Apparatus for filtering server responses

37 Pages·2015·3.3 MB·English

US007849507B1
(12) United States Patent (10) Patent N0.: US 7,849,507 B1
Bloch et al. (45) Date of Patent: Dec. 7, 2010
(54) APPARATUS FOR FILTERING SERVER 7,624,110 B2 11/2009 Alagna et a1.
RESPONSES 2003/0172167 A1* 9/2003 Judge et al. ............... .. 709/229
2004/0122926 A1 6/2004 Moore et al.
(75) Inventors: Eric Bloch, San Mateo, CA (US); 2004/0153512 A1 8/2004 Friend
Shalabh Mohan, Mountain View, CA 2005/0015626 A1 1/2005 Chasin
(US); Rajendraprasad R. Pagaku, 2005/0204002 A1 9/2005 Friend
2006/0010215 A1 1/2006 Clegg et a1.
Foster City, CA (US); Doug Moore,
2006/0059238 A1 3/2006 Slater et al.
Houston, TX (US); Mark Krentel,
2006/0069697 A1 3/2006 Shraim et a1.
Houston, TX (US); Bruce Thompson, 2006/0206573 A1 9/2006 HorvitZ et al.
So. San Francisco, CA (US); Julian R. 2006/0212925 A1 9/2006 Shull et al.
Elischer, El Cerrito, CA (US); Brandon 2006/0218143 A1 9/2006 Nijork
L. Golm, San Francisco, CA (US) 2006/0253583 A1 11/2006 Dixon et al.
2007/0078936 A1 4/2007 Quinlan et al.
(73) Assignee: Ironport Systems, Inc., San Bruno, CA 2007/0100795 A1 5/2007 Davies
(Us) 2008/0114709 A1 5/2008 Dixon et al.
2009/0070872 A1 3/2009 Cowings et al.
(*) Notice: Subject to any disclaimer, the term of this * cited by examiner
patent is extended or adjusted under 35
Primary ExamineriHosuk Song
U.S.C. 154(b) by 768 days.
(74) Attorney, Agent, or FirmiHickman Palermo Truong &
(21) App1.No.: 11/742,080 Becker LLP
(22) Filed: Apr. 30, 2007 (57) ABSTRACT
A data processing apparatus can perform HTTP traf?c moni
(51) Int. Cl.
toring and ?ltering of HTTP requests from clients and
G06F 11/00 (2006.01)
responses from servers. Example apparatus comprises a pro
(52) U.S. C1. ............................ .. 726/22; 726/23; 726/24
cessor; a ?rst network interface to a protected network; a
(58) Field of Classi?cation Search ........... .. 726/11413, second network interface to an external network; a core
726/22426; 713/1504155, 1874188; 709/2234225,
hypertext transfer protocol (HTTP) proxy coupled to the pro
709/229
cessor and coupled to a content cache, wherein the HTTP
See application ?le for complete search history.
proxy is con?gured to receive an HTTP request from a client
(56) References Cited computer in the protected network, send the request to a
network resource in the external network on behalf of the
U.S. PATENT DOCUMENTS client, and receive an HTTP response from the network
resource on behalf of the client computer; and a plurality of
6,012,090 A 1/2000 Chung et a1.
spyware scanning engines (SSEs), wherein each of the SSEs
6,115,745 A 9/2000 Berstis et al.
is coupled to stored content signatures, and wherein each of
6,411,952 B1 6/2002 Bharat et a1.
the SSEs is con?gured to detect a particular kind of malicious
6,886,013 B1 4/2005 Beranek
7,272,853 B2 9/2007 Goodman et a1. software in an HTTP response.
7,467,206 B2 12/2008 Moore etal.
7,586,871 B2 9/2009 Hamilton etal. 33 Claims, 11 Drawing Sheets
1 MAIN STORAGE SERVER
DISPLAY1 12 <: I‘ MEfMORY g DfEVICE
1
1
1
1
1
INPUTDEVIMC.E <: :1 >
102
1
1
1
1
CURSOR 1
CONTROL /‘— I COMMUNICATION LOCAL
116 , ‘ PROCESSOR
1 1011. INTERFACE NETWORK
1 118 1
1
US. Patent
Dec. 7, 2010 Sheet 1 0f 11 US 7,849,507 B1
mm? mm?
wwr
mm>mmw a
mowmzo

US. Patent
Dec. 7, 2010 Sheet 4 0f 11 US 7,849,507 B1
E2@g28o2 :
ugcmw
A
mm; mm;
$2_2E>> 5515320 sm__v_om_m 5.551220 $225;
gaazmw 5E822225 5Q28 EHman
3.ME
$85$93825265c.wh.1
9US$5655?
@2285 $2285
E2NH68ge83owm2 @8Q2853: 5E82E226 n63_5%_$ 55328225 :>
mm; mm;
US. Patent
Dec. 7, 2010 Sheet 5 0f 11 US 7,849,507 B1
2232:265 2
r 935w
83A-“: 280
2:6$0628;8 g E5m%
5%@22$85
s$wom2c:3on E
:92H52_5_2<
M
$625%? $2699%6
$6.$93m85e2m5w.wQ.e
:
>j><
$2285 S?zosm
5s568:226 5$52;6
.a35 2E:&32;3 2m5:m8 @w5z0a3
US. Patent
Dec. 7, 2010 Sheet 6 0f 11 US 7,849,507 B1
86221
{05%
an
It
E0aE5O$n:;
8>a:o65n?
8>a:62n352 >
US. Patent
Dec. 7, 2010 Sheet 7 0f 11 US 7,849,507 B1
EDQEOQ 359:8
$629m x652
E$.2966
in
E5Ego 5388 5358
E<2055 36291 foiwz 2m2g6
an
$501
6QwlEEo0Ql:Fm
82g&m55?
68g:35:m2. £w2.52q3u2 52$
At
350$
Nod
=22;
m
@mm
6:61
Nod
652$ fosz
Nod