US 2012/0260315 A1Published application

Firewalls for providing security in http networks and applications

AssigneeGrupo S21Sec Gestion, S.A.

InventorsLlius Mora Hidalgo, Xabier Panadero Lleonart

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods provide security to HTTP applications. Responses sent from a server, such as a web server, are analyzed and a signature is generated for each HTML object in that page. The signature is encrypted and sent to a client along with the contents of the page. When a client later sends a request, the system checks the signature associated with that request with the contents of the request itself. If the values, variables, lengths, and cardinality of the request are validated, then the request is forwarded to the web server. If, on the other hand, the request is invalidated, the request is blocked from reaching the web server, thereby protecting the web server from malicious attacks. The systems and methods offer security without being limited to a session or user.

Claims11

Dependent claims

A method for validating a communication sent from a client computer to an application server, the method comprising the steps of:

a security server intercepting an electronic form in HTML format sent by the client computer addressed to the application server before the form is processed by the application server, the security server generating a signature based on (a) session information contained in a field of the form which is not displayed in the form but is listed in an HTML document describing the form or (b) information with the form specifying a permitted maximum length of data in a field of the form, and forwarding the signature along with the form to the application server;
in response to the communication, the application server processing the form, and returning to the client computer a related form and the signature, the related form having a field which was the basis for the signature;
and
the security server intercepting the related form and signature subsequently sent by the client computer addressed to the application server before the related form is processed by the application server, the related form having data entered by the user and the signature, and in response, the security server determining if the signature sent by the client computer with the related form conforms to the field in the related form which was the basis for generating the signature, and if so, the security server forwarding to the application server the related form intercepted by the security server, and if not, the security server preventing the related form intercepted by the security server from being forwarded to the application server.

1 more element

A computer program product for validating a communication sent from a client computer to an application server, the computer program product comprising:

one or more computer-readable tangible storage devices and program instructions stored on at least one of the one or more storage devices, the program instructions comprising:
program instructions, for execution in a security server, to intercept an electronic form in HTML format sent by the client computer addressed to the application server before the form is processed by the application server, generate a signature based on session information contained in a field of the form which is not displayed in the form but is listed in an HTML document describing the form, and forward the signature along with the form to the application server;
program instructions, for execution in the application server, responsive to the communication, to process the form, and return to the client computer a related form and the signature, the related form having a field which was the basis for the signature;
and
program instructions, for execution in the security server, to intercept the related form and signature subsequently sent by the client computer addressed to the application server before the related form is processed by the application server, the related form having data entered by the user and the signature, and in response, determine if the signature sent by the client computer with the related form conforms to the field in the related form which was the basis for generating the signature, and if so, forward to the application server the related form intercepted by the security server, and if not, prevent the related form intercepted by the security server from being forwarded to the application server.

2 more elements

A computer program product for validating a communication sent from a client computer to an application server, the computer program product comprising:

one or more computer-readable tangible storage devices and program instructions stored on at least one of the one or more storage devices, the program instructions comprising:
program instructions, for execution in a security server, to intercept an electronic form in HTML format sent by the client computer addressed to the application server before the form is processed by the application server, generate a signature based on information with the form specifying a permitted maximum length of data in a field of the form, and forward the signature along with the form to the application server;
program instructions, for execution in the application server, responsive to the communication, to process the form, and return to the client computer a related form and the signature, the related form having a field which was the basis for the signature;
and
program instructions, for execution in the security server, to intercept the related form and signature subsequently sent by the client computer addressed to the application server before the related form is processed by the application server, the related form having data entered by the user and the signature, and in response, determine if the signature sent by the client computer with the related form conforms to the field in the related form which was the basis for generating the signature, and if so, forward to the application server the related form intercepted by the security server, and if not, prevent the related form intercepted by the security server from being forwarded to the application server.

2 more elements

Dependencies are inferred from the claim text.