Hierarchical Rule Schema for Web Application Firewall
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web applications are vulnerable to attacks like Cross-Site Scripting (XSS), SQL Injection (SQL-I), and Cross-Site Request Forgery (CSRF) due to existing vulnerabilities, and current firewall solutions often provide coarse-grain protection that can hinder the functionality of rich web applications.
Innovation Solution
Implementing a Web Application Server Firewall (WASF) with a Hierarchical Rule Schema (HRS) and a Rule Development Tool (RDT) that allows for fine-grain, hierarchical rule development and binding, enabling late binding of rules to message components and supporting URI templates and RESTful requests, thereby providing flexible and effective protection without modifying the web application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If coarse-grain firewall protection is implemented, then security coverage is improved, but web application functionality is hindered
Solution Approach 1:
The patent segments the firewall rule structure into hierarchical levels (general rules and specific rules) and divides message components into sections (URL, parameters, headers, etc.). This segmentation allows the firewall to apply different granularities of protection to different parts of web requests, maintaining security coverage while preserving application functionality by being less restrictive where not needed.
Solution Approach 2:
The patent implements local quality by allowing different sections of HTTP messages to be evaluated against different types of rules with different granularities. Specific message sections can be targeted with specific rules that have precise conditions and actions, while other sections use more general rules. This ensures that security protection is applied locally where vulnerabilities exist without unnecessarily restricting other parts of the application.
2Manufacturing precision
If fine-grain rule binding is implemented, then rule configuration accuracy is improved, but rule development complexity increases
Solution Approach 1:
The patent performs preliminary action by automatically binding specific rules to specific message sections during the rule definition phase. The system pre-establishes the relationships between rules and message components, so that when security policies are configured, the fine-grain binding is already in place. This eliminates the need for manual, complex binding operations while maintaining high configuration accuracy.
Solution Approach 2:
The patent introduces an intermediary mechanism (the rule binding system) that automatically matches and binds rules to appropriate message sections based on predefined criteria. This intermediary handles the complexity of fine-grain rule binding internally, presenting a simplified interface to users while achieving precise rule configuration accuracy behind the scenes.
3Measurement precision
If hierarchical rule schema is implemented, then security protection precision is improved, but firewall system complexity increases
Solution Approach 1:
The hierarchical rule schema segments rules into different levels (general and specific) and message components into sections. This segmentation enables precise security protection by allowing different precision levels at different hierarchical levels. The system manages complexity by organizing rules in a structured hierarchy where general rules provide broad protection and specific rules provide targeted precision, reducing the need for a single complex rule set.
Solution Approach 2:
The patent adds a hierarchical dimension to the rule system, organizing rules and message components in multiple levels rather than a flat structure. This dimensional change allows the system to achieve high precision protection through the hierarchy of general-to-specific rules while managing complexity through the structured organization. The hierarchical dimension provides a natural way to group and manage rules, reducing cognitive load and system complexity.
Data Source
AI summary
At least one of an HTTP request message and an HTTP response message is intercepted. A corresponding HTTP message model includes a plurality of message model sections. A representation of the at least one of an HTTP request message and an HTTP response message is parsed into message sections in accordance with the message model sections of the HTTP message model. A plurality of security rules are bounds to the message model sections. The plurality of security rules each specify at least one action to be taken in response to a given condition, which is based, at least in part, on a corresponding given one of the message sections. The at least one of an HTTP request message and an HTTP response message is processed in accordance with the plurality of security rules. Techniques for developing rules for a web application server firewall are also provided.