Methods, systems, and computer readable media for providing application layer firewall and integrated deep packet inspection functions for providing early intrusion detection and intrusion prevention at an edge networking device
View Patent ↗Methods, systems, and computer readable media for an application layer firewall function including an integrated deep packet inspection function for providing early intrusion detection and intrusion prevention at an edge networking device are disclosed. According to one method, steps are performed at a session controller configured to operate at the border of a first network and a second network. The steps include receiving, at an intrusion protection system (IPS) module of the session controller interfacing with modules associated with layers 2 and above of a protocol stack of the session controller, information gathered by modules located at lower layers and associated with an intrusion attempt, vulnerability, or other security policy violation. In response to receiving the information, the IPS module provides at least one of a security policy and a rule to a module located at the most appropriate layer for securing the intrusion attempt, vulnerability, or other security policy violation.
1. A method for providing application layer firewall functionality including integrated deep packet inspection, intrusion detection, and intrusion prevention capabilities, the method comprising:
at a session controller configured to operate at the border of a first network and a second network:
receiving, at an intrusion protection system (IPS) module of the session controller interfacing with modules associated with layers 2 and above of a protocol stack of the session controller, information gathered by modules located at layers lower than the IPS and associated with an intrusion attempt, vulnerability, or other security policy violation;
in response to receiving the information, providing, by the IPS module, at least one of a security policy and a rule to a module located at a targeted layer for securing against the intrusion attempt, vulnerability, or other security policy violation;
forwarding, by a deep packet inspection (DPI) module, a first copy of a received communications message to an application firewall and rate admission control module located at layers 5 and 6 of the stack via a first path for in-line processing, wherein the application firewall and rate admission control module is located at a layer above the DPI module; and
forwarding a second copy of the communications message to an intrusion detection system (IDS) module via a second path, wherein the first path is parallel to the second path and wherein forwarding the second copy is performed simultaneously with the forwarding of the first copy of the communications message.
2. The method of claim 1 comprising applying, by a module located at a lower layer, the at least one of a security policy and a rule.
3. The method of claim 1 comprising generating a report including information associated with the intrusion attempt.
4. The method of claim 1 wherein receiving information includes receiving an Internet protocol (IP)-based packet.
5. The method of claim 1 wherein receiving information associated with an intrusion attempt, vulnerability, or other security policy violation includes receiving a communications message associated with one of a signature-based anomaly, usage-based anomaly, SIP protocol vulnerability, denial of service (DoS) attack, spam attack, and spam over Internet telephony (SPIT) attack.
6. The method of claim 1 wherein providing at least one of a security policy and a rule includes providing a vulnerability signature to a deep packet inspection (DPI) module for monitoring packets on an ongoing basis.
7. The method of claim 6 wherein the DPI module resides at the boundary of layer 4 and layer 5 of the stack and scans the payloads of received packets to detect the presence of a vulnerability signature, identifies the nature of the packet.
8. The method of claim 1 wherein the information is associated with one of voice, video, and file transfer.
9. The method of claim 1 wherein the IDS module is located at layers 5, 6, and 7 of the stack.
10. The method of claim 1 wherein the IPS module interfaces with a layer 3 security-hardened IP stack located above a layer 2 packet filter and below a layer 3 firewall.
11. The method of claim 1 wherein the IPS module interfaces with a layer 3 firewall located above a layer 3 security-hardened IP stack and below a layer 3 rate limit function.
12. The method of claim 1 wherein the IPS module interfaces with a layer 3 rate limit function located above a layer 3 firewall and below a layer 3 encryption/decryption module.
13. The method of claim 1 wherein the IPS module interfaces with a layer 3 encryption/decryption module located above a layer 3 encryption/decryption module and below a layer 4 security-hardened TCP/UDP/SCTP stack.
14. The method of claim 1 wherein the IPS module interfaces with a layer 4 security-hardened TCP/UDP/SCTP stack located above a layer 3 and below a layer 4 firewall.
15. The method of claim 1 wherein the IPS module interfaces with a layer 4 firewall located above a layer 4 security-hardened IP stack and below a layer 4 rate limit function.
16. The method of claim 1 wherein the IPS module interfaces with a layer 4 rate limit function located above a layer 4 firewall and below a layer 4 encryption/decryption module.
17. The method of claim 1 wherein the IPS module interfaces with a layer encryption/decryption module located above a layer 4 encryption/decryption module and below a layer 4 deep packet inspection engine.
18. A session controller configured to operate at the border of a first network and a second network for providing application layer firewall functionality including integrated deep packet inspection, intrusion detection, and intrusion prevention capabilities, the session controller comprising:
a processor; and
a memory, the memory comprising:
a plurality of modules associated with layers 2 and above of a protocol stack of the session controller; and
an intrusion protection system (IPS) module for:
interfacing with the plurality of modules;
receiving information gathered by the plurality of modules that is associated with an intrusion attempt, vulnerability, or other security policy violation; and
in response to receiving the information, providing at least one of a security policy and a rule to a module of the plurality of modules that is located at a targeted layer for securing against the intrusion attempt, vulnerability, or other security policy violation; and
a deep packet inspection (DPI) module for:
forwarding a first copy of the communications message to an application firewall and rate admission control module located at layers 5 and 6 of the stack via a first path for inline processing, wherein the application firewall and rate admission control module is located at a layer above the DPI module; and
forwarding a second copy of the communications message to the DPI module via a second path, wherein the first path is parallel to the second path and wherein forwarding the second copy is performed simultaneously with the forwarding of the first copy of the communications message.
19. The session controller of claim 18 wherein the plurality of modules applies the at least one of a security policy and a rule by a module located at a lower layer.
20. The session controller of claim 18 wherein the session controller generates a report including information associated with the intrusion attempt.
21. The session controller of claim 18 wherein the session controller receives an Internet protocol (IP)-based packet.
22. The session controller of claim 18 wherein the session controller receives a communications message associated with an intrusion attempt, vulnerability, or other security policy violation includes receiving a communications message associated with one of a signature-based anomaly, usage-based anomaly, SIP protocol vulnerability, denial of service (DoS) attack, unsolicited email spam attack, and spam over Internet telephony (SPIT) attack.
23. The session controller of claim 18 wherein the IPS module provides at least one of a security policy and a rule includes providing a vulnerability signature to a deep packet inspection (DPI) module for monitoring packet on an ongoing basis.
24. The session controller of claim 18 comprising:
an intrusion detection system (IDS) module for identifying behavioral and usage pattern based vulnerabilities in a packet flow not across individual and collective sessions and packets streams.
25. The session controller of claim 24 wherein the DPI module resides at the boundary of layer 4 and layer 5 of the stack and scans the payloads of received packets to detect the presence of a vulnerability signature, identifies the nature of the packet.
26. The session controller of claim 18 wherein the nature of the communications message includes one of voice, video, and file transfer.
27. The session controller of claim 18 wherein the IDS module is located at layers 5, 6, and 7 of the stack.
28. The session controller of claim 18 wherein the IPS module interfaces with a layer 3 security-hardened IP stack located above a layer 2 packet filter and below a layer 3 firewall.
29. The session controller of claim 18 wherein the IPS module interfaces with a layer 3 firewall located above a layer 3 security-hardened IP stack and below a layer 3 rate limit function.
30. The session controller of claim 18 wherein the IPS module interfaces with a layer 3 rate limit function located above a layer 3 firewall and below a layer 3 encryption/decryption module.
31. The session controller of claim 18 wherein the IPS module interfaces with a layer 3 encryption/decryption module located above a layer 3 encryption/decryption module and below a layer 4 security-hardened TCP/UDP/SCTP stack.
32. The session controller of claim 18 wherein the IPS module interfaces with a layer 4 security-hardened TCP/UDP/SCTP stack located above a layer 3 and below a layer 4 firewall.
33. The session controller of claim 18 wherein the IPS module interfaces with a layer 4 firewall located above a layer 4 security-hardened IP stack and below a layer 4 rate limit function.
34. The session controller of claim 18 wherein the IPS module interfaces with a layer 4 rate limit function located above a layer 4 firewall and below a layer 4 encryption/decryption module.
35. The session controller of claim 18 wherein the IPS module interfaces with a layer 4 encryption/decryption module located above a layer 4 encryption/decryption module and below a layer 4 deep packet inspection engine.
36. A computer readable medium comprising computer executable instructions embodied in a non-transitory computer readable medium and when executed by a processor of a computer performs steps comprising:
at a session controller configured to operate at the border of a first network and a second network:
receiving, at an intrusion protection system (IPS) module of the session controller interfacing with modules associated with layers 2 and above of a protocol stack of the session controller, information gathered by modules located at layers lower than the IPS and associated with an intrusion attempt, vulnerability, or other security policy violation; and
in response to receiving the information, providing, by the IPS module, at least one of a security policy and a rule to a module located at a targeted layer for securing against the intrusion attempt, vulnerability, or other security policy violation;
forwarding, by a deep packet inspection (DPI) module, a first copy of a received communications message to an application firewall and rate admission control module located at layers 5 and 6 of the stack via a first path for in-line processing, wherein the application firewall and rate admission control module is located at a layer above the DPI module; and
forwarding a second copy of the communications message to an intrusion detection system (IDS) module via a second path, wherein the first path is parallel to the second path and wherein forwarding the second copy is performed simultaneously with the forwarding of the first copy of the communications message.