Patent Application
20100058467
The present invention relates to the field of active content filtering and, more particularly, to improving the efficiency of active content filtering using cache ruleset metadata.
Active content filtering (ACF) is a key component in providing security and privacy to a broad range of computing tasks. One common problem with active content filtering is that filtering can reduce the performance of content delivery. Currently, active content filtering methodology revolves around approaching filtering from a tree data model. For example, many ACF systems analyze hypertext markup language (HTML) documents using the document object model (DOM) to determine potential harmful content. This technique suffers from performance bottlenecks due to tree traversal and frequently unnecessary data inspection. Further, this manner of ACF utilizes significant computing resources and does not scale efficiently to larger configurations.
Attempts have been made to correct this performance degradation associated with ACF processing. One approach reduces the reliance on direct content parsing through caching and focuses on structural assessments of the content. Process content is cached and new content is compared against the cache to determine if processing is necessary. While this method improves upon existing procedures, cached ACF does not represent the most optimized solution possible. Taking further advantage of the properties of cache content can provide a further gain in performance.
The present invention discloses a solution for improving the efficiency of active content filtering (ACF) using cache ruleset metadata. In the solution, unfiltered content can be processed based on one or more rules and the resulting processing can be cached for reuse. The cache can be an automation able to store states and transition data associated with applicable content filtering rules. Cached ruleset metadata can be utilized to shortcut content filtering when new content is determined to have previously been analyzed and filtered. Further, the rule scope can be used to perform partial reuse of cached content when a full match of new content against cached content is not possible. Caching ruleset metadata for reuse translates into better scalability, enhanced performance, and distribution of computing resources.
The present invention may be embodied as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, the present invention may take the form of a computer program product on a computer-usable storage medium having computer-usable program code embodied in the medium. In a preferred embodiment, the invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.
Furthermore, the invention can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. For the purposes of this description, a computer-usable or computer readable medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-usable medium may include a propagated data signal with the computer-usable program code embodied therewith, either in baseband or as part of a carrier wave. The computer usable program code may be transmitted using any appropriate medium, including but not limited to the Internet, wireline, optical fiber cable, RF, etc.
Any suitable computer usable or computer readable medium may be utilized. The computer-usable or computer-readable medium may be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. Examples of a computer-readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory, a rigid magnetic disk and an optical disk. Current examples of optical disks include compact disk-read only memory (CD-ROM), compact disk-read/write (CD-R/W) and DVD. Other computer-readable medium can include a transmission media, such as those supporting the Internet, an intranet, a personal area network (PAN), or a magnetic storage device. Transmission media can include an electrical connection having one or more wires, an optical fiber, an optical storage device, and a defined segment of the electromagnet spectrum through which digitally encoded content is wirelessly conveyed using a carrier wave.
Note that the computer-usable or computer-readable medium can even include paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.
Computer program code for carrying out operations of the present invention may be written in an object oriented programming language such as Java, Smalltalk, C++ or the like. However, the computer program code for carrying out operations of the present invention may also be written in conventional procedural programming languages, such as the “C” programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
A data processing system suitable for storing and/or executing program code will include at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories which provide temporary storage of at least some program code in order to reduce the number of times code must be retrieved from bulk storage during execution.
Input/output or I/O devices (including but not limited to keyboards, displays, pointing devices, etc.) can be coupled to the system either directly or through intervening I/O controllers.
Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modem and Ethernet cards are just a few of the currently available types of network adapters.
The present invention is described below with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function/act specified in the flowchart and/or block diagram block or blocks.
The computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
As used herein, content 152 can include Hypertext Markup Language (HTML), Extensible Markup Language (XML), Extensible Hypertext Markup Language (XHTML), and the like. Further, content 152 can be an aggregate (e.g., mashup) document composed of content from one or more source servers 150. Content 152 can include code 154, 156 (e.g., tags, attributes) which can be identified as unwanted content, unsafe content, potentially harmful code, and the like. This code can be removed or replaced based on rules 148 established in ACF system 140. For instance, identified JAVASCRIPT 154 code determined to be potentially harmful, can be removed using ACF system 140.
When request for content 152 occurs ACF engine 142 can perform cached and non-cached processing on the content 152 based on the contents of cache 144. When a match has not been determined, ACF engine 142 can process and filter the content 152. Content 152 is analyzed and a cache 145 entry is created for content 152. As content 152 is processed the content 145 is updated to reflect the content structure 152 and any applied rules 148. Information about rules which have been applied to content 152 can be stored associatively with cached content 145 as rule metadata 147.
Sample cache 160 illustrates one implementation for the caching process. Key 162 provides identifiers for comprehending sample cache 162. As shown by key 162, sample cache 160 shows multiple states (State-a through State-l). Either fixed transitions or variable transitions occur between the states, as shown by key 162. Two different rulesets are shown, one (e.g., ruleset 165) for the html-head-default another (e.g., ruleset 167) for the html-body-default. Different filter rules (F-1 and F-2) are applied at different states.
As shown, content 152 is processed by sample cache 160. States-a and States-b show a pre-processing 164 of an initial portion of the content 152 before the head is processed. The head is processed by ruleset 165 associated with State-c, State-d, State-e, and State-f. A transition 166 occurs between the head and body, where tag information is consumed or parsed, as shown by State-g. Ruleset 167 then processes the body of the content, which is associated with State-h, State-i, and State-j. Post-processing 168 of the content 152 associated with State-k and State-l can then occur as shown.
Should content 152 match or partially match previously processed content stored in cache 144, engine 142 can utilize the cached information 145 to bypass full content processing, which represents is an optional optimization for system 100. That is, Reuse of cached content 145 (e.g., cached HTML template) can eliminate unnecessary processing. For example, matches can be determined by comparison engine 143 which can perform a byte comparison processing of content 152 against cached content 145. Byte comparison can be executed in lieu of HTML parsing to improve filtering performance. In one embodiment, partial matches can be detected and used. For example, with a partial match, ruleset metadata 147 can be used by engine 142 to rapidly process matched content.
Drawings presented herein are for illustrative purposes only and should not be construed to limit the invention in any regard. Although presented as separate systems, system 140 can be a server 150 side component or a client side 110 component. In one embodiment, system 140 can be a proxy residing able to intercept and filter content being conveyed between server 150 and client 110. In one embodiment, system 140 can be a component within a distributable computing architecture promoting compartmentalization and distribution of computing resources. System 140 functionality can be accessible via a unified resource identifier (URI) performing request/response actions such as a Web service. Further system 140 functionality can be embodied in one or more endpoint devices such as firewalls, gateways, security checkpoint devices, and the like.
In step 205, the ACF system receives unfiltered content from a content provider. Content from content provider can include one or more portions (e.g., aggregated content) of hypertext markup language (HTML), Extensible markup language (XML), and the like. In step 210, if the unfiltered content requires filtering the method can continue to step 215, else proceed to step 255. In step 215, if the unfiltered content is stored in the cache, the method can continue to step 220, else proceed to step 230. In step 220, the comparison engine can evaluate the structure of the unfiltered content against a cached copy. In step 225, if the unfiltered content matches a cached copy, the method can proceed to step 245, else continue to step 230. In step 230 the content parser can process the unfiltered content. In step 235, the processed content can be cached with the applicable ruleset metadata. In one embodiment, the cache can be an automation able to store the name of an applicable ruleset, the name of an applicable filter rule, and a start position and an end position within the content for which the rule can be applied.
In step 240, if there is more unfiltered content to process the method can return to step 210, else proceed to step 245. In step 245, unfiltered content can be sanitized using ruleset metadata stored in the cache. Sanitization can include the removal of suspect and/or malicious content. In step 250, removed content can be stored in a data map for composing any output template. In step 255, the filtered content can be presented to a requesting entity. Entities can include a client device, a Web server, a Web service, a messaging component, and the like.
As used herein, rules 312 can be associated with tags and/or attribute values within content 310. Rules 312 can be associated with an action which can be used to modify (e.g., filter) content 310. Rules 312 can be identifiable by name and/or belonging to a ruleset. Each ruleset can include a scope for which a ruleset can be active. In one embodiment, rules 312 can be maintained in an XML document.
Content 310 can be segmented into multiple inputs 310 which can allow engine 320 to process content 310 in parallel and identify partial matches within content 310. Comparison engine 322 can perform processing on inputs 310 to determine if inputs 310 have previously been processed and cached. Inputs 310 can be analyzed to determine a start and end offset for a byte sequence to be processed based on cached rule metadata 334. For instance, cache table 370 can be used to identify a start offset 360 and an end offset 362 for which a rule 352 (e.g., F-2) can be applied. Filtered content can be conveyed as content 332 to be compiled into a finalized output 340. When input 310 requires parsing, content parser 324 can execute the necessary steps. Input 310 processed by parser 324 can include filtered content and rule metadata which can be stored in cache 330. Parser 324 can identify inputs 310 which match rules 312, and the rule specified action can be performed. Filtered content 334 with applicable filtering rules 312 can be stored in cache 330 as filtered content 332 and rule metadata 334. Filtered content 336 generated from parser 324 can be used to produce can output 340.
Cache 330 can be updated as input 310 is processed and filtering rules are applied. In one embodiment cache 330 can be an automation able to store rule metadata associated with one or more states and/or transitions. A new automation can be created for each input 310 where a cached instance does not previously exist. Cached rule metadata can include ruleset metadata which can be used to identify the scope for which a set of rules can be applied. Utilizing the rule defined scope, cache 330 can be reused in a modular fashion to match portions of unfiltered content 310 (e.g., inputs 310) with cached content 332.
System 300 represents one contemplated embodiment and should not be construed to limit the invention in any regard. Cache table 330 is for illustrative purposes only, actual implementation details can vary.
The diagrams in
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a,” “an,” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the invention. The embodiment was chosen and described in order to best explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.
