Certifying server side web applications against security vulnerabilities
AssigneeInternational Business Machines Corporation
InventorsSalvatore A. Guarnieri, Marco Pistoia, Omer Tripp
Life of this patent
Estimating the term…
Abstract
Methods for server security verification include acquiring a public key associated with a received report that includes an indication regarding the presence of a vulnerability for each vulnerability, the report having been generated at a server; decrypting the received report using the public key; determining a level of server-side security based on the decrypted report using a processor; and reconfiguring a browser at the client responsive to the determined level of server-side security.
Claims23
A method for server security verification, comprising:
- acquiring a public key associated with a received report that includes an indication regarding the presence of a vulnerability, said report having been generated by a security scan by a server;
- decrypting the received report using the public key;
- determining a level of server-side security based on the decrypted report using a processor;
- scanning the server for vulnerabilities using a scanning module located at the client based on the decrypted report;
- and
- reconfiguring a browser at the client responsive to the determined level of server-side security.
A method for server security verification, comprising:
- acquiring a public key at a client associated with a received report that includes an indication regarding the presence of a vulnerability, said report having been generated by a security scan by a server;
- decrypting the received report using the public key;
- determining a level of server-side security based on the decrypted report using a processor;
- scanning the server for vulnerabilities using a scanning module located at the client, the scanning module being configured to enhance or diminish scanning of specific vulnerabilities based on the determined level of server-side security;
- and
- reconfiguring a browser at the client responsive to the determined level of server-side security.
A method for server security verification, comprising:
- scanning a server for one or more vulnerabilities using a scanning module located at the server;
- generating an encrypted report of server-side security by a security scan by the server that includes an indication regarding the presence of a vulnerability for each of said one or more vulnerabilities based on the results of said scanning, said encryption being performed using a private key;
- decrypting a copy of the encrypted report at a requesting client using a public key;
- determining a level of server-side security based on the decrypted report using a processor;
- and
- scanning the server for vulnerabilities using a scanning module located at the client based on the copy of the decrypted report.
A method for server security verification, comprising:
- scanning a server for one or more vulnerabilities using a scanning module located at the server;
- generating an encrypted report of server-side security that includes an indication regarding the presence of a vulnerability for each of said one or more vulnerabilities based on the results of said scanning, said encryption being performed using a private key;
- transmitting the encrypted report to a requesting client;
- decrypting the encrypted report using a public key;
- determining a level of server-side security based on the decrypted report using a processor;
- configuring a scanning module located at the client to increase or diminish scanning of specific vulnerabilities based on the determined level of server-side security;
- and
- scanning the server for vulnerabilities using a scanning module located at the client.
Dependencies are inferred from the claim text.