Real-time reconfigurable web application firewall for a distributed platform
View Patent ↗Some embodiments provide reconfigurable web application firewall (WAF) functionality across a distributed platform. Specifically, the WAF function at each distributed platform server is customizable on a per customer and per inbound message basis. When a server receives an inbound message, the server identities the content or services of which specific customer are implicated by the inbound message. The server screens the inbound message for attacks using a first set of rules and policies defined as part of a production profile from a WAF instance defined by the specific customer while contemporaneously testing the inbound message against a second set of rules and polices defined as part of an audit profile from the same WAF instance. In this manner, the specific customer tests the audit profile rules and policies while still receiving the protections of the production profile rules and policies.
1. A firewall apparatus comprising:
a memory storing a plurality of firewall configurations defined by a plurality of different customers, each firewall configuration of the plurality of firewall configurations comprising (i) a production profile comprising a different first set of firewall rules or policies actively protecting customer content and services against real-world traffic and (ii) an audit profile comprising a different second set of firewall rules or policies testing new rules or policies against said real-world traffic without actively protecting the customer content and services with said new rules or policies;
a network interface receiving an inbound message directed to a content or service of a particular customer of the plurality of customers; and
a hardware processor (i) reconfiguring the apparatus firewall protections for the inbound message according to a particular firewall configuration from the plurality of firewall configurations defined by the particular customer and (ii) protecting the particular customer content or service from a first attack within the inbound message using the first set of firewall rules or policies from the production profile of the particular firewall configuration while simultaneously testing the second set of firewall rules or policies from the audit profile of the particular firewall configuration against the inbound message, wherein said testing comprises alerting the particular customer of a second attack in the inbound message violating a rule or policy from the second set of firewall rules or policies without protecting the particular customer content or service against the second attack.
2. The firewall apparatus of claim 1 further comprising a cache storing any of a content or service provided by each of the plurality of different customers.
3. The firewall apparatus of claim 2 , wherein the hardware processor further submits the particular customer content or service from the cache over the network interface when the inbound message does not violate any of the production profile first set of rules or policies.
4. The firewall apparatus of claim 1 , wherein protecting the particular customer content or service comprises performing a first action when the inbound message contains the first attack violating at least one of the production profile first set of firewall rules or policies and passing the inbound message past the firewall protections when the inbound message does not violate any of the production profile first set of firewall rules or policies.
5. The firewall apparatus of claim 4 , wherein passing the inbound message past the firewall protections comprises processing the inbound message as part of the particular customer content or service.
6. The firewall apparatus of claim 4 , wherein performing the first action comprises blocking the inbound message from the particular customer content or service.
7. A system for providing custom firewall protections for a plurality of customers, the system comprising:
a memory storing computer-executable instructions, a first firewall configuration, and a second firewall configuration, the first firewall configuration comprising a first production profile with a first set of rules and policies securing inbound messaging directed to a content or service of a first customer, and the second firewall configuration comprising (i) a second production profile with a second set of rules and policies securing inbound messaging directed to a content or service of a second customer and (ii) a second audit profile comprising a third set of rules and policies of the second customer under test; and
a computer processor in communication with the memory, the computer-executable instructions programming the computer processor in:
receiving a first inbound message directed to a content or service of the first customer and a second inbound message directed to a content or service of the second customer;
reconfiguring the firewall protections according to the first firewall configuration in response to receiving the first inbound message, wherein said reconfiguring comprises screening the first inbound message for an attack defined according to the first set of rules and policies of the first firewall configuration;
reconfiguring the firewall protections according to the second firewall configuration in response to receiving the second inbound message, wherein said reconfiguring comprising (i) detecting the second audit profile in addition to the second production profile of the second firewall configuration, (ii) replicating the second inbound message in response to said detecting, wherein said replicating produces a first copy and a second copy of the second inbound message, and (iii) screening the first copy of the second inbound message for an attack defined according to the second set of rules and policies while simultaneously testing the third set of rules and polices with the second copy of the second inbound message.
8. The system of claim 7 , wherein the first production profile defines performing a first action in response to a violation of any of the first set of rules and policies, and wherein the second production profile defines performing a different second action in response to a violation of any of the second set of rules and policies.
9. The system of claim 8 , wherein screening the first inbound message comprises performing the first action when the first inbound message contains an attack that violates any of the first set of rules and policies, and wherein screening the second inbound message comprises performing the second action when the second inbound message contains an attack that violates any of the second set of rules and policies.
10. The system of claim 9 , wherein performing the first action comprises blocking the first inbound message, and wherein performing the second action comprises providing an alert identifying a rule or policy from the second set of rules and policies that the second inbound message violates.
11. The system of claim 7 , wherein the first firewall configuration further comprises a first audit profile with a secondary first set of rules and policies for test against inbound messaging directed to a content or service of the first customer.
12. The system of claim 11 , wherein the secondary first set of rules and policies of the first audit profile differ from the first set of rules and policies of the first production profile.
13. The system of claim 11 , wherein screening the first inbound message comprises contemporaneously testing the secondary first set of rules and policies from the first audit profile with the first inbound message.
14. The system of claim 7 , wherein screening the second inbound message further comprises performing a first action in response to a violation of any of the second set of rules and policies from the second production profile and performing a different second action in response to a violation of any of the third set of rules and policies from the second audit profile.
15. The system of claim 14 , wherein performing the first action comprises blocking the second inbound message, and wherein performing the second action comprises generating an alert identifying which of the third set of rules and policies from the second audit profile is violated by the second copy of the second inbound message.
16. A system comprising:
a plurality of points-of-presence (PoPs) providing distributed delivery for assets of at least a first customer and a second customer, wherein each PoP of the plurality of PoPs comprises at least one PoP server,
each PoP server operating according to a configuration comprising (i) a first firewall instance protecting the first customer assets from a first set of attacks by definition of a first set of rules or policies and (ii) a second firewall instance protecting the second customer assets from a second set of attacks by definition of a second set of rules or policies, wherein each PoP server screens inbound messages to a first customer asset for any of the first set of attacks using the first set of rules or policies from the first firewall instance and further secures and further screens inbound messages to a second customer asset for any of the second set of attacks using the second set of rules or polices from the second firewall instance; and
a repository comprising (i) a memory storing the first and second firewall instances, (ii) a processor adding a new global rule to each of the first and second firewall instances in response to an attack detected at one or more of the plurality of PoPs, and (iii) connections to each PoP of the plurality of PoPs, wherein said repository distributes the first and second firewall instances with the new global rule to each PoP server operating in each of the plurality of PoPs.
17. The system of claim 16 further comprising a portal providing an interactive interface with which the first customer defines the first set of rules or polices and with which the second customer defines the second set of rules or policies.
18. The system of claim 17 , wherein the repository enters rules or policies specified by different customers using the portal to corresponding customer firewall instances.
19. The system of claim 16 , wherein the first firewall instance comprises a third set of rules or policies for testing detection of a third set of attacks, and wherein each PoP further screens the inbound messages to the first customer asset for any of the third set of attacks using the third set of rules or policies from the first firewall instance.
20. The system of claim 7 , wherein the computer-executable instructions further program the computer processor in adding a new global rule to each of the first and second firewall configurations in response to a newly detected attack, wherein said adding occurs prior to reconfiguring the firewall protections according to either the first firewall configuration or the second firewall configuration.