System and method for protecting service-level entities

Patent metadata

Field	Value
Publication number	US-9560011-B2
Application number	US-201213407468-A
Country	US
Kind code	B2
Filing date	Feb 28, 2012
Priority date	Feb 28, 2012
Publication date	Jan 31, 2017
Grant date	Jan 31, 2017

Abstract

An architecture is provided for protecting service-level entities. Such an architecture may escrow service requests prior to forwarding the requests to the service, and checking may be performed prior to releasing the request to the service. A crumple zone (CZ) architecture may be provided that buffers incoming service requests and may intercept attacks and/or sustain damage in lieu of the services being protected. The CZ may include an outward interface that is accessed by other entities, and the underlying service is not accessed directly. Elements of the CZ receive service requests, analyze them, and determine whether they can be safely executed by the underlying service.

First claim

What is claimed is:

1. A method for performing security functions in a service-oriented computer system, the method comprising acts of:
providing, for an entity in a distributed computer system, a service request from one or more entities for a service provided by one or more server computers associated with the entity that are adapted to process the service request;
sending a copy of the service request to a processor adapted to analyze the copy of the service request;
sending the service request to a memory;
storing the service request in the memory;
analyzing, by the processor, the copy of the service request for content harmful to the entity;
determining, by the processor, if the service request should be processed by the entity based on analyzing the copy of the service request wherein the processor is adapted to perform one or more analyses of the service request, the one or more analyses including at least one of a group comprising:
a signature analysis of one or more parameters associated with the copy of the service request;
an emulation of processing the copy of the service request; and
an analysis of a requester associated with the copy of the service request; and
if it is determined that the service request should be processed by the entity, responsive to the act of determining, forwarding the service request from the memory to the one or more server computers associated with the entity that are adapted to process the service request.

2. The method according to claim 1 , further comprising providing an interface that permits the creation of a hierarchical execution of the one or more analyses.

3. The method according to claim 1 , further comprising an act of executing the copy of the service request, by the processor, separately from an execution of the service request by the service.

4. The method according to claim 3 , wherein the act of executing the copy of the service request separately from an execution of the service request by the service is performed prior to forwarding the service request to the entity.

5. The method according to claim 1 , further comprising an act of releasing the stored service request from the memory and forwarding the service request to the entity responsive to the act of determining.

6. The method according to claim 5 , further comprising sending a control signal from the processor adapted to analyze the copy of the service request to the memory to release the service request from the memory.

7. The method according to claim 1 , wherein the processor adapted to analyze the copy of the service request is executed by a virtual machine (VM).

8. The method according to claim 1 , wherein the processor adapted to analyze the copy of the service request is executed selectively on one or more hosts.

9. The method according to claim 8 , wherein the processor adapted to analyze the copy of the service request is executed by a virtual machine (VM) executing on the one or more hosts.

10. The method according to claim 9 , further comprising an act of providing for the selective execution of the processor on one or more virtual machines including the virtual machine, the one or more virtual machines executing on the one or more hosts.

11. The method according to claim 1 , wherein the processor adapted to analyze the copy of the service request is executed as part of a group of processors adapted to execute other copies of service requests.

12. The method according to claim 11 , wherein the group of processors are arranged in a neighborhood cluster.

13. The method according to claim 12 , wherein the neighborhood cluster is assigned to and executed by a single virtual machine.

14. The method according to claim 12 , wherein the neighborhood cluster is combined with other neighborhood clusters into a neighborhood.

15. The method according to claim 14 , wherein the neighborhood is selectively created by at least one of a process and a user.

16. The method according to claim 14 , wherein the neighborhood is assigned to and executed by a single virtual machine.

17. A system for performing security functions in a service-oriented computer system, the system comprising:
a first processor adapted to receive a service request sent to an entity in a distributed computer system from one or more other entities, the service being provided by one or more server computers associated with the entity that are adapted to process the service request;
a memory that is adapted to store the service request;
a second processor adapted to analyze a copy of the service request, wherein the first processor adapted to receive the service request sends the service request to be stored in the memory, and is adapted to send a copy of the service request to the second processor adapted to analyze the copy of the service request, and wherein the second processor adapted to analyze the copy of the service request is adapted to analyze the copy of the service request for content harmful to the entity to produce an analysis result, determine whether the service request should be processed by the entity based on the analysis result, and if it is determined that the service request should be processed by the entity, the first processor adapted to receive the service request is adapted to forward the service request stored in memory to the one or more server computers associated with the entity that are adapted to process the service request, wherein the first processor adapted to receive the service request further comprises a splitter adapted to create a copy of the service request, forward the copy of the service request to the second processor adapted to analyze the copy of the service request, and forward the service request to the memory.

18. The system according to claim 17 , wherein the memory comprises a circular buffer that stores one or more service requests.

19. The system according to claim 17 , wherein the first processor adapted to receive the service request further comprises a splitter adapted to create a copy of the service request, forward the copy of the service request to the second processor adapted to analyze the copy of the service request, and forward the service request to the memory.

20. The system according to claim 17 , wherein the second processor adapted to analyze the copy of the service request further comprises at least one proxy entity adapted to analyze the copy of the service request.

21. The system according to claim 20 , wherein the second processor adapted to analyze the copy of the service request further comprises a plurality of proxy entities adapted to analyze the copy of the service request, wherein one or more of the plurality of proxy entities are adapted to perform at least one of a group of analyses of the copy of the service request, the group comprising inspection checking and emulation checking.

22. The system according to claim 21 , wherein inspection checking includes at least one of a group comprising:
rate limiting checking;
size checking; and
white list checking.

23. The system according to claim 21 , wherein emulation checking includes at least a partial emulation processing of the copy of the service request.

24. The system according to claim 20 , wherein the at least one proxy entity is adapted to analyze the service request prior to forwarding the service request to the entity.

25. The system according to claim 17 , wherein the second processor adapted to a

Assignees

• Pal Partha
• Atighetchi Michael
• Webb Jonathan
• Gronosky Andrew
• Loyall Joseph
• Adler Aaron
• Yaman-Sirin Fusun
• Raytheon Co

Inventors

• Pal Partha
• Atighetchi Michael
• Webb Jonathan
• Gronosky Andrew
• Loyall Joseph
• Adler Aaron
• Yaman-Sirin Fusun

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/0209 Primary

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title