Load balancer based computer intrusion detection device

[0001] One embodiment of the present invention is directed to computer data security. More particularly, one embodiment of the present invention is directed to a load balancer based computer intrusion detection device.

[0002] The increasing prevalence of the Internet and other connected networks in people's lives, both for personal and business purposes, have given rise to a data explosion. Large amounts of data from all areas of the world are constantly available to a user with merely access to a personal computer and a communication line.

[0003] Unfortunately, the increased use and importance of the Internet has also spawned an increase in the number of people who access data and change data without authorization. These people, often referred to as hackers, have been around since the advent of computers. However, because so much data is now available over networks such as the Internet, the opportunities for hackers to perform their deeds has sharply increased in recent years. As a result, the number of unauthorized activities, or hacks, has skyrocketed.

[0004] One response to hacking incidents is the installation of an intrusion detection device, such as the Gillian G-Server from Gillian Technologies Inc. An intrusion detection device typically sits between the Web server and the router or firewall that connects the Web server to the Internet, and inspects every piece of content that goes out for signs of unauthorized changes. However, this activity adds latency because the data must be redirected to and processed by the intrusion detection device.

[0005] Based on the foregoing, there is a need for an improved intrusion detection device that reduces latency and provides other advantages.

[0006] FIG. 1 is a block diagram of a system in accordance with one embodiment of the present invention.

[0007] FIG. 2 is a flow diagram of the functions performed by a load balancer or other devices of the system in accordance with one embodiment of the present invention.

[0008] One embodiment of the present invention is a load balancer that compares a master copy of a Web site with the copy received from a Web server. If the copies differ, the load balancer takes proactive action.

[0009] FIG. 1 is a block diagram of a system 50 in accordance with one embodiment of the present invention. System 50 includes the Internet 20 and a client computer 10 that is used to access Internet 20. Client computer 10 can be any known personal computer or other device that includes a Web browser. The Web browser can be the Internet Explorer from Microsoft Corp., or any other type of browser. Client computer 10 accesses Internet 50 through known methods such as through an Internet service provider (not shown).

[0010] System 50 further includes a load balancer 30 coupled to servers 41-45. Servers 41-45 form a group of servers that provide the same or similar content to a user and can each respond to the same URL request from a client. Hackers can potentially access servers 41-45 through Internet 50 or through other means and modify or destroy the data stored on servers 41-45.

[0011] Load balancer 30 can be any known load balancer that is modified to implement an embodiment of the present invention. Many e-commerce sites and other sites on the Internet employ multiple servers and a load balancer as illustrated in FIG. 1. In essence, a load balancer makes multiple servers look like a single, high-powered network resource to those accessing the site. It does this by selectively forwarding connections to the many servers arrayed behind it in an equitable manner, according to the server's operational health and the nature of the query.

[0012] In one embodiment, load balancer 30 is the NetStructure 7180 e-commerce Director from Intel Corp. that has been modified to perform the functions described below. Load balancer 30 includes a processor and a memory or other type of computer readable medium. The memory may be integrated with load balancer 30, or may be remote from load balancer 30 (e.g., a remote memory accessible to load balancer 30 over a network). Stored on the memory in one embodiment is an master copy of all of the Web pages or other content that is stored at servers 41-45. In another embodiment, only a subset of the Web pages stored at servers 41-45 is stored on the memory of load balancer 30. In one embodiment, the master copy may include a template that defines a range of dynamic Web content.

[0013] FIG. 2 is a flow diagram of functions performed by load balancer 30 or other devices of system 50 in accordance with one embodiment of the present invention. These functions are performed by load balancer 30 in addition to the typical load balancer functions.

[0014] In one embodiment, the functions are implemented by software stored in memory and executed by the processor of load balancer 30. In other embodiments, the functions can be performed by hardware, or any combination of hardware and software. The functions can also be performed by a device that is separate from, but in communication with, load balancer 30.

[0015] At function 100, load balancer 30 receives a Uniform Resource Locator (URL) or other type of Web request from client computer 30. The Web request is directed to a Web site that is concurrently located on each of servers 41-45. The Web request is a request for content located on the Internet.

[0016] At function 110, load balancer 30 selects one of servers 41-45 based on known load balancing algorithms or techniques. These algorithms typically distribute URL requests or queries equitably among servers 41-45 in order to amortize load and improve availability by avoiding downed servers. The Web request is then forwarded to the selected server.

[0017] At function 120, the selected server responds to the request with Web content such as a HyperText Markup Language (HTML) Web page. The Web content is received by load balancer 30.

[0018] At function 130, load balancer 30 compares the Web content received from the server with the master copy of the Web content stored at load balancer 30. In one embodiment, the Web content has static content such as a Web page that does not change. In this embodiment, the comparison can be on a bit-by-bit basis to insure that the Web pages are identical.

[0019] In another embodiment, the Web content has dynamic content that changes, such as a Web page that returns a calculated price of a requested product item. In this embodiment, the static portion of the Web page can be compared on a bit-by-bit basis, and the dynamic content can be compared to a template that specifies valid ranges or possibilities of the content. For example, a template might specify that the price of a product should be between $10-$50. The comparison would verify that the price on the returned Web page is between this range, and also whether the price is even a number (e.g., a hacker may substitute a phrase or picture for the price).

[0020] At function 140, load balancer 30 determines whether the received Web content is valid based on the comparison at function 130. In one embodiment, the Web content is valid only if the static content is identical to the master Web content at load balancer 30 and the dynamic content falls within template specifications. If the Web content is not valid, it is likely that the server that sent that content has been hacked.

[0021] If at function 140 it is determined that the Web content is not valid, multiple actions may be taken at function 150. One action is to send an e-mail to an administrator to alert the administrator that the server has been hacked, or otherwise report the status of the server. Another action is to mark the server that sent the invalid content as dead, and have load balancer 30 redirect the Web request from function 100 to one of the remaining servers at function 160. All future Web requests received by load balancer 30 would then be re-balanced to exclude the dead server, until the server is corrected.

[0022] If load balancer 30 determines that the Web content is valid at function 140, the Web content is forwarded to client computer 10 at function 170. The Web content is then displayed at client computer 10 at function 180.

[0023] In one embodiment, for performance sensitive implementations, only a percentage of the traffic for each Web page is checked for validity by load balancer 30 as opposed to all of the traffic.

[0024] When updating the valid content, the load balancer should be updated first. After updating the load balancer each of the servers should be updated. For a period of time the old content and new content will be valid. After that period old content will be treated as hacked or invalid content.

[0025] As described, embodiments of the present invention checks for the validity of Web content at a load balancer in response to a Web content request.

[0026] Embodiments of the present invention provide advantages over prior art intrusion detection devices because the load balancer can transparently get valid content to a user through an alternative server when not all of servers 41-45 are hacked. In addition, embodiments of the present invention provide proactive hacked content discovery and faster hacked Web server recovery. In addition, embodiments of the present invention eliminates the need for a separate intrusion detection device by using an already existing load balancer. This reduces latency and allows networks to operate more efficiently and at lower costs.

[0027] Several embodiments of the present invention are specifically illustrated and/or described herein. However, it will be appreciated that modifications and variations of the embodiments of the present invention are covered by the above teachings and within the purview of the appended claims without departing from the spirit and intended scope of the invention.