readable program code configured to develop further comprise computer readable program code configured to cause at least one given one of said plurality of security rules which is written for a parent portion of at least one of said first and second HTTP message models to be inherited for a respective child portion of said at least one of said first and second HTTP message models.

8. The article of manufacture of claim 7 , wherein said computer readable program code configured to build and said computer readable program code configured to develop further comprise computer readable program code configured to chain at least two given ones of said plurality of security rules together based on at least said given condition being common to both of said at least two given ones of said plurality of security rules.

9. The article of manufacture of claim 7 , wherein said computer readable program code configured to build said plurality of HTTP message models further comprises computer readable program code configured to build said plurality of HTTP message models in a Unified Modeling Language.

Assignees

• IBM

Inventors

• Ji Peng
• Luo Lin
• Sreedhar Vugranam C
• Yang Shun Xiang
• Zhang Yu

Classifications

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/0263 Primary

  Rule management · CPC title