Extensible protocol validation

1. A method, comprising:

receiving, by a network interface device within a network interface protection apparatus, a binary data structure including a portion representing a protocol validation specification expressed in a respective protocol validation specification language and another portion including a validation code indicator used to identify a validation code separate from the binary data structure;

receiving, by the network interface device, a security policy rule separate from the binary data structure having an action part specifying that the binary data structure is to be used for verifying that application protocol payload of network packets complies with the protocol validation specification, the security policy rule further indicating actions to be performed upon detection of a violation of the protocol validation specification; and

verifying, by a data processing device within the network interface apparatus, that application protocol payload of received network packets complies with the protocol validation specification, wherein said verifying is initiated in response to determining that the security policy rule applies to said received network packets and wherein said verifying includes validating said application protocol payload of said received network packets against the binary data structure using the validation code.

2. The method of claim 1 , further comprising:

transforming the protocol validation specification from a text format to a binary format thereby providing a binary-format representation of the protocol validation specification; and

creating the binary data structure, wherein the binary data structure includes the binary-format representation of the protocol validation specification.

3. The method of claim 1 wherein verifying said application protocol payload of said received network packets includes validating said application protocol payload of said received network packets against the portion of the binary data structure representing the protocol validation specification on a character-by-character basis.

4. The method of claim 3 , further comprising:

transforming the protocol validation specification from a text format to a binary format for creating the portion of the binary data structure representing the protocol validation specification prior to receiving the binary data structure.

5. The method of claim 1 wherein receiving the binary data structure and the security policy rule includes loading the security policy rule and the binary data structure at run-time of a security policy instantiation.

6. A method, comprising:

transforming, by a data processing device within a specification transforming apparatus, a protocol validation specification from a text format to a binary format thereby creating a binary-format representation of the protocol validation specification representing the protocol validation specification expressed in a respective protocol validation specification language;

creating, by the data processing device, a binary data structure including the binary-format representation of the protocol validation specification and a validation code indicator used to identify a validation code separate from the binary data structure and intended to be used for validating application protocol payload against the binary-format representation of the protocol validation specification; and

providing, by a network interface device within the specification transforming apparatus, the binary data structure to a network interface protection apparatus to validate application protocol payload of network packets received by the network interface protection apparatus against the portion of the binary data structure representing the protocol validation specification using the validation code to verify that said application protocol payload of said received network packets complies with the protocol validation specification;

wherein the network interface protection apparatus further receives a security policy rule separate from the binary data structure having an action part specifying that the binary data structure is to be used for verifying that application protocol payload of network packets complies with the protocol validation specification, the security policy rule further indicating actions to be performed upon detection of a violation of the protocol validation specification.

7. The method of claim 6 wherein said validation code is configured in accordance with the respective protocol validation specification language of the protocol validation specification.

8. An apparatus, comprising:

memory;

at least one data processing device coupled to said memory; and

instructions accessible from said memory by said at least one data processing device, wherein said instructions are configured for causing said at least one data processing device to carry out operations for:

receiving a binary data structure including a portion representing a protocol validation specification expressed in a respective protocol validation specification language and another portion including a validation code indicator used to identify a validation code separate from the binary data structure;

receiving a security policy rule separate from the binary data structure and having an action part specifying that the binary data structure is to be used for verifying that application protocol payload of network packets complies with the protocol validation specification, the security policy rule further indicating actions to be performed upon detection of a violation of the protocol validation specification; and

verifying that application protocol payload of received network packets complies with the protocol validation specification, wherein said verifying is initiated in response to determining that the security policy rule applies to said received network packets and wherein said verifying includes validating said application protocol payload of said received network packets against the binary data structure using the validation code.

9. The apparatus of claim 8 wherein the validation code is configured for interpreting the binary data structure.

10. The apparatus of claim 8 wherein said instructions are further configured for causing said at least one data processing device to carry out operations for:

receiving the validation code configured for validating application protocol payload against the portion of the binary data structure representing the protocol validation specification, wherein verifying that said application protocol payload of received network packets complies with the protocol validation specification includes said validation code using the binary data structure to validate said application protocol payload of said received network packets against the portion of the binary data structure representing the protocol validation specification.

11. The apparatus of claim 8 wherein said instructions are further configured for causing said at least one data processing device to carry out operations for:

transforming the protocol validation specification from a text format to a binary format thereby providing a binary-format representation of the protocol validation specification; and

creating the binary data structure, wherein the binary data structure includes the binary-format representation of the protocol validation specification.

12. The apparatus of claim 8 wherein said validation code is configured in accordance with the respective protocol validation specification language of the protocol validation specification.

13. The apparatus of claim 8 wherein verifying said application protocol payload of said received network packets includes validating said application protocol payload of said received network packets against the portion of the binary data structure representing the protocol validation specification on a character-by-character basis.

14. The apparatus of claim 13 wherein said instructions are further configured for causing said at least one data processing device to carry out operations for:

transforming the protocol validation specification from a text format to a binary format for creating the portion of the binary data structure representing the protocol validation specification prior to receiving the binary data structure.

15. The apparatus of claim 8 wherein receiving the binary data structure and the security policy rule includes loading the security policy rule and the binary data structure at run-time of a security policy instantiation.

16. An apparatus, comprising:

memory;

at least one data processing device coupled to said memory; and

instructions accessible from said memory by said at least one data processing device, wherein said instructions are configured for causing said at least one data processing device to carry out operations for:

transforming a protocol validation specification from a text format to a binary format thereby creating a binary-format representation of the protocol validation specification representing the protocol validation specification expressed in a respective protocol validation specification language;

creating a binary data structure including the binary-format representation of the protocol validation specification and a validation code indicator used to identify a validation code separate from the binary data structure and intended to be used for validating application protocol payload against the binary-format representation of the protocol validation specification; and

providing the binary data structure to a network interface protection apparatus to validate application protocol payload of network packets received by the network interface protection apparatus against the portion of the binary data structure representing the protocol validation specification using the validation code to verify that said application protocol payload of said received network packets complies with the protocol validation specification;

wherein the network interface protection apparatus further receives a security policy rule separate from the binary data structure having an action part specifying that the binary data structure is to be used for verifying that application protocol payload of network packets complies with the protocol validation specification, the security policy rule further indicating actions to be performed upon detection of a violation of the protocol validation specification.

17. The apparatus of claim 16 wherein said validation code is configured in accordance with the respective protocol validation specification language of the protocol validation specification.

18. A non-transitory computer-readable medium having tangibly embodied thereon and accessible therefrom a set of instructions interpretable by at least one data processing device, said set of instructions configured for causing said at least one data processing device to carry out operations for:

receiving a binary data structure including a portion representing a protocol validation specification expressed in a respective protocol validation specification language and another portion including a validation code indicator used to identify a validation code separate from the binary data structure;

receiving a security policy rule separate from the binary data structure and having an action part specifying that the binary data structure is to be used for verifying that application protocol payload of network packets complies with the protocol validation specification, the security policy rule further indicating actions to be performed upon detection of a violation of the protocol validation specification; and

verifying that application protocol payload of received network packets complies with the protocol validation specification, wherein said verifying is initiated in response to determining that the security policy rule applies to said received network packets and wherein said verifying includes validating said application protocol payload of said received network packets against the binary data structure using the validation code.

19. The computer-readable medium of claim 18 wherein the validation code is configured for interpreting the binary data structure.

20. The computer-readable medium of claim 18 said set of instructions configured for causing said at least one data processing device to carry out operations for:

Receiving the validation code configured for validating application protocol payload against the portion of the binary data structure representing the protocol validation specification, wherein verifying that said application protocol payload of received network packets complies with the protocol validation specification includes said validation code using the binary data structure to validate said application protocol payload of said received network packets against the portion of the binary data structure representing the protocol validation specification.

21. The computer-readable medium of claim 18 said set of instructions configured for causing said at least one data processing device to carry out operations for:

transforming the protocol validation specification from a text format to a binary format thereby providing a binary-format representation of the protocol validation specification; and

creating the binary data structure, wherein the binary data structure includes the binary-format representation of the protocol validation specification.

22. The computer-readable medium of claim 18 wherein said validation code is configured in accordance with the respective protocol validation specification language of the protocol validation specification.

23. The computer-readable medium of claim 18 wherein verifying said application protocol payload of said received network packet includes validating said application protocol payload of said received network packets against the portion of the binary data structure representing the protocol validation specification on a character-by-character basis.

24. The computer-readable medium of claim 23 said set of instructions configured for causing said at least one data processing device to carry out operations for:

transforming the protocol validation specification from a text format to a binary format for creating the portion of the binary data structure representing the protocol validation specification prior to receiving the binary data structure.

25. The computer-readable medium of claim 18 wherein receiving the binary data structure and the security policy rule includes loading the security policy rule and the binary data structure at run-time of a security policy instantiation.

26. A non-transitory computer-readable medium having tangibly embodied thereon and accessible therefrom a set of instructions interpretable by at least one data processing device, said set of instructions configured for causing said at least one data processing device to carry out operations for:

transforming a protocol validation specification from a text format to a binary format thereby creating a binary-format representation of the protocol validation specification representing the protocol validation specification expressed in a respective protocol validation specification language;

creating a binary data structure including the binary-format representation of the protocol validation specification and a validation code indicator used to identify a validation code separate from the binary data structure and intended to be used for validating application protocol payload against the binary-format representation of the protocol validation specification; and

providing the binary data structure to a network interface protection apparatus to validate application protocol payload of network packets received by the network interface protection apparatus against the portion of the binary data structure representing the protocol validation specification using the validation code to verify that said application protocol payload of said received network packets complies with the protocol validation specification;

wherein the network interface protection apparatus further receives a security policy rule separate from the binary data structure having an action part specifying that the binary data structure is to be used for verifying that application protocol payload of network packets complies with the protocol validation specification, the security policy rule further indicating actions to be performed upon detection of a violation of the protocol validation specification.

27. The computer-readable medium of claim 26 wherein said validation code is configured in accordance with the respective protocol validation specification language of the protocol validation specification.