Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
1999-07-01
2001-10-30
Trammell, James P. (Department: 2161)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C173S152000
Reexamination Certificate
active
06311278
ABSTRACT:
COPYRIGHT NOICE
A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyright rights whatsoever.
RELATED APPLICATIONS
This application is related to pending application Ser. No. 09/149,911 titled METHOD AND SYSTEM FOR PROTECTING OPERATIONS OF TRUSTED INTERNAL NETWORKS, filed Sep. 9, 1998, and application Ser. No. 09/150,112 titled METHOD AND SYSTEM FOR MAINTAINING RESTRICTED OPERATING ENVIRONMENTS FOR APPLICATION PROGRAMS OR OPERATING SYSTEMS, filed Sep. 9, 1998, both of which applications are hereby incorporated by reference into this application.
BACKGROUND OF THE INVENTION
The present invention relates generally to network security and privacy systems, and more particularly to a method and system for continuously and automatically or semi-automatically defining and updating actions which may be taken in an application program operating on a server.
One way in which the security or privacy of data or an application program residing on a server computer may be compromised is through an unauthorized command. That is, a client computer connectable to the server, such as via the Internet, may transmit a request for the retrieval of data or for the execution of an instruction to which the client is not entitled. For example, a web server accessible over the Internet on which goods are available for sale may allow actions such as the selection of an item to purchase, the input of personal and payment data, or even the execution of an application program to retrieve data previously entered. However, the web server should not allow a given client to change price data or retrieve other data intended to be kept private, and these types of requests should be considered unauthorized or disallowable for that client. Currently, many applications do not include safeguards against clients making these kinds of requests.
Presently, service provider networks (e.g., commercial sites, government institutes, e-commerce sites, etc.) are often protected by firewall security devices or routers. These tools provide a good level of security against attacks based on the weaknesses of low level protocols (such as TCP or UDP) and of generic Internet applications like FTP or TELNET. However, these tools cannot guard implementations of specific application protocols, such as a specific banking application, billing application, insurance application, etc., nor can they account for changes or updates to application protocols.
To prevent clients from performing disallowable actions, a gateway or filter mechanism may be interposed between the client and server to identify and eliminate disallowable requests. As shown in
FIG. 1
, a filter module
14
is positioned between a server
10
and clients, only one of which is shown in
FIG. 1
as client
12
. The filter module
14
receives requests from the client
12
, eliminates any disallowable actions requested by the client
12
to the server
10
, and passes the remaining, allowable parts of requests to the server
10
. The filter module
14
determines which requests are allowable by querying a protocol database
16
. The protocol database
16
stores an application protocol for the application program residing on the server. As used herein, an application protocol represents some or all of the allowable actions for the application program.
An example of a gateway system and related components is described in the aforementioned applications, Ser. Nos. 09/149,911 and 09/150,112, which are incorporated by reference into this application.
In order to create the protocol database
16
, a developer must know all the protocols of the application and the authorized or allowable actions. However, for applications which utilize complex protocols, the process of specifying the precise protocol can be long and tedious. In addition, the application developer is often not even aware of the complete protocol specification, as implicit assumptions made by the programmer are usually extremely difficult to identify. Furthermore, the developer must monitor changes in the application protocol and update the protocol database accordingly. Failure to have a complete and accurate protocol database could prevent clients from making fill use of the application program residing on the server. An ineffective database could alternatively allow clients to take actions which are disallowed in the current version of the application program.
There is therefore a need for a method and system for at least semi-automatically defining application protocols for applications residing on servers on an on-line, real-time basis.
BRIEF SUMMARY OF THE INVENTION
It is an object of the present invention to solve the problems described above with security and privacy systems.
It is another object of the present invention to define allowable actions which may be requested by clients of servers.
It is another object of the present invention to provide a mechanism for extracting application protocols on an on-line, real-time basis.
These and other objects are achieved by a method implemented by an extraction computer program for extracting application protocols thereby defining a set of allowable or authorized actions. The method involves receiving a message from a server before it is sent or in parallel with sending to a client. The message may be in response to a specific request for it from the client. In the case of the world wide web, for example, in which clients typically request web documents or pages through browser programs, the requested web page would be intercepted before or in parallel with transmission to the client.
The extraction program then extracts the application protocol data from the server message. The server message typically contains data for one or more communication protocols required for transmission to the client, such as TCP/IP in the case of Internet communications. Working with a copy of the message, the program parses the communications data from the message and saves or discards this information. Then, the program strips off the communications protocol(s) from the message. The program next parses the remaining message to identify commands, fields, or other user-selectable options contained in the message. These items represent the set of allowable or authorized user actions for the application as set forth in the message.
The set of allowable user actions is then stored by the extraction program in a protocol database accessible to a gateway or filter module. The protocol data may be stored on a session by session basis, in which case it is used by the filter module to enforce a protocol policy for each individual client/server session and even for each portion or segment of an application program. When used this way, the protocol data may be continuously updated and changed to represent actions which are allowable at any given point. Alternatively, the protocol data may be collected from many sessions over a period of time and stored to create a larger and more complex protocol database.
In any event, the ability to capture an application protocol from a server message provides for a protocol database which may be continuously updated on an ongoing, real-time basis and which more accurately reflects the set of allowable actions.
REFERENCES:
patent: 4734853 (1988-03-01), Nakano
patent: 5073933 (1991-12-01), Rosenthal
patent: 5166977 (1992-11-01), Ross
patent: 5191611 (1993-03-01), Lang
patent: 5220604 (1993-06-01), Gasser et al.
patent: 5224163 (1993-06-01), Gasser et al.
patent: 5315657 (1994-05-01), Abadi et al.
patent: 5347578 (1994-09-01), Duxbury
patent: 5559800 (1996-09-01), Mousseau et al.
patent: 5566326 (1996-10-01), Hirsch et al.
patent: 5611048 (1997-03-01), Jacobs et al.
patent: 5623601 (1997-04-01), Vu
patent: 5629981 (1997-05-01), Nerlikar
patent: 5657390 (1997-08-01), Elg
El-Hanani Yuval
Galant Yoron
Moran Tal
Raanan Gil
Reshef Eran
Brown & Raysman Millstein Felder & Steiner LLP
Elisca Pierre E.
Sanctum Ltd.
Trammell James P.
LandOfFree
Method and system for extracting application protocol... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Method and system for extracting application protocol..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method and system for extracting application protocol... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2551516