Automatically Detecting and Correcting Missing and Misconfigured Security Attributes
AssigneeVerizon Digital Media Services Inc.
InventorTin Zaw
Life of this patent
Estimating the term…
Abstract
Some embodiments provide automated and intelligent security configuration at the network edge. A server tasked with distributing content provider content automatically detects and modifies attributes in the content provider content in order to close potential security vulnerabilities prior to redistributing that content on behalf of the content provider to different recipients. The vulnerabilities can arise from the content provider misconfiguring attributes or omitting certain security attributes when creating the content. The server can provide a default or customized set of protections, wherein the customized protections are specific to each content provider or the content of each content provider.
Claims20
A method comprising:
- retrieving by a content distribution server, a packet encapsulating content of a particular content provider, wherein the particular content provider offloads said content to the content distribution server for delivery to a plurality of clients;
- verifying at the content distribution server, security of an original header of said packet based on security options the particular content provider configures with the content distribution server;
- modifying said packet with a modified header in response to changing said original header based on the original header violating one of said security options;
- and
- serving the packet with the modified header to a client of the plurality of clients.
A method comprising:
- receiving at a particular server, a first request for content of a first content provider, and a second request for content of a different second content provider;
- obtaining first and second packets in response to said first and second requests;
- changing a particular field in a header of the first packet to a first value based on a first set of security options the particular server enforces on behalf of the first content provider;
- changing the particular field in a header of the second packet to a different second value based on a different second set of security options the particular server enforces on behalf of the second content provider;
- and
- serving over a digital network, the first packet with a modified header comprising the first value for the particular field in response to the first request, and the second packet with a modified header comprising the second value for the particular field in response to the second request.
A security enforcement server comprising:
- a network interface receiving a packet with an original header from a content provider and distributing said packet with a modified header to a requesting client;
- a memory storing a set of security policies defined by said content provider;
- and
- a packet inspection module examining the original header of said packet in response to said receiving, and producing said modified header by modifying an attribute in said original header violating at least one of said set of security policies.
Dependencies are inferred from the claim text.