METHOD AND SYSTEM FOR CONTROLLING A COMPUTER APPLICATION PROGRAM

• US 20090187666A1
• Filed: 01/17/2008
• Published: 07/23/2009
• Est. Priority Date: 01/17/2008
• Status: Active Grant

• Current Assignee: Koninklijke KPN NV
• Original Assignee: DLB Finance & Consultancy BV, HITD Information Technology BV
• Inventors: Benschop, Henderik Reinout, Benschop, Dirk Leonard
• Granted Patent: US 8,463,921 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

Aspects of the invention relate to a computer-implemented method of controlling a computer application program in a computer system configured for electronically communication with a client. The computer system is configured to have access to a first request set of one or more allowable requests corresponding to a first application state of the computer application program. The computer application program may run on the computer system or on one or more other computer systems. A client request is received at the computer system for the computer application program. The computer application program is in the first application state in relation to said client (using e.g. the client connection). The client request is analysed to determine if the client request matches one of the allowable requests corresponding to the first application state of the computer application program. The computer application program is controlled by instructing this program to execute the client request only if the client request matches an allowable request of the first request set.

Claims

1. A computer-implemented method of controlling a computer application program in a computer system configured for electronic communication with a client and having access to a first request set of one or more allowable requests corresponding to a first application state of said computer application program running on said computer system or another computer system in relation to said client, the method comprising:

receiving, at said computer system, a client request from said client for said computer application program in said first predetermined application state;

analysing if said client request matches one of said allowable requests in response to receiving said client request;

instructing said computer application program to execute said client request only if said client request matches one of said allowable requests of said first request set.

2. The method according to claim 1, further comprising:

changing said first application state to a second application state of said computer application program, said second application state being different from said first application state;

receiving a further client request from said client device;

analysing if said further client request matches an allowable request of a second request set of one or more allowable requests corresponding to said second application state;

instructing said computer application program to execute said further client request only if said further client request matches one of said allowable requests of said second request set.

3. The method according to claim 2, wherein said first application state is changed to said second application state in response to executing said client request.

4. The method according to claim 1, wherein at least one of said first request set or said first application state is obtained from said computer application program running on said computer system or said other computer system.

5. The method according to claim 1, wherein said allow-able requests of said first request set relate to application layer requests.

6. The method according to claim 5, wherein said application layer requests comprise at least one of hypertext transfer protocol (HTTP) requests, file transfer protocol (FTP) requests, simple mail transfer protocol (SMTP) requests and telnet requests.

7. The method according to claim 1, further comprising:

determining, by said computer system, a connection state between said client and said computer system;

relating said first application state and a second application state to said connection state.

8. The method according to claim 1, wherein said computer system maintains a threshold amount of client requests per time unit, the method comprising instructing said computer application program to execute said client requests only if the amount of client requests is below said threshold amount.

9. The method according to claim 1, further comprising:

distinguishing between malicious and non-malicious clients;

ranking client requests from said malicious and said non-malicious clients to obtain a queue of non-malicious client requests followed by said malicious client requests;

instructing said computer application program to first execute said non-malicious client requests.

10. The method according to claim 9, further comprising analysing said malicious client requests from said queue after having instructed said computer application program to execute all non-malicious client requests.

11. The method according to claim 9, wherein said computer system stores a contact history from clients, further comprising ranking clients known from said contact history higher in said queue than clients not known from said contact history.

12. The method according to claim 9, further comprising distinguishing said malicious and non-malicious clients on the basis of at least one of the following:

number of client requests received from clients, contact history of clients with said computer system, type of content of requests, content of requests received from said clients.

13. The method according to claim 1, wherein said client is implemented in a client device and said computer system is connected to at least one communication network to electronically communicate with said client device, the method comprising receiving said client request over said communication network.

14. The method according to claim 1, wherein said computer system or said other computer system comprises a database and said computer application program is a database application program.

15. The method according to claim 14, further comprising:

receiving said first set of allowable database requests from said database application program;

instructing a database operation of said database application program of said database only if said client request matches one of said allowable database requests.

16. A computer program comprising software code portions adapted for, when installed on and executed by an electronic system, performing the method according to claim 1.

17. A computer readable media containing the computer program of claim 16.

18. A computer system for controlling a computer application program on said computer system or another computer system, said computer system being configured for connecting to at least one client comprising:

a client request receiver configured for receiving a client request directed to said computer application program, said computer application program comprising at least a first application state;

an analyzer module configured for analyzing if said client request matches an allowable request of a first request set comprising one or more allowable requests corresponding to said first application state of said computer application program in relation to said client;

an instruction module configured for instructing said computer application program to execute said client request only if said client request matches one of said allowable requests of said first request set.

19. The computer system according to claim 18, wherein:

said client request receiver is configured for receiving a further client request from said client;

said analyzer module is configured for analyzing if said further client request matches an allowable request of a second request set comprising one or more allowable requests corresponding to a second application state of said computer application program, said second application state being different from said first application state;

said instruction module is further configured for instructing said computer application program to execute said further client request only if said further client request matches one of said allowable requests of said second request set.

20. The computer system according to claim 19, wherein said computer system further comprises:

an application state detector configured for detecting said first application state and said second application state;

a request set retriever configured for retrieving said first request set and said second request, respectively, in response to detecting said first application state or said second application state.

21. The computer system according to claim 19, wherein said computer system further comprises a request set receiver configured for receiving said first request set and said second request set.

22. The computer system according to claim 18, wherein said client request receiver is configured for receiving application layer requests, such as hypertext transfer protocol (HTTP) requests, file transfer protocol (FTP) requests, simple mail transfer protocol (SMTP) requests and telnet requests.

23. The computer system according to claim 18, wherein said computer system further comprises a connection state monitor configured for determining a connection state between said client and said computer system, said computer system being configured such that said first application state and a second application state of said computer application program are related to said connection state.

24. The computer system according to claim 18, wherein said computer system is configured for maintaining a threshold amount of client requests per time unit and wherein said instruction module is configured for instructing said computer application program to execute said client request only if the amount of client requests is below said threshold amount.

25. The computer system according to claim 18, wherein said computer system further comprises:

a distinguishing module configured for distinguishing between malicious and non-malicious clients;

a ranking module configured for ranking client requests from said malicious and said non-malicious clients to obtain a queue of non-malicious client requests followed by said malicious client requests;

wherein said instruction module is configured for instructing said computer application program to first execute said non-malicious client requests.

26. The computer system according to claim 25, further comprising a second analyzer module configured for analysing said malicious client requests from said queue after said installation module having instructed all non-malicious client requests.

27. The computer system according to claim 25, further comprising a storage module for storing a contact history from clients and a ranking module configured for ranking clients known from said contact history higher in said queue than clients not known from said contact history.

28. The computer system according to claim 25, wherein said distinguishing module is configured for distinguishing said malicious and non-malicious clients on the basis of at least one of the following:

number of client requests received from clients, contact history of clients with said computer system, type of content of requests, content of requests received from said clients.

29. The computer system according to claim 18, wherein said computer system is configured for receiving said client requests over communication network.

30. The computer system according to claim 18, wherein said computer application program is a database application program, preferably installed on said other computer system.

31. The computer system according to claim 30, wherein said computer system comprises:

a receiver configured for receiving said first set of allowable database requests from said database application program of said other computer system; and

said instruction module is configured for instructing said database application program to execute a database operation only if said client request matches one of said allowable database requests.