US 6,308,275 B1 · Web host providing for secure execution of CGI programs and method of doing the same

Abstract

A web host includes a web server that provides web pages to a client. In response to a particular web page, the client sends a request to the web server to execute a CGI program stored on the web server. A redirector within the web server redirects the CGI execution request to a CGI proxy, which determines the execution mode in which the CGI program is executed. To make this determination, the CGI proxy first checks if the requested program requires authentication, and next if it belongs to a list of “special” CGI programs meant to be executed with different “safety” modes. Each CGI program in such a list corresponds to an execution mode with particular security privileges—e.g., being able to read or write to a file the user otherwise could not read or modify. If authentication is required but fails, the CGI proxy executes the requested program in a “safety” mode, according very limited privileges to the invoked program. If authentication is required and succeeds, the CGI proxy checks the requested program name against the list of “special” programs. If the program is in this list, the proxy executes it with a mode appropriate to the program; otherwise, it executes the program under the requesting user's identification. If authentication is not required at all, the CGI proxy checks the requested program name against the list of “special” programs, and then executes the program either with the appropriate mode or under the requesting user's identification.

Claims23

Dependent claims

A method of securely executing programs on a web host providing a plurality of web pages to a client and having a processor and a memory, the method comprising the steps of:

receiving from the client in response to a particular web page a request to execute a program in the memory of the web host identified by a path;
if the request from the client includes authentication information, authenticating an identity of the client;
determining an execution mode for the program from the path of the program, data stored in the memory specifying programs requiring a certain execution modes, and a result of the authentication;
and
executing the requested program with the processor in the determined execution mode.

2 more elements

A host for providing data to and receiving data from a client in communication with the host, the host comprising:

a program storage for holding a plurality of programs, each program identified by a path;
a server coupled to the program storage and in communication with the client, for receiving a request from the client containing a path identifying a program in the program storage to be executed;
a security module for controlling permissions available to the identified program when executed in response to the client request, comprising:
an authentication module for authenticating the client if the request from the client contains authentication information;
a customer program recognition module for determining, from the program path identified in the client request, whether the identified program is associated with a customer of the host;
and
a permissions module for setting the permissions available to the identified program in response to the determinations of the authentication and customer program recognition modules;
and
an execution module for executing the identified program with the permissions determined by the security module;
wherein the execution module executes the identified program with a customer user identification if the authentication module does not authenticate the client and the customer program recognition module determines that the requested program is a customer program.

7 more elements

A computer-readable memory having a computer program instructions encoded thereon for securely executing programs on a web host having a processor and a memory, the computer program instructions comprising:

instructions for receiving a program execution request from a client in communication with the web host, the program execution request identifying a path of a program stored in the memory;
instructions for redirecting the program execution request to a proxy executing on the processor and providing the proxy with the path of the program stored in the memory;
instructions for determining an execution mode for the program identified by the path from the path;
and
instructions for executing the program identified by the path on the processor with the determined execution mode.

2 more elements

Dependencies are inferred from the claim text.

Web host providing for secure execution of CGI programs and method of doing the same

Life of this patent

Web host providing for secure execution of CGI programs and method of doing the same

Life of this patent

Abstract

Claims23