Method and system for extracting application protocol characteristics

A security gateway system interposed between an external computing environment and an internal computing environment, the system comprising:

• a protocol database storing a set of allowable actions which may be taken in an application program residing on the internal computing environment;
• a filter module for receiving an external message from the external computing environment, querying the protocol database, and refusing to pass to the internal environment any portion of the external message not contained in the protocol database;
• and
• a protocol extraction module for receiving an internal message from the internal computing environment, extracting application protocol data from the internal message, and storing the extracted application protocol data in the protocol database.

In a communication system in which a server is connectable to clients, a method for limiting clients to allowable actions for one or more application programs residing on the server, the method comprising:

• receiving messages transmitted by the server addressed to one or more clients;
• deriving from the server messages sets of allowable actions which may be taken in response to each of the server messages;
• receiving requests from a client addressed to the server, each request containing one or more actions requested by the client;
• comparing the one or more actions in each of the requests with at least one of the sets of allowable actions;
• and
• disallowing any action contained in a request which is not in the at least one set of allowable actions.

A computerized application protocol extraction module comprising an extraction program which, when executed, causes the protocol extraction module to perform a method for defining a set of allowable actions for an application program residing on a server, the method comprising:

• receiving a message transmitted by the server addressed to one or more clients;
• extracting application protocol data from the server message to thereby retrieve the set of allowable actions which may be taken in response to the server message;
• and
• storing the extracted application protocol data in a protocol database.

A computerized security module comprising an extraction program which, when executed, causes the security module to perform a method for limiting clients to allowable actions for one or more application programs residing on the server, the method comprising:

• receiving messages transmitted by the server addressed to one or more clients;
• deriving from the server messages sets of allowable actions which may be taken for the application program in response to the server messages;
• receiving requests from a client addressed to the server, each request containing one or more actions requested by the client;
• comparing the one or more actions in each of the requests with at least one of the sets of allowable actions;
• and
• disallowing any action contained in a request which is not in the at least one set of allowable actions.