Patent Application
20100251329
The present invention relates to Internet security, and more particularly, to a system and a method for access management and security protection for network accessible computer services.
Since the early days of linking computers together to form a computer network, computer networks have grown more and more important and have become one of the fundamental infrastructural foundations of our society. Typical networks include the Internet, various Local Area Networks (LAN), wireless networks, mobile networks, Virtual Private Network (VPN), among others. A lot of networked computers are programmed to provide some kind of service that can be used by other networked entities. In general, a networked computer that provides a network accessible service is referred to as a “server” and a program that consumes such a service is referred to as a “client”. Sometimes the term “client” is also used to refer to the computer or device that runs such a client program.
There are many types of network accessible computer services. Web applications are the best known examples of such services. A web application (also referred to as a “web site”) is a network accessible computer service that runs on a web server for responding to Hypertext Transport Protocol (HTTP) requests. Depending on how the web application is programmed, the service may be serving HTML documents, processing an e-commerce transaction or performing a search query, among others. Clients are typically web browsers who issue HTTP requests to such a web server. The web server processes these HTTP requests and sends back the result to the client web browser. The client web browser may in turn display the result to the end user.
Another example of a networked computer service is a web service. A web service is a network accessible computer service running on a web service server and is typically accessible via HTTP-based protocol, Simple Object Access Protocol (SOAP) or Representational State Transfer (REST) protocol. However, unlike a web application that is typically designed to serve a human being (via a client side graphic user interface such as a web browser), a web service is typically designed to serve other computers or devices. For example, most airlines provide web services for other businesses such as travel web sites to perform air fare query, booking, checking flight status and so on.
Other examples of network computer services include email server, File Transfer Protocol (FTP) server, Instant Messaging server and steaming media server, among others.
Networked computer services are accessible by anyone using the associated network protocol. For example, anyone can use the Hypertext Transport Protocol (HTTP) to access a web application, SOAP or REST for web services, Simple Mail Transfer Protocol (SMTP) or Post Office Protocol (POP) for email services, FTP for FTP services and so on. This “open accessibility” is a double edged sword. It enables tremendous flexibility and facilitates innovation. However, it also introduces access management and security protection challenges.
Access management is a fundamental requirement for the operation of many network services. Most network services need a mechanism to decide and control who can access the service. Access management is not only about preventing unwanted access, but also about access rules and polices. For example, web applications may set up the following rules or policies:
Further, for a wide variety of networked computer services, information traveling on the network usually takes a circuitous route through several intermediary nodes to reach any destination node. Hackers exploit the various aspects and/or holes in the Internet architecture for malicious purposes. This is where network security comes in and why it has become a rapidly growing concern for all who use the Internet. Some common Internet security issues include the following:
Besides the above mentioned generic attacks, additional common attacks specific to web applications include the following:
The above attacks are merely examples of some of the common security attacks. Such security issues can be serious threat to not only web applications, but also web services, email applications, or any other Internet-based applications.
Over the recent years, cloud computing has emerged as an efficient and flexible way to do computing. According to Wikipedia, cloud computing “refers to the use of Internet-based (i.e. Cloud) computer technology for a variety of services. It is a style of computing in which dynamically scalable and often virtualized resources are provided as a service over the Internet. Users need not have knowledge of, expertise in, or control over the technology infrastructure ‘in the cloud’ that supports them”. The word “cloud” is a metaphor, based on how it is depicted in computer network diagrams, and is an abstraction for the complex infrastructure it conceals. In this document, we use the term “Cloud Computing” to refer to the utilization of a network-based computing infrastructure that includes many inter-connected computing nodes to provide a certain type of service, of which each node may employ technologies like virtualization and web services. The internal works of the cloud itself are concealed from the user point of view.
An enabler for cloud computing is virtualization. Wikipedia explains that “virtualization is a broad term that refers to the abstraction of computer resource”. It includes “Platform virtualization, which separates an operating system from the underlying platform resources”, “Resource virtualization, the virtualization of specific system resources, such as storage volumes, name spaces, and network resource” and so on. Due to virtualization, one can automate the tasks of starting, stopping and managing “virtual machine” (VM) nodes in a computing environment. Each “virtual machine” behaves just like a regular computer from an external point of view. One can install software onto it, delete files from it and run programs on it, among others, though the “virtual machine” itself is just a software program running on a “real” computer.
Based on virtualization, many vendors are offering “computing infrastructure as a service”. Various vendors are providing cloud computing infrastructure to customers using a “pay as you go and pay for what you use” model, including Amazon.com's Elastic Computing Cloud (EC2), RackSpace Cloud, GoGrid, SoftLayer, Savvis, Fujitsu, Joyent, and FlexiScale. These cloud infrastructures provide ways for a customer to dynamically start new virtual machine nodes or shut down existing virtual machine nodes in a matter of a few minutes. The cloud computing business model and elastic nature of virtual machine nodes provide new perspectives on how problems can be solved.
Prior art approaches of access management and security protection for networked computer services are primarily “in the data center” approaches using specialized appliances or custom coding. These approaches require adding special hardware or software in front of the servers on which the network service runs, typically inside the data center where the server machines are deployed.
For scalability and availability reasons, a lot of network applications are deployed to more than one data center. The multiple data centers are typically located at different geographic locations.
Many hardware vendors provide hardware devices for security protection. For example, Application Delivery Controller (ADC) devices, Intrusion Prevention Devices (IPS) and Web Application Firewall devices are the typical hardware appliances that customers use today for enforcing security. Some web acceleration devices also provide security protection features. A list of companies that provide such products include Arbor Networks, Cisco Systems, F5 Networks, BlueCoat, Brocade Communications, Citrix Systems, RadWare, Barracuda, JetNexus, Kemp Technologies, A10 Networks, CAI Networks, Coyote Point Systems, Crescendo Networks, StrangeLoop Networks, Stamped Technologies, and Zeus Technology, among others.
Access management is typically achieved via custom coding, though some of the hardware devices also provide some access management capability. For example, it is very common that customers implement specific code to verify the validity of client requests by checking the “cookie” field from an HTTP request. If a certain cookie is not found from such an HTTP request, the request is considered “illegal” and rejected. Another example is A/B testing. Customers implement some custom specific code to serve different pages to different clients according to the specific A/B testing logic.
However, the current “inside the data center” approaches such as deploying specialized hardware and custom coding do not work very well in reality. Some of the problems are listed below:
As a result of the above problems, it is not surprising that a lot of web sites can not afford the cost and complexity of such solutions and thus are left vulnerable to security attacks. Even for these large scale web applications that have the resources and time to implement access management and security protection, it is not unusual to see them go down for a prolonged period of time whenever a problem happens due to the inflexibility and limitations of such approaches.
Thus there is a need for a new approach to provide access management and security protection that is easier to implement, easier to manage and more responsive to problems.
In general, in one aspect, the invention features a method for providing access management and security protection to a computer service, including the following steps. First providing a computer service that is hosted at one or more servers and is accessible to clients via a first network. Next, providing a second network that includes a plurality of traffic processing nodes. Next, providing means for redirecting network traffic from the first network to the second network and then redirecting network traffic targeted to access the computer service via the first network to traffic processing nodes of the second network via the means for redirecting network traffic. Next, inspecting and processing the redirected network traffic by the traffic processing nodes. Finally, routing only redirected network traffic that has been inspected, processed and approved by the traffic processing nodes to access the computer service via the second network.
Implementations of this aspect of the invention may include one or more of the following features. The second network is an overlay network superimposed over the first network. The processing of the redirected network traffic includes applying network traffic management comprising at least one of client throttling, geographic throttling or rate throttling. The inspecting of the redirected network traffic includes inspecting for presence of malware, spyware, virus, adult content, worm, denial of service attack, injection attack or information scanning attack. The method further includes preventing the redirected network traffic from accessing the computer service, upon confirmation of the presence of malware, spyware, virus, adult content, worm, denial of service attack, injection attack or information scanning attack. The second network further includes access management means and security protection means. The traffic processing nodes are configured to provide access management and security protection to the computer service via the access management means and security protection means, respectively. The method further includes applying access rules via the access management means and applying security rules via the security protection means to the redirected network traffic in real time. The access rules and the security rules are aggregates of access rules and security rules applied to a plurality of computer services. The method may further include providing means for monitoring network traffic parameters comprising at least one of network traffic volume, bandwidth consumption information, link congestion level, link latency, request URL or origin IP, and then monitoring the network traffic. The second network further includes a data processing system comprising one or more databases storing network traffic data produced by the monitoring means and the aggregate access rules and security rules. The method further includes sharing the network traffic data produced by the monitoring means and the aggregate access rules and security rules among a plurality of computer services. The data processing system further includes means for analyzing the network traffic data stored in the databases and the method further includes analyzing the stored data with the analyzing means to determine key network metrics required for decision making. The method further includes directing responses from the computer service to the traffic processing node of the second network and inspecting and processing the responses by the traffic processing node before returning the responses to the clients. The means for redirecting network traffic may be means for setting Domain Name System (DNS) Name Server (NS) record, means for setting DNS Canonical Name (CNAME) record, means for setting “A” record, means for hosting DNS records at a DNS system that resolves hostname of the computer service to traffic processing nodes, means for setting client side proxy configurations, or means for network address translation. The second network includes virtual machines nodes. The second network scales its processing capacity and network capacity by dynamically adjusting the number of traffic processing nodes. The computer service may be a web application, web service or email service. The method may further include providing an access control gateway. The access control gateway is configured to provide access control and security control to the computer service by allowing only network traffic from the traffic processing nodes of the second network to access the computer service. The access control gateway may be a router configured to allow only network traffic with a specific signature to pass through. The specific signature may be an IP address or token. The access control gateway may be a private communication channel between the computer service and the second network.
In general, in another aspect, the invention features a system for providing access management and security protection to a computer service including a first network, a computer service and a second network. The first network provides network connections between one or more servers and a plurality of clients. The computer service is hosted at the one or more servers and is accessible to the clients via the first network. The second network includes a plurality of traffic processing nodes. The system also includes means for redirecting network traffic targeted to access the computer service via the first network to traffic processing nodes of the second network. The system also includes means for inspecting and means for processing the redirected network traffic by the traffic processing nodes. The system also includes means for routing only redirected network traffic that has been inspected, processed and approved by the traffic processing nodes to access the computer service via the second network.
Among the advantages of the invention may be one or more of the following. The invention provides a service that prevents undesired access, filters out unwanted traffic targeted at a network application and allows only clean traffic to reach the network application. The present invention eliminates the need to set up special hardware appliances or write custom code inside the data center while enhancing the security and flexibility of such network application. The service for access management and security protection is built into the network itself. Traffic processing nodes with such intelligence are deployed at various locations of the network, together forming a network service for access management and security protection. Traffic targeted at a network application is intercepted and processed by this network service first. The network service inspects traffic, figures out how access should be granted, which traffic is unwanted and which is legitimate traffic according to rules and policies related to the specific network application. Further, the network service blocks out unwanted access, discards unwanted traffic and only forwards the legitimate traffic to the target network application. As a result, unwanted traffic is filtered out by the network and thus only clean traffic reaches the network application.
The invention also aggregates data and intelligence from many network applications, independent of whether these network applications are related or not, in order to make better decisions. A centralized global data storage is used for storing and managing threat signature patterns, storing monitoring results of global network conditions, storing monitoring results of all protected network applications, storing gathered global data, providing global visibility and correlating all these stored data to provide access management and security protection for a plurality of network applications. The data stored in the global data storage are shared among all network applications. Whenever a new threat is detected, its signature patterns are added to the threat signature patterns database. Since a shared global data storage is used, threat signature patterns need to be updated only once and can be applied to all network services. This is distinctly different from prior art solutions where each network application must update its own threat signature database in order to prevent new attacks.
Furthermore, the network service uses probes deployed at various locations of the network to gather data. Such data may include bandwidth consumption information, link congestion level, link latency, request URL, origin IP, among others. Such data are stored at specific locations, forming a global data repository. Furthermore, the service performs analysis based on the global data repository to determine some key metrics required for decision making, such as request rate from a specific client, the geographic location of a specific client IP, the number of requests to a specific URL, the number of requests from a specific client, among others. As a result of such global data analysis, the network service is able to identify undesirable access, unwanted traffic and detect problems much better than the prior art solutions.
The invention also provides an access management and security protection network service that automatically grows or shrinks its processing capacity and bandwidth capacity in response to the traffic demand, thus being able to handle large scale distributed denial of service attacks without building up an expensive infrastructure up front.
The invention also provides a system and method that secures network applications by disabling the public network access to the application directly without disrupting access from legitimate clients from the public network. Such applications are referred to as “virtual private applications”. In one embodiment, the servers on which the application runs are deployed behind a router which blocks out public network access to the target network application. A private communication tunnel between the servers and the routing network is established and all traffic to the target network application is redirected through the routing network which then enforces security rules and polices. As a result, only legitimate traffic can access the application.
The details of one or more embodiments of the invention are set forth in the accompanying drawings and description below. Other features, objects and advantages of the invention will be apparent from the following description of the preferred embodiments, the drawings and from the claims.
The present invention utilizes an overlay virtual network to provide access management and security protection for networked computer services (Virtual Network-based Security Service). The security service itself is a network service that provides access control, trouble detection, trouble prevention, malware detection and removal, and denial of service (DOS) mitigation for other network services that the overlay network is connected to, such as web applications and web services.
Traffic processing nodes are deployed on the physical network through which client traffic travels to data centers where a network application is running. These traffic processing nodes are called “Traffic Processing Units” (TPU). TPUs are deployed at different locations, with each location forming a computing cloud. All the TPUs together form a “virtual network”, referred to as a “cloud routing network”. A traffic management mechanism intercepts all client traffic and redirects them through the TPUs. TPUs consult global data store in trouble detection, trouble prevention, access control and Denial of Service Attack (DOS) defense. In the end, only “clean traffic” is routed to the target data center and thus the network application is protected.
Each TPU has a certain amount of bandwidth and processing capacity. These TPUs are connected to each other via the underlying network, forming a virtual network. This virtual network possesses a certain amount of bandwidth and processing capacity by combing the bandwidth and processing capacities of all the TPUs. When traffic grows to a certain level, the virtual network starts up more TPUs as a way to increase its processing power as well as bandwidth capacity. When traffic level decreases to a certain threshold, the virtual network shuts down a certain TPUs to reduce its processing and bandwidth capacity.
Referring to
The protected network service is running on multiple servers (i.e., server 386 and server 388) behind a firewall inside data center 380. Clients 300 access this network service via network 370. There are different types of clients: users 310 and 316, spider 318, hacker 312, and virus 314. Depending on the specific conditions related to the protected network service, some client requests are legitimate, some are not. Some client access requests are undesirable.
Without the security service illustrated in
The traffic processing unit then performs inspection of the request and determines its access condition and status. Unlike the prior art solutions where such decisions are based on local data gathered by individual appliances, the present invention makes much better decisions by leveraging its global data visibility.
Lastly, the traffic processing unit performs traffic processing by applying rules associated with access management and security. For example, as shown in
The present invention leverages a cloud routing network. By way of background, we use the term “cloud routing network” to refer to a virtual network that includes traffic processing nodes deployed at various locations of an underlying physical network. These traffic processing nodes run specialized traffic handling software to perform functions such as traffic re-direction, traffic splitting, load balancing, traffic inspection, traffic cleansing, traffic optimization, route selection, route optimization, among others. A typical configuration of such nodes includes virtual machines at various cloud computing data centers. These cloud computing data centers provide the physical infrastructure to add or remove nodes dynamically, which further enables the virtual network to scale both its processing capacity and network bandwidth capacity. A cloud routing network contains a traffic management component 330 that redirects network traffic to its traffic processing units (TPU), a traffic processing mechanism 334 that inspects and processes the network traffic and a DPS 332 that gathers data from different sources, stores them in a global data store and provides global decision support and means to configure and manage the system.
These nodes are connected to each other via the underlying network 370. The connection between two nodes may contain many physical links and hops in the underlying network, but these links and hops together form a conceptual “virtual link” that conceptually connects these two nodes directly. All these virtual links together form the virtual network. Each node has only a fixed amount of bandwidth and processing capacity. The capacity of this virtual network is the sum of the capacity of all nodes, and thus a cloud routing network has only a fixed amount of processing and network capacity at any given moment. This fixed account of capacity may be insufficient or excessive for the traffic demand. By adjusting the capacity of individual nodes or by adding or removing nodes, the virtual network is able to adjust its processing power as well as bandwidth capacity.
Referring to
The invention uses a network service to process traffic and thus delivers only “clean” traffic to the target servers.
More specifically, when a client issues a request to a server (for example, a consumer enters a web URL into a web browser to access a web site), the default Internet routing mechanism would route the request through the network hops along a certain network path from the client to the target server (“default path”). Using a cloud routing network, if there are multiple server nodes, the cloud routing network first selects an “optimal” server node from the multiple server nodes as the target serve node to serve the request. This server node selection process takes into consideration factors including load balancing, performance, cost, and geographic proximity, among others. Secondly, instead of going through the default path, the traffic management service redirects the request to an “optimal” Traffic Processing Unit (TPU) within the overlay network (“Optimal” is defined by the system's routing policy, such as being geographically nearest, most cost effective, or a combination of a few factors). This “optimal” TPU further routes the request to second “optimal” TPU within the cloud routing network if necessary. For performance and reliability reasons, these two TPU nodes communicate with each other using either the best available mechanism or an optimized transport mechanism. Then the second “optimal” node may route the request to a third “optimal” node and so on. This process can be repeated within the cloud routing network until the request finally arrives at the target server. The set of “optimal” TPU nodes together form a “virtual” path along which traffic travels. This virtual path is chosen in such a way that a certain routing measure (such as performance, cost, carbon footprint, or a combination of a few factors) is optimized.
When the server responds, the response goes through a similar pipeline process within the cloud routing network until it is reaches the client. In the process, the response may be inspected for possible containment of “unwanted content” such as spyware, malware, pornography and so on. Such “unwanted content” is removed from the response if policy requires doing so.
The invention also uses the virtual network for performing process scaling and bandwidth scaling in response to traffic demand variations. The cloud routing network monitors traffic demand, load conditions, network performance and various other factors via its monitoring service. When certain conditions are met, it dynamically launches new nodes at appropriate locations and spreads load to these new nodes in response to increased demand, or shuts down some existing nodes in response to decreased traffic demand. The net result is that the cloud routing network dynamically adjusts its processing and network capacity to deliver optimal results while eliminating unnecessary capacity waste and carbon footprint.
Further, the cloud routing network can quickly recover from “fault”. When a fault such as node failure and link failure occurs, the system detects the problem and recovers from it by either starting a new node or selecting an alternative route. As a result, though individual components may not be reliable, the overall system is highly reliable.
The present invention includes a mechanism, referred to as “traffic redirection”, such that client requests are intercepted and redirected to traffic processing nodes. The traffic processing nodes inspect the traffic, process the traffic by applying rules and polices associated with access management and security protection. As a result, a traffic process node may discard or reject the traffic if such traffic is determined to be “unwanted traffic”, or otherwise route the traffic to the target server.
The following list includes a few examples of the traffic interception and redirection mechanisms. However, this list is not intended to be exhaustive. The invention intends to accommodate various traffic redirection means.
Referring to
The above examples are for illustration purpose. The present invention is agnostic and accommodates a wide variety of ways of monitoring. An embodiment of the present invention employs all above techniques for monitoring different target systems: Using ICMP, traceroute and host agent to monitor the cloud routing network itself, using web performance monitoring, network security monitoring and content security monitoring to monitor the available, performance and security of target network services such as web applications.
Referring to
Furthermore, the network service uses probes deployed at various locations of the network to gather data. Such data may include bandwidth consumption information, link congestion level, link latency, request URL, origin IP, among others. Such data are stored at specific locations, forming a global data repository. Furthermore, the service performs analysis based on the global data repository to determine some key metrics required for decision making, such as request rate from a specific client, the geographic location of a specific client IP, the number of requests to a specific URL, the number of requests from a specific client, among others. As a result of such global data analysis, the network service is able to identify undesirable access, unwanted traffic and detect problems much better than the prior art solutions.
Following the forgoing discussed embodiments of using the present invention to provide access management and security protection for general network accessible computer services, the present invention will be better understood by reviewing some specific applications: virtual private application, web applications, web services, and email servers.
Part of the present invention disclosed here is a system and method for enabling a “virtual private application”. Typical network applications (or network accessible computer services) are designed to be accessible by anyone that has access to that network. Due to the open nature of network access, the network application may become target of unwanted or even malicious traffic.
The present invention “removes” the network application from public access. In fact, it makes the application “not publicly” accessible. Its access is limited to certain parts of a virtual network only. All traffic targeted at the application is routed to a virtual network for processing. Upon cleaning unwanted or malicious traffic, only “clean traffic” arrives at the application.
In another example, the target server nodes establish a private communication channel with TPU nodes and only accept packets from this private communication channel. This invention is not limited to a specific technique but rather accommodates a wide range of such techniques.
A part of the present invention disclosed here is a system and method for web application security.
Referring to
In this embodiment the traffic management system utilizes customized Domain Name System (DNS) servers and configures the application's DNS record to point to the customized DNS servers. Such configuration can be achieved by setting various DNS entries. The following is a sample list of techniques:
When a client is trying to access a Web URL, instead of resolving the hostname to the IP address of a target server, the customized DNS server resolves the hostname of the URL to the IP address of an “optimal” Traffic Processing Unit (TPU) node within the web application security system. As a result, all traffic targeted at a target server is “redirected” to the TPU unit instead.
When the TPU node receives a request from a client, it inspects the request, compares it to the known threat patterns provided by the data processing system and performs a series of security checks and access management tasks. First, the TPU performs access management by checking predefined rules and policies, and compares the related data associated with such rules and policies, such as request protocol, client information, geography, request rate and request token, among others. Such access checking allows the TPU to determine whether access should be granted to this request. If the access should be denied, such traffic is rejected and the event is logged. For example, if the client IP is in an IP black list, the request should be denied. Otherwise the TPU continues to process the request. Next, it performs a serious of security checks by comparing the request to a threat signature pattern database. The matching process helps the TPU determine whether the request poses security threat and thus should be denied. Typical forms of security threats considers include denial of service attacks (DOS), virus, spam, worm, spyware, malware, phishing, information gathering attacks (directory scanning, link crawling, password cracking) and injection attacks (SQL injection, variable injection, command injection, cookie tampering, cross site scripting attacks). If a threat match is found, the request is rejected. Otherwise the request is routed to the target node for processing. When an attack against one application is identified, the data processing system A60 is updated immediately and such update prevents other applications from being attacked by the same attack.
The above list is not intended to be exhaustive but rather for the purpose of illustrating the subject invention. There are many other security checks, such as applying customer configured rules, running customer configured filter or even run custom logic, that the system performs. These variants are all within the spirit of the subject invention.
The advantages of the present invention include the following. It is very easy to adopt the presented solution because it is non-intrusive to customers and users. Customers do not need to purchase hardware or install software in order to use the web security service. Users do not need to change anything in order to receive the benefits of the service. As a hosted service, the present invention allows a service provider to continuously collect data and use collected data to continuously enhance the service. For example, a service provider can stop the users from accessing a new phishing site as soon as the service provider identifies the phishing site, significantly reducing the damage. As an application based on a cloud routing network, the service has “auto scaling” capability built in to deliver both performance and cost effectiveness. As an application based on a cloud routing network, it also provides load balancing and failover capabilities. For example, if one web server is down, the system automatically routes requests to other web servers.
Another part of the present invention disclosed here is a system and a method for web services management. A Web service is “a software system designed to support interoperable machine-to-machine interaction over a network”. Web services are typically provided via application programming interfaces (API) that can be accessed over a network, such as the Internet, and executed on a remote system hosting the requested services. Web services are frequently used to implement architecture according to Service-oriented architecture (SOA) concepts, where the basic unit of communication is a message, rather than an operation. This is often referred to as “message-oriented” services. SOA Web services are supported by most major software vendors and industry analysts. The typical protocols that web services use include Simple Object Access Protocol (SOAP), Representational state transfer (REST) and JavaScript Object Notation (JSON).
Companies can provide third party access to data and application logic via web services, and thus allow third parties to build applications that leverage the capability of different systems without knowing the inner works of these systems. Well known examples of web services include Amazon EC2 API, eBay Web Services and Salesforce.com's web services.
To facilitate the production and consumption of web services, there is a need to meter service usage and measure service quality. Further, there is a need to provide access control and reporting. Such functionalities are typically built by (or purchased by) web service producers and deployed over a “fixed capacity” infrastructure. Building, deploying, and managing such functionalities is expensive and time consuming. Further, using a “fixed capacity” infrastructure does not scale well. The present invention provides a much simpler and more cost effective solution. The web service management system of the present invention is a network service based on a cloud routing network. The cloud routing network is a virtual network comprising of nodes distributed at different locations over the underlying physical network. These nodes provide traffic interception, traffic redirection, traffic processing, and monitoring services.
Referring to
While web services calls are being routed within the cloud routing network, the web services management application performs various processing, such as access control, usage metering, rule and policy enforcement, denial of service mitigation and reporting, among others.
The above mentioned examples are merely for the purpose of illustrating the present invention. As one skilled in the art will appreciate, many combinations or variants, such as different kinds of “management”, different steps of “management” and different protocols, are all within the spirit of the present invention.
Another part of the present invention disclosed here is a system and method for email security and archiving. There are a variety of email security and archiving solutions available in the prior art. The present invention is different because it is based on a cloud routing network. Because the present invention is based on a cloud routing network, it is able to provide much better performance, and more cost effective scalability than prior arts. Importantly, the subject invention is non-intrusive to customers and users. Customers do not need to purchase hardware or install software in order to adopt the service. Users do not need to change anything in order to receive the benefits of the service. Further, as a hosted service, the present invention allows a service provider to continuously collect data and use collected data to non-disruptively enhance the service. For example, the service provider can stop a new email virus from spreading as soon as the service provider learns about the virus, which is much quicker than requiring each customer to learn about the virus and taking actions on their own.
The email security and archiving system of the present invention (“email security system”) is an application based on a cloud routing network. It includes the following components:
When a client sends an email to an email address that belongs to one of the managed email servers, the traffic redirection module of the present invention redirects the email message to a node within the email management system. This node performs routing, path selection, transport selection before delivering the message to the target email server node. However, before it performs the routing activity as part of the cloud routing network, it invokes the email security application C30 to process the message first, shown in
The above list is not exhaustive and is merely for illustration purpose.
In performing the above checks, the email security system may consult its own databases and business rules. Depending on the answer to the above questions, it performs the corresponding actions. If the answer to any of the above mentioned checks is positive, the system rejects the mail message (886) and logs the message (887). Finally, after the above processing, if applicable, the message is routed to the target email server for delivery (889). The mail usage is metered, the metrics is logged (890) and the message is archived (891).
The advantages of the present invention include the following. It is very easy to adopt it because it is non-intrusive to customers and users. Customers do not need to purchase hardware or install software in order to adopt the service. Users do not need to change anything in order to receive the benefits of the service. As a hosted service, the present invention allows a service provider to continuously collect data and use collected data to continuously enhance the service. For example, the service provider can stop a new email virus from spreading as soon as the service provider learns about the virus, long before customers even hear about the virus. As an application based on a cloud routing network, the service has “auto scaling” capability built in to deliver performance and scalability in a cost effective manner. As an application based on a cloud routing network, it also provides load balancing and failover capabilities. For example, if one email server is down, the system automatically routes messages to other email servers.
Several embodiments of the present invention have been described. Nevertheless, it will be understood that various modifications may be made without departing from the spirit and scope of the invention. Accordingly, other embodiments are within the scope of the following claims.
This application claims the benefit of U.S. provisional application Ser. No. 61/165,250 filed on Mar. 31, 2009 and entitled CLOUD ROUTING NETWORK FOR BETTER INTERNET PERFORMANCE, RELIABILITY AND SECURITY, which is commonly assigned and the contents of which are expressly incorporated herein by reference.
| Number | Date | Country | |
|---|---|---|---|
| 61165250 | Mar 2009 | US |
