Automatically detecting and correcting missing and misconfigured security attributes

Patent metadata

Field	Value
Publication number	US-9762604-B2
Application number	US-201514814755-A
Country	US
Kind code	B2
Filing date	Jul 31, 2015
Priority date	Jul 31, 2015
Publication date	Sep 12, 2017
Grant date	Sep 12, 2017

Abstract

Some embodiments provide automated and intelligent security configuration at the network edge. A server tasked with distributing content provider content automatically detects and modifies attributes in the content provider content in order to close potential security vulnerabilities prior to redistributing that content on behalf of the content provider to different recipients. The vulnerabilities can arise from the content provider misconfiguring attributes or omitting certain security attributes when creating the content. The server can provide a default or customized set of protections, wherein the customized protections are specific to each content provider or the content of each content provider.

First claim

I claim:

1. A method comprising:
receiving a request from a client comprising at least one of a domain name, Internet Protocol (IP) address, and Uniform Resource Locator (URL) directed to content of a content provider;
retrieving from said content provider, at least one packet encapsulating said content provider content;
retrieving from different sets of security attributes defined by a plurality of content providers, a particular set of security attributes defined by said content provider based on one of the domain name, IP address, and URL from said request;
inspecting an original header of said packet;
detecting a security vulnerability based on an attribute defined in the original header violating at least one security attribute from the particular set of security attributes defined by the content provider;
modifying the original header before serving said packet to said client, wherein said modifying comprises producing a modified header from changing the attribute defined in said original header in resolution of the violation of the at least one security attribute from the particular set of security attributes defined by the content provider, wherein changing the attribute closes said security vulnerability; and
serving the packet with the modified header in response to said request for said content provider content.

2. The method of claim 1 further comprising storing the packet with the modified header to cache.

3. The method of claim 2 , wherein serving the packet comprises receiving a second request for the content provider content and serving the packet with the modified header from said cache without accessing the content provider.

4. The method of claim 1 , wherein detecting the security vulnerability comprises identifying the security vulnerability based on said attribute defined in the original header not matching to the at least one security attribute from the particular set of security attributes defined by the content provider.

5. The method of claim 1 , wherein modifying the original header comprises removing a header attribute from the original header violating the particular set of security attributes defined by the content provider.

6. The method of claim 1 , wherein modifying the original header comprises adding a new header attribute to the original header.

7. The method of claim 1 , wherein modifying the original header comprises changing a parameter for said attribute defined in the original header.

8. The method of claim 1 , wherein modifying the original header comprises configuring at least one of Access-Control-Allow-Origin, Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, and X-XSS-Protection security attributes in the original header.

9. The method of claim 1 , wherein inspecting the original header comprises identifying the content provider content as being retrievable using an unsecure connection, and wherein modifying the original header comprises configuring a security attribute requiring a secure connection in order to retrieve the content provider content.

10. The method of claim 1 , wherein modifying the original header comprises configuring the original header with a security attribute with an enumeration identifying one or more scripts, stylesheets, images, fonts, plugins, audio and video, and loading frames permitted to run with the content provider content.

11. The method of claim 1 , wherein modifying the original header comprises configuring the original header with a security attribute preventing unauthorized access to a cookie used in conjunction with the content provider content.

12. A method comprising:
providing an interface with which each of a plurality of content providers defines a different set of security policies to be enforced in delivering the respective content provider's content;
receiving a first request from a first client at a first server, said first request directed to at least one original packet for content of a particular content provider from the plurality of content providers;
retrieving in response to said first request, said original packet encapsulating part or all of the content from a second server of the particular content provider to the first server;
detecting a security vulnerability at the first server in response to attributes configured in the original packet violating at least one security policy from a particular set of security policies defined by the particular content provider using said interface;
closing said security vulnerability by producing a modified packet from said original packet at the first server, wherein producing the modified packet comprises at least one of removing an attribute from the original packet, modifying a parameter of an attribute in the original packet, and adding a new attribute to the original packet based on the particular set of security policies;
serving said modified packet from said first server to the first client in response to said first request;
storing the modified packet in place of the original packet in cache of said first server;
retrieving the modified packet from said cache of said first server without retrieving the original packet from the second server in response to a second request from a different second client directed to the at least one original packet; and
serving the modified packet from cache of the first server in response to said second request.

13. The method of claim 12 , wherein the attributes configured in the original packet comprise Hypertext Transfer Protocol (HTTP) headers.

14. The method of claim 12 , wherein detecting the security vulnerability comprises identifying a misconfigured security attribute in a header of said original packet.

15. The method of claim 12 , wherein detecting the security vulnerability comprises identifying a missing security attribute in a header of said original packet.

Assignees

• Verizon Digital Media Services Inc

Inventors

• Zaw Tin

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L2212/00

  Encapsulation of packets · CPC title

• H04L63/105

  Multiple levels of security · CPC title