Method and apparatus for security of a network server

• US 20020144157A1
• Filed: 02/27/2002
• Published: 10/03/2002
• Est. Priority Date: 03/29/2001
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Cheng, Qi, Zhao, Yanchun
• Application Number:
  US10/084,567
• Publication Number:
  US 20020144157A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method, apparatus and software is provided for protecting security of a network or Internet server from unauthorized content contained in a message received by the server from a user, which provide the capability of intercepting the message received before any content of the message is processed by the server; examining the message received to determine if it contains one or more unauthorized elements. If it is determined that the message contains an unauthorized element, steps are take to prevent the message from being processed by the server. If it is determined that the message does not contain an unauthorized element, the message is allowed to be processed by the server.

Claims

1. A method of protecting security of a network server from unauthorized content contained in a message received by said server from a user, comprising:

intercepting said message before any content of said message is processed by said server;

examining said message to determine if it contains one or more unauthorized elements;

if it is determined that said message contains an unauthorized element preventing said message received from being processed by said server;

if it is determined that said message does not contain an unauthorized element allowing said message received to be processed by said server.

2. The method of claim 1 wherein, if it is determined that said message received contains an unauthorized element, preventing said message received from being processed by said server, and causing an error notification to be sent to said user.

3. The method of claim 1 comprising:

receiving identification of an execution program set to be used to process said message received;

retrieving identification of all message types associated with said execution program set;

examining said message received by said server in relation to said message types associated with said execution program set;

determining if said message received by said server contains an unauthorized element in relation to the corresponding message type for said message received;

preventing a said message received containing an unauthorized element from being processed by said server.

4. The method of claim 3 wherein, if it is determined that said message received contains an unauthorized element, causing an error notification to be sent to said user.

10. The method of claims 1, 5, or 7 wherein said message comprises a name-value pair.

11. The method of claim 10 wherein said element comprises one or more of the following items:

an instruction, a command, a character, a parameter, a token, or a string of any of said previous items.

12. The method of claims 11 wherein said element is interpretable as an instruction or command by said server.

14. The apparatus of claim 14 wherein said network server comprises an Internet network server and said message is received over the Internet by said server from a user.

15. The apparatus of claim 13 or 14 further comprising means for returning an error message to said user.

16. The apparatus of claim 15, comprising:

means for receiving identification from said user of an execution page retrievable by said server to be used to process said message received;

means for retrieving identification of message types associated with said execution page from facilities associated with said server;

means for examining said message received by said server in relation to said message types associated with said execution page;

means for determining if said message received by said server contains an unauthorized element in relation to a corresponding message type for said message received;

means for preventing said message received containing an unauthorized element from being processed by said server.

17. The apparatus of claim 16 comprising means for allowing said message received to be processed by said server if it is determined that said message received does not contain an unauthorized element.

18. The apparatus of claim 17 wherein said message comprises a name-value pair and said element is contained by said name-value pair.

19. The apparatus of claim 18 wherein said element comprises one or more of the following items:

an instruction, a command, a character, a parameter, a token, or a string of any of said previous items.

20. The apparatus of claim 19 wherein said element is interpretable as an instruction or command by said server.

5. A method of protecting security of an Internet network server from unauthorized content contained in a message received over the Internet by said server from a user, comprising:

intercepting said message before any content of said message is processed by said server;

examining said message to determine if it contains one or more unauthorized elements;

if it is determined that said message contains an unauthorized element, preventing said message received from being processed by said server;

if it is determined that said message received does not contain an unauthorized element, allowing said message received to be processed by said server.

6. The method of claim 5 wherein, if it is determined that said message received contains an unauthorized element preventing said message received from being processed by said server, causing an error notification to be sent to said user.

7. The method of claim 5 comprising:

receiving identification of an execution page to be used to process said message received;

retrieving identification of all message types associated with said execution page;

examining said message received by said server in relation to said message types associated with said execution page;

determining if said message received by said server contains an unauthorized element in relation to a corresponding message type for said message received;

preventing said message received containing an unauthorized element from being processed by said server.

8. The method of claim 7 wherein, if it is determined that said message received contains an unauthorized element, causing an error notification to be sent to said user.

9. The method of claim 8 wherein, if it is determined that said message received does not contain an unauthorized element, allowing said message received to be processed by said server.

13. Security control apparatus for controlling the security of a network server from unauthorized content contained in a message received from a user of said server comprising:

means for intercepting said message received before any content of said message is processed by said server;

means for examining said message received to determine if it contains one or more unauthorized elements;

means for preventing said message received from being processed by said server if it is determined that said message received contains an unauthorized element;

means for allowing said message received to be processed by said server if it is determined that said message received does not contain an unauthorized element.