Patent application EP16305225A (EP), filed 2016-02-26
Publication number: EP3211853A1
Title: REAL-TIME VALIDATION OF JSON DATA APPLYING TREE GRAPH PROPERTIES
Abstract: The invention relates to a method of processing in real-time a data stream exchanged between a source and a server over a telecommunications network, the method being carried out by a classifier, said classifier storing a first set of a least one test, and a list of existing TCP connections, the method comprising: - receiving (400) a TCP segment of the data stream, the TCP segment including data payload, said payload comprising at least a portion of a HTTP message; - identifying (401) a first TCP connection to which the TCP segment belongs or creating a new first TCP connection for the received TCP segment; - detecting (406), in the portion of the HTTP message, presence of JavaScript Object Notation, JSON, data ; - in the case where JSON data is detected, building (409) a tree graph based on the JSON data; - performing (410) at least one test of the first set on properties of the built tree graph to determine whether the JSON data is invalid; - if the JSON data is invalid, interrupting (411) the first TCP connection.
IPC codes: H04L  29/    06            A I
G06F  16/    81            A I
G06F  16/   901            A I
H04L  29/    08            A I
Claims: number: 1
text: A method of processing in real-time a data stream exchanged between a source (10.1 ;10.2) and a server (13) over a telecommunications network (12), the method being carried out by a classifier (15), said classifier storing a first set of a least one test, and a list of existing TCP connections, the method comprising:
number: 2
text: The method according to claim 1, wherein the tree graph comprises a plurality of nodes (500), each node corresponding to a given node type among the following types :
number: 3
text: The method according to claim 2, wherein the tree graph comprises a plurality of nodes (500) including a root node and at least one child node of the root node, wherein properties of the tree graph includes any combination of the following:
number: 4
text: The method according to claim 3, wherein each node (500) of the tree graph with a number, string or Boolean type is associated with a key and with a value of the key and wherein the combination further comprises :
number: 5
text: The method according to claim 3 or 4, wherein each test of the first set consists in comparing one of the properties of the tree graph with a respective predetermined value, wherein if the property exceeds said respective predetermined value, a counter is incremented, and wherein, if the counter exceeds a predetermined threshold, the JSON data is classified as invalid.
number: 6
text: The method according to one of the preceding claims, wherein if the JSON data is not classified as invalid after performing the at least one test, then a semantic classification based on JSON schema completed with JSON content specification is performed on the JSON data to classify the JSON data as valid or invalid.
number: 7
text: The method according to one of the preceding claims, wherein the first TCP connection is interrupted by sending, by the classifier (15), a first TCP segment to the client (10.1; 10.2) and a second TCP segment to the server (13), said first and second TCP segments comprising a reset flag.
number: 8
text: The method according to one of the preceding claims, wherein, in case where no JSON data is detected in the TCP segment, the TCP segment is forwarded to a recipient of the TCP segment among the client and the server.
number: 9
text: The method according to one of the preceding claims, wherein the classifier (13) comprises a memory storing a list of monitored TCP connections,
wherein the method further comprises:
number: 10
text: The method according to one of the preceding claims, wherein the classifier comprises a memory storing a list of monitored TCP connections, wherein, for each monitored TCP connection, TCP connection information is maintained, said TCP connection information comprising a Bottom of Window;
wherein the received TCP segment comprises a TCP sequence number;
wherein the method comprises:
number: 11
text: The method according to claim 9 or 10, wherein each existing TCP connection is identified by identification information comprising a source address, a TCP source port, an IP destination address and a TCP destination port;
wherein the received TCP segment comprises a header indicating a first source address, a first TCP source port, a first IP destination address and a first TCP destination port.
number: 12
text: The method according to one of the preceding claims, wherein presence of JSON data is detected based at least on a first HTTP header value of the HTTP message.
number: 13
text: The method according to claim 12, wherein the classifier comprises a HTTP re-assembly buffer, and wherein a size of the re-assembly buffer is equal to a maximum size of at least the first HTTP header value.
number: 14
text: The method according to claim 12 or 13, wherein the first HTTP header value is a value corresponding to a field "Content-Type" and wherein JSON data length is detected based on a second HTTP header value corresponding to a field "Content-Length.
number: 15
text: A computer program product comprising a computer readable medium having stored thereon computer program instructions loadable into a computing device and adapted to - when loaded into and executed by said computing device-cause the computing device to perform a method according to anyone of claims 1 to 14.
number: 16
text: A classifier for processing in real-time a data stream exchanged between a source (10.1;10.2) and a server (13) over a telecommunications network (12),
wherein the classifier (15) comprises :
Office action: search_report, dated 2017-08-30
Rejection reasons: inventive_step_epc_56
Prior art cited: ref_id: WO2007009210A1
ref_type: patent
severity: background
ref_id: US2012124661A1
ref_type: patent
severity: background
ref_id: - BARRACUDA NETWORKS INC.: "Barracuda Web Application Firewall Administrator's Guide", 31 December 2015 (2015-12-31), XP002757621, Retrieved from the Internet <URL:https://techlib.barracuda.com/files/pdf/bwafv76.pdf> [retrieved on 20160512]
ref_type: npl
severity: background
ref_id: - F5: "BIG-IP® Application Security Manager:Implementations - Version 11.6", 20 August 2014 (2014-08-20), XP002757622, Retrieved from the Internet <URL:https://support.f5.com/content/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-11-6-0/_jcr_content/pdfAttach/download/file.res/BIG-IP_Application_Security_Manager__Implementations.pdf> [retrieved on 20160512]
ref_type: npl
severity: background
ref_id: - BARRACUDA NETWORKS, INC.: "Enhancements to Barracuda Web Application Firewall Streamline On-Premises Central Management", 24 June 2015 (2015-06-24), XP002757624, Retrieved from the Internet <URL:http://www.prnewswire.com/news-releases/enhancements-to-barracuda-web-application-firewall-streamline-on-premises-central-management-300103949.html> [retrieved on 20160512]
ref_type: npl
severity: background
ref_id: - FGE GALIEGUE ET AL: "JSON Schema: interactive and non interactive validation; draft-fge-json-schema-validation-00.txt", JSON SCHEMA: INTERACTIVE AND NON INTERACTIVE VALIDATION; DRAFT-FGE-JSON-SCHEMA-VALIDATION-00.TXT, INTERNET ENGINEERING TASK FORCE, IETF; STANDARDWORKINGDRAFT, INTERNET SOCIETY (ISOC) 4, RUE DES FALAISES CH- 1205 GENEVA, SWITZERLAND, 1 February 2013 (2013-02-01), pages 1 - 25, XP015089763
ref_type: npl
severity: background
ref_id: WO2007009210
ref_type: patent
severity: obviousness
ref_id: US2012124661
ref_type: patent
severity: background
ref_id: - Barracuda Networks Inc., "Barracuda Web Application Firewall Administrator's Guide", (20151231), Barracuda Networks Inc., URL: https://techlib.barracuda.com/files/pdf/bwafv76.pdf, (20160512), XP002757621 [Y] 1-9,11,12,14-16 * page  7  - page  7 * * page  10  - page  10 * * page  205  - page  205 * * page  221  - page  221 * * page  216  - page  218 * * page  576  - page  579 * [A] 10,13
ref_type: npl
severity: obviousness
ref_id: - F5, "BIG-IP® Application Security Manager:Implementations - Version 11.6", (20140820), F5, URL: https://support.f5.com/content/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-11-6-0/_jcr_content/pdfAttach/download/file.res/BIG-IP_Application_Security_Manager__Implementations.pdf, (20160512), XP002757622 [A] 1-16 * page  165  - page  168 *
ref_type: npl
severity: background
ref_id: - Barracuda Networks, Inc., "Enhancements to Barracuda Web Application Firewall Streamline On-Premises Central Management", (20150624), Barracuda Networks, Inc., URL: http://www.prnewswire.com/news-releases/enhancements-to-barracuda-web-application-firewall-streamline-on-premises-central-management-300103949.html, (20160512), XP002757624 [A] 1-16 * the whole document *
ref_type: npl
severity: background
ref_id: - FGE GALIEGUE ET AL, "JSON Schema: interactive and non interactive validation; draft-fge-json-schema-validation-00.txt", JSON SCHEMA: INTERACTIVE AND NON INTERACTIVE VALIDATION; DRAFT-FGE-JSON-SCHEMA-VALIDATION-00.TXT, INTERNET ENGINEERING TASK FORCE, IETF; STANDARDWORKINGDRAFT, INTERNET SOCIETY (ISOC) 4, RUE DES FALAISES CH- 1205 GENEVA, SWITZERLAND, (20130201), pages 1 - 25, XP015089763 [A] 1-16 * paragraph  [0007]  - paragraph  [0007] *
ref_type: npl
severity: background
Final disposition: pending (2017-08-30)