Stateful Request Filtering for Application Security

The patent segments the request filtering process into two distinct stages: first, a stateful packet filter performs lightweight filtering based on connection state and pre-defined rules; second, an application-layer filter performs more intensive content inspection only on requests that pass the first stage. This segmentation allows the system to maintain high security through application-layer inspection while reducing overall resource consumption by limiting the scope of intensive filtering.

The patent implements preliminary action by performing stateful packet filtering before application-layer content inspection. The stateful firewall pre-establishes connection states and creates a framework of acceptable traffic patterns, allowing the system to quickly reject obviously malicious packets without performing resource-intensive content analysis. This preliminary filtering reduces the workload for subsequent application-layer inspection.

The patent segments the packet processing flow into two paths: a fast path for packets that match established connection states and simple rules, and a slow path for packets requiring application-layer content inspection. This segmentation ensures that the majority of legitimate traffic flows through the high-speed path, maintaining processing speed, while suspicious or unrecognized packets are routed to the application-layer filter for thorough inspection, ensuring comprehensive security coverage.

The patent applies partial action by performing application-layer content inspection only on a subset of packets that pass through the stateful packet filter, rather than inspecting all packets. This selective inspection approach maintains security coverage for potentially malicious traffic while avoiding the performance penalty of inspecting every packet, thus preserving overall processing speed.