# US 11,444,958 B2 · Web server security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,958 B2 - Document ID: US11444958B2 - Status: Granted - Kind: B2 - Application number: 16/333,272 - Filed: 2018-04-27 - Published: 2021-09-16 - Granted: 2022-09-13 - Earliest claimed: 2017-06-01 - Assignees: Garrison Technology Ltd. - Applicants: Garrison Technology Ltd - Inventors: Henry Harrison - Web page: https://patentgrep.com/patent/US11444958B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - H04L 5/0044: {Allocation of payload; Allocation of data channels, e.g. PDSCH or PUSCH} - H04L 49/3072: {Packet splitting} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L 69/22: Parsing or analysis of headers - H04L 69/326: in the transport layer [OSI layer 4] (H04L69/16 takes precedence) - H04L 63/1458: {Denial of Service} - H04L 63/166: {at the transport layer} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system (30) for protecting a server (20) from network attacks is provided. The system (30) comprises a data splitter (31) and a parameter extractor (33). The data splitter (31) is configured to receive network communications from a client (10); send network data comprising at least payload information included in the received network communications to the parameter extractor (33); and send network data comprising at least communication state information included in the received network communications to the server (20). The parameter extractor (33) is configured to apply predefined parameter extraction rules to network data received from the data splitter (31) in order to extract parameters, and to forward extracted parameters to the server (20). The system (30) is also configured to enforce unidirectional dataflow over at least part of the network connection path to the server (20) via the parameter extractor (33), such that dataflow to the server (20) over the network connection path is allowed, but dataflow in the opposite direction is not allowed for at least part of the network connection path. A server (20), data splitter (31) and parameter extractor (33) for use with the system (30) are also provided, and a corresponding method for protecting a server (20) from network attacks is provided. ## Claims ### Claim 1 A system for protecting a server from network attacks, the system comprising a data splitter and a parameter extractor, the data splitter being configured to: receive network communications from a client; send network data comprising at least payload information included in the received network communications to the parameter extractor; and send network data comprising at least communication state information included in the received network communications to the server; the parameter extractor being configured to: apply predefined parameter extraction rules to network data received from the data splitter in order to extract parameters, and to forward extracted parameters to the server, wherein the system is configured to enforce unidirectional dataflow over at least part of the network connection path to the server via the parameter extractor, such that dataflow to the server over the network connection path is allowed, but dataflow in the opposite direction is not allowed for at least part of the network connection path. ### Claim 2 (depends on 1) A system according to claim 1, wherein the data splitter is further configured to process the received network communications to remove payload information to produce cleared data, the cleared data comprising communication state information included in received network communications, and wherein sending network data to the server comprises sending the cleared data to the server. ### Claim 3 (depends on 2) A system according to claim 2, wherein processing received network communications to produce cleared data comprises overwriting a payload of a received network communication, optionally with zeroes or other meaningless data. ### Claim 4 (depends on 2) A system according to claim 2, wherein processing received network communications to produce cleared data comprises removing a payload of a received network communication. ### Claim 5 (depends on 1) A system according to claim 1, configured to enforce unidirectional dataflow over at least part of the network connection path between the parameter extractor and the server, such that dataflow from the parameter extractor to the server over the network connection path is allowed, but dataflow from the server to the parameter extractor over the network connection path is not allowed. ### Claim 6 (depends on 1) A system according to claim 1, configured to enforce unidirectional dataflow over at least part of the network connection path between the parameter extractor and the client. ### Claim 7 (depends on 1) A system according to claim 1, configured to enforce unidirectional dataflow over at least part of the network connection path between the data splitter and the parameter extractor, such that dataflow from the data splitter to the parameter extractor over said network connection path is allowed, but dataflow from the parameter extractor to the data splitter over said network connection path is not allowed. ### Claim 8 (depends on 1) A system according to claim 1, wherein the parameter extractor is configured to signal to the data splitter to confirm when it has successfully received network data from the data splitter, and wherein the data splitter is configured to only send network data to the server when the parameter extractor has signalled that it has successfully received the network data sent by the data splitter. ### Claim 9 (depends on 1) A system according to claim 1, wherein the parameter extractor is configured to extract one or more GET parameters from HTTP GET requests. ### Claim 10 (depends on 1) A system according to claim 1, wherein the parameter extractor is configured to extract one or more POST parameters from HTTP POST requests. ### Claim 11 (depends on 1) A system according to claim 1, wherein the communication state information comprises information for maintaining a stateful communication session for a connection-oriented communication protocol. ### Claim 12 (depends on 1) A system according to claim 1, further comprising a parameter validator located between the parameter extractor and the server, the parameter validator being configured to: receive extracted parameters from the parameter extractor; apply predefined rules for implementing predefined validation criteria to the received parameters; and send parameters meeting the predefined validation criteria to the server. ### Claim 13 (depends on 12) A system according to claim 12, configured to enforce unidirectional dataflow between the parameter extractor and the parameter validator, such that dataflow from the parameter extractor to the parameter validator is allowed, but dataflow from the parameter validator to the parameter extractor is not allowed. ### Claim 14 (depends on 12) A system according to claim 12, configured to enforce unidirectional dataflow between the parameter validator and the server, such that dataflow from the parameter validator to the server is allowed, but dataflow from the server to the parameter validator is not allowed. ### Claim 15 (depends on 1) A system according to claim 1, wherein the parameter extractor is preconfigured with encryption-related data of the server so that the system can establish encrypted communication sessions with network-based clients. ### Claim 16 (depends on 1) A system according to claim 1, wherein the parameter extractor is preconfigured with encryption-related data of the server so that the parameter extractor can generate a secret key from extracted parameters, so that the parameter extractor can decrypt network communications received from the data splitter. ### Claim 17 (depends on 1) A system according to claim 1, further comprising the server. ### Claim 18 (depends on 17) A system according to claim 17, wherein the server is configured to formulate responses to the network communications received by the data splitter using the parameters received from the parameter extractor. ### Claim 19 (depends on 17) A system according to claim 17, wherein the server is configured to formulate protocol-level responses to network communications received by the data splitter using the communication state information included in the data received from the data splitter. ### Claim 20 A method for protecting a server from network attacks, the method comprising: receiving network communications from a client at a data splitter; sending network data comprising at least payload information included in the received network communications from the data splitter to a parameter extractor; sending network data comprising at least communication state information included in the received network communications from the data splitter to the server; and applying, by the parameter extractor, predefined parameter extraction rules to the network data received from the data splitter in order to extract parameters, and forwarding extracted parameters to the server; and enforcing unidirectional dataflow over at least part of the network connection path to the server via the parameter extractor, such that dataflow to the server over the connection path is allowed, but dataflow in the opposite direction is not allowed for at least part of the network connection path.