US 9,426,125 B2Granted

Real-time reconfigurable web application firewall for a distributed platform

AssigneeVerizon Digital Media Services Inc.

InventorsVikas Phonsa, Hayes Kim, David Andrews

Life of this patent

Estimating the term…

Loading patent…

Abstract

Some embodiments provide reconfigurable web application firewall (WAF) functionality across a distributed platform. Specifically, the WAF function at each distributed platform server is customizable on a per customer and per inbound message basis. When a server receives an inbound message, the server identities the content or services of which specific customer are implicated by the inbound message. The server screens the inbound message for attacks using a first set of rules and policies defined as part of a production profile from a WAF instance defined by the specific customer while contemporaneously testing the inbound message against a second set of rules and polices defined as part of an audit profile from the same WAF instance. In this manner, the specific customer tests the audit profile rules and policies while still receiving the protections of the production profile rules and policies.

Claims20

Dependent claims

A firewall apparatus comprising:

a memory storing a plurality of firewall configurations defined by a plurality of different customers, each firewall configuration of the plurality of firewall configurations comprising (i) a production profile comprising a different first set of firewall rules or policies actively protecting customer content and services against real-world traffic and (ii) an audit profile comprising a different second set of firewall rules or policies testing new rules or policies against said real-world traffic without actively protecting the customer content and services with said new rules or policies;
a network interface receiving an inbound message directed to a content or service of a particular customer of the plurality of customers;
and
a hardware processor (i) reconfiguring the apparatus firewall protections for the inbound message according to a particular firewall configuration from the plurality of firewall configurations defined by the particular customer and (ii) protecting the particular customer content or service from a first attack within the inbound message using the first set of firewall rules or policies from the production profile of the particular firewall configuration while simultaneously testing the second set of firewall rules or policies from the audit profile of the particular firewall configuration against the inbound message, wherein said testing comprises alerting the particular customer of a second attack in the inbound message violating a rule or policy from the second set of firewall rules or policies without protecting the particular customer content or service against the second attack.

1 more element

A system for providing custom firewall protections for a plurality of customers, the system comprising:

a memory storing computer-executable instructions, a first firewall configuration, and a second firewall configuration, the first firewall configuration comprising a first production profile with a first set of rules and policies securing inbound messaging directed to a content or service of a first customer, and the second firewall configuration comprising (i) a second production profile with a second set of rules and policies securing inbound messaging directed to a content or service of a second customer and (ii) a second audit profile comprising a third set of rules and policies of the second customer under test;
and
a computer processor in communication with the memory, the computer-executable instructions programming the computer processor in:
receiving a first inbound message directed to a content or service of the first customer and a second inbound message directed to a content or service of the second customer;
reconfiguring the firewall protections according to the first firewall configuration in response to receiving the first inbound message, wherein said reconfiguring comprises screening the first inbound message for an attack defined according to the first set of rules and policies of the first firewall configuration;
reconfiguring the firewall protections according to the second firewall configuration in response to receiving the second inbound message, wherein said reconfiguring comprising (i) detecting the second audit profile in addition to the second production profile of the second firewall configuration, (ii) replicating the second inbound message in response to said detecting, wherein said replicating produces a first copy and a second copy of the second inbound message, and (iii) screening the first copy of the second inbound message for an attack defined according to the second set of rules and policies while simultaneously testing the third set of rules and polices with the second copy of the second inbound message.

3 more elements

A system comprising:

a plurality of points-of-presence (PoPs) providing distributed delivery for assets of at least a first customer and a second customer, wherein each PoP of the plurality of PoPs comprises at least one PoP server,
each PoP server operating according to a configuration comprising (i) a first firewall instance protecting the first customer assets from a first set of attacks by definition of a first set of rules or policies and (ii) a second firewall instance protecting the second customer assets from a second set of attacks by definition of a second set of rules or policies, wherein each PoP server screens inbound messages to a first customer asset for any of the first set of attacks using the first set of rules or policies from the first firewall instance and further secures and further screens inbound messages to a second customer asset for any of the second set of attacks using the second set of rules or polices from the second firewall instance;
and
a repository comprising (i) a memory storing the first and second firewall instances, (ii) a processor adding a new global rule to each of the first and second firewall instances in response to an attack detected at one or more of the plurality of PoPs, and (iii) connections to each PoP of the plurality of PoPs, wherein said repository distributes the first and second firewall instances with the new global rule to each PoP server operating in each of the plurality of PoPs.

1 more element

Dependencies are inferred from the claim text.