NTO input validation technique

• US 20070016960A1
• Filed: 07/17/2006
• Published: 01/18/2007
• Est. Priority Date: 07/18/2005
• Status: Abandoned Application

• Current Assignee: NT Objectives Incorporated (Rapid7, Inc.)
• Original Assignee: NT Objectives Incorporated (Rapid7, Inc.)
• Inventors: Shema, Mike, Glaser, Jd
• Application Number:
  US11/488,537
• Publication Number:
  US 20070016960A1
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

This invention relates to an apparatus and method for an input validation and security server for validating and scanning data information between a client and a server application. Input validation mistakes are the heart of major web application security problems. In web applications the inputs are the GPC, which stands for GET, POST, and COOKIES. In this document, we will use PHP for the examples but the concept stands for all web application languages.

Claims

1. A validation and security server for validating and scanning data information between a client and a server application, comprising

a user interface with a plurality of data input modules which comprise data input fields for inputting data relating to the object of web transaction, which user interface is operable for internet users by means of terminals electrically communicated with a network;

stored data rules assigned to the data input fields and validation means for verifying data values input via the data input fields on the basis of the assigned data rules, for requesting corrections via the user interface on the basis of the assigned data rules and for generating a validation result, characterized by stored commercial rules assigned to one or more of the data input fields;

evaluation means for evaluating the data value input via the data input fields on the basis of the assigned commercial rules and for generating a corresponding evaluation result, a plurality of different determination processes for indicating a desired data via the user interface; and

control means for activating a first one of the data input modules, for activating the evaluation means in the case of a positive validation result, and for automatically selecting and activating further one of the data input modules in dependence on the evaluation result.

2. The validation and security server as recited in claim 1, wherein said data input fields comprise of an array of $_GET values, an array of $_POST values, an array of $_COOKIE values, and an array of $_REQUEST values.

3. The validation and security server as recited in claim 2, wherein said $_GET values are fetched from (URL) Uniform Resource Locator.

4. The validation and security server as recited in claim 2, wherein said $_GET values are fetched from HTML forms with their METHOD set to GET.

5. The validation server and security as recited in claim 2, wherein said $_COOKIE values are fetched from COOKIE values which are electrically communicated from cookie enabled internet browsers.

6. The validation and security server as recited in claim 2, wherein said $_REQUEST values are fetched from the merged values comprising $_GET, $_POST, and $_COOKIE.

7. The validation and security server as recited in claim 2, wherein said data input modules are configured to fetch the original data values from $_GET, $_POST, $_COOKIE, and $_REQUEST and transfer said original data values in first predetermined memory location to a second set of matching secondary data values in second predetermined memory location disposed in a separate storage means, and erasing said original data values from first memory location after successful transfer to said second memory location.

8. The validation and security server as recited in claim 1, characterized in that the commercial rules in each case comprise rule logic and one or more rule parameters, that the validation server comprises a rules database, and that the rule parameters are stored in the rules database.

9. The validation and security server as recited in claim 8, characterized in that the rule logic is stored executable program code in the rules database.

10. The validation and security server as recited in claim 1, characterized in that the data rules and commercial rules are in each case assigned to one of a number of sets of rules, that the control means are adapted to select a set of rules to be applied from the set of rules in dependence on at least one data value input into a particular data input field, and that the validation means and the evaluation means are adapted to check and to evaluate, respectively, the data values input on the basis of the data rules and commercial rules, respectively, of the set of rules to be applied.

11. The validation and security server as recited in claim 10, characterized in that geographic data, user identification data and/or product identification data are in each case assigned to the sets of rules, and that the control means are adapted to select the set of rules to be applied in dependence on a geographic data value input or a data value for user identification input, respectively, and/or a data value for product identification input.

12. The validation and security server as recited in claim 1, characterized in that at least one of the determination processes is adapted to automatically replace the data from a stored database on the basis of data values input.

13. The validation and security server as recited in claim 1, characterized in that the control means are adapted to store the data values input, the validation result generated and the evaluation result generated assigned to one another.

14. The validation and security server as recited in claim 7, wherein said user interface comprises an input validation function for setting the input parameter name, the specific type of data, input location such as GET/POST/COOKIE, and custom data type callback function therein.

15. The validation and security server as recited in claim 14, wherein said evaluation means comprise of said input validation function which compares the data value input with said stored data rules and evaluates whether it matches the specified data rules to at least one threshold.

16. The validation and security server as recited in claim 15, wherein said threshold indicates a level at which problem is present and associating the data about data input values with classifications.

17. The validation and security server as recited in claim 16, wherein if the input validation function evaluates a positive match between said data value input and said stored data rules, said secondary data values will be transferred back to first predetermined memory location, and erasing said secondary data values after successful transfer to said first memory location.

18. The validation server and security as recited in claim 16, wherein if the input validation function evaluates a negative match between said data value input and said stored data rules, said secondary data values will remain in second predetermined memory location, and the user will be prompted to reenter data value via said user interface.

19. The validation and security server as recited in claim 15, wherein said input locations are absent from said data input values, said evaluation means will fetch substantially similar input location value from said stored data rules.

20. The validation and security server as recited in claim 14, wherein said custom data type callback function comprises a user-defined routine for validating data whereby the value for the input parameter and return value are communicated with said input validation function.

21. The validation and security server as recited in claim 13, wherein said control means comprise a first configuration option which scans undefined inputs and analyze the plurality of results to determine if a problem is present in the undefined data values by comparing said stored data about data input values resulting from the scan of said undefined inputs to identify basic attack signatures and post actions in a log so that additional input validation inputs can be added to the corresponding actions.

22. The validation and security server as recited in claim 1, wherein said input validation functions are assembled in a singular Data Type Header group.

23. The validation and security server as recited in claim 22, further comprises a proxy software/appliance as a proxy server whereby said proxy software/appliance will analyze a user'"'"'s web program for the automatic generation of said Data Type Header functions and report for the recommended Data Type Header functions for each page of the web program.

24. The validation and security server as recited in claim 23, further comprises a fuzzy logic module in communication with said stored data rules for analyzing the pattern of inputs being submitted and produce logically relevant data types in said report.

25. The validation and security server as recited in claim 1, wherein additional HTTP header tags providing security information are placed on each web page of a particular server whereby a security scanner can detect said HTTP header tag and possesses the ability to indicate in a report which web pages on a server are being protected by the routines and which are not.

26. The validation and security server as recited in claim 1, wherein user interface, stored data rules, evaluation means, and control means are performed by a single computer.

27. The validation and security server as recited in claim 1, wherein user interface is performed by a first computer while stored data rules, evaluation means, and control means are performed by a second computer.

28. The validation and security server as recited in claim 1, wherein user interface is performed by a first computer, stored data rules is performed by a second computer, and evaluation means and control means are performed by a third computer.

29. The validation and security server as recited in claim 1, wherein the communication data is communication over a network selected from a group consisting of a wide area network, local area network, wireless network, and global communication network.

30. The validation and security server as recited in claim 1, wherein the communication data comprises an application protocol selected from the group consisting of Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hyper-text transfer protocols, web-mail protocols, hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, and file transfer protocols.

31. The validation and security server as recited in claim 1, wherein the server application is implemented by a web server.

32. The validation and security server as recited in claim 1, wherein the communication data comprises only transmission control protocol packets.

33. The validation and security server as recited in claim 1, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

34. The validation and security network test embodied in at least one carrier wave comprising:

a plurality of first signal segments constituting scan modules for scanning executable programs on web server to learn vulnerabilities that the programs has to basic attack signatures; and

a second signal segment defining instructions for one of the scan modules to perform a scan of executable programs on web server and to produce an output based on the scan, and for producing an input for implementation by user interface based on the output.

35. The validation and security network test embodied in at least one carrier wave comprising:

a plurality of first signal segments constituting scan modules for scanning executable programs on web server to learn vulnerabilities that the programs has to basic attack signatures;

a second signal segment defining instructions for one of the scan modules to perform a scan of executable programs on web server and to produce an output based on the scan, and for producing an input for implementation by evaluation means based on the output; and

a third signal segment constituting instructions for formatting the output in the form of a data record having a plurality of data fields, and for formatting the input for implementation by evaluation means in the form of a second data record having a plurality of second data fields.

36. A method for validating and scanning data information between a client and a server application, the method comprising:

providing a user interface with a plurality of data input modules which comprise data input fields for inputting data relating to the object of web transaction, which user interface is operable for internet users by means of terminals electrically communicated with a network;

providing stored data rules assigned to the data input fields and validation means for verifying data values input via the data input fields on the basis of the assigned data rules, for requesting corrections via the user interface on the basis of the assigned data rules and for generating a validation result, characterized by stored commercial rules assigned to one or more of the data input fields;

providing evaluation means for evaluating the data value input via the data input fields on the basis of the assigned commercial rules and for generating a corresponding evaluation result, a plurality of different determination processes for indicating a desired data via the user interface; and

providing control means for activating a first one of the data input modules, for activating the evaluation means in the case of a positive validation result, and for automatically selecting and activating further one of the data input modules in dependence on the evaluation result.

37. The method of claim 36, wherein said data input fields comprise of an array of $_GET values, an array of $_POST values, an array of $_COOKIE values, and an array of $_REQUEST values.

38. The method of claim 37, wherein said $_GET values are fetched from (URL) Uniform Resource Locator.

39. The method of claim 37, wherein said $_GET values are fetched from HTML forms with their METHOD set to GET.

40. The method of claim 37, wherein said $_COOKIE values are fetched from COOKIE valuers which are electrically communicated from cookie enabled internet browsers.

41. The method of claim 37, wherein said $_REQUEST values are fetched from the merged values comprising $_GET, $_POST, and $_COOKIE.

42. The method of claim 37, wherein said data input modules are configured to fetch the original data values from $_GET, $_POST, $_COOKIE, and $_REQUEST and transfer said original data values in first predetermined memory location to a second set of matching secondary data values in second predetermined memory location disposed in a separate storage means, and erasing said original data values from first memory location after successful transfer to said second memory location.

43. The method of claim 42, wherein said user interface comprises an input validation function for setting the input parameter name, the specific type of data, input location such as GET/POST/COOKIE, and custom data type callback function therein;

wherein said custom data type callback function comprises a user-defined routine for validating data whereby the value for the input parameter and return value are communicated with said input validation function.

44. The method of claim 43, wherein said evaluation means comprise of said input validation function which compares the data value input with said stored data rules and evaluates whether it matches the specified data rules to at least one threshold.

45. The method of claim 44, wherein said input locations are absent from said data input values, said evaluation means will fetch substantially similar input location value from said stored data rules.

46. The method of claim 44, wherein said threshold indicates a level at which problem is present and associating the data about data input values with classifications.

47. The method of claim 46, wherein if the input validation function evaluates a positive match between said data value input and said stored data rules, said secondary data values will be transferred back to first predetermined memory location, and erasing said secondary data values after successful transfer to said first memory location.

48. The method of claim 46, wherein if the input validation function evaluates a negative match between said data value input and said stored data rules, said secondary data values will remain in second predetermined memory location, and the user will be prompted to reenter data value via said user interfaces.

49. The method of claim 36, characterized in that the commercial rules in each case comprise rule logic and one or more rule parameters, that the validation server comprises a rules database, and that the rule parameters are stored in the rules database;

and said rule logic is stored executable program code in the rules database.

50. The method of claim 36, characterized in that the data rules and commercial rules are in each case assigned to one of a number of sets of rules, that the control means are adapted to select a set of rules to be applied from the set of rules in dependence on at least one data value input into a particular data input field, and that the validation means and the evaluation means are adapted to check and to evaluate, respectively, the data values input on the basis of the data rules and commercial rules, respectively, of the set of rules to be applied.

52. The method of claim 36, characterized in that at least one of the determination processes is adapted to automatically replace the data from a stored database on the basis of data values input.

53. The method of claim 36, characterized in that the control means are adapted to store the data values input, the validation result generated and the evaluation result generated assigned to one another;

and wherein said control means comprise a first configuration option which scans undefined inputs and analyze the plurality of results to determine if a problem is present in the undefined data values by comparing said stored data about data input values resulting from the scan of said undefined inputs to identify basic attack signatures and post actions in a log so that additional input validation inputs can be added to the corresponding actions.

54. The method of claim 36, wherein said input validation functions are assembled in a singular Data Type Header group.

55. The method of claim 54, further comprises a proxy software/appliance as a proxy server whereby said proxy software/appliance will analyze a user'"'"'s web program for the automatic generation of said Data Type Header functions and report for the recommended Data Type Header functions for each page of the web program.

56. The method of claim 55, further comprises a fuzzy logic module in communication with said stored data rules for analyzing the pattern of inputs being submitted and produce logically relevant data types in said report.

57. The method of claim 36, wherein additional HTTP header tags providing security information are placed on each web page of a particular server whereby a security scanner can detect said HTTP header tag and possesses the ability to indicate in a report which web pages on a server are being protected by the routines and which are not.

51. The method of claim 51, characterized in that geographic data, user identification data and/or product identification data are in each case assigned to the sets of rules, and that the control means are adapted to select the set of rules to be applied independence on a geographic data value input or a data value for user identification input, respectively, and/or a data value for product identification input.