Secure server utilizing separate protocol stacks

• US 6,332,195 B1
• Filed: 02/22/1999
• Issued: 12/18/2001
• Est. Priority Date: 02/09/1996
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Green, Michael W., Jensen, Andrew W.
• Primary Examiner(s): WRIGHT, NORMAN M
• Application Number:
  US09/255,111
• Time in Patent Office: 1,030 Days
• Field of Search: 713/200, 713/201, 709/201
• US Class Current: 726/14
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A secure commerce server system and method. A secure commerce server system includes a plurality of regions or burbs, including an internal burb and an external burb, a commerce server and an administration server. Processes and data objects associated with the administration server are bound to the internal burb. Processes and data objects associated with the commerce server are bound to the external burb. Processes bound to one burb cannot communicate directly to processes and data objects bound to other burbs. The administration server cannot be manipulated by a process bound to the external burb.

Claims

1. A secure commerce server system, comprising:

a plurality of regions or burbs, including an internal burb and an external burb, wherein processes bound to one burb cannot communicate directly to processes and data objects bound to other burbs, and wherein the internal burb includes a first protocol stack and the external burb includes a second protocol stack separate from the first protocol stack;

a commerce server, wherein processes and data objects associated with the commerce server are bound to the external burb;

an administration server, wherein processes and data objects associated with the administration server are bound to the internal burb; and

an assured pipeline connected between the external and internal burbs, wherein the assured pipeline controls transfer of information between the internal and external burbs such that a message from the commerce server to the administration server is routed up one or more layers of the second protocol stack and through the assured pipeline to the first protocol stack before being routed to the administration server.

2. The commerce server system according to claim 1 wherein the administration server includes means for reading and writing a configuration file used to configure the commerce server.

3. The commerce server system according to claim 1 wherein the administration server includes means for starting and stopping the commerce server.

4. The commerce server system according to claim 1 wherein the commerce server system further includes a CGI processor for executing CGI scripts, wherein the plurality of burbs further includes a cgix burb and wherein the CGI processor is bound to the cgix burb and all CGI scripts are restricted to operating within said cgix burb.

5. The commerce server system according to claim 1 wherein the assured pipeline includes means for enforcing a type enforcement mechanism to restrict communication between processes bound to different burbs.

6. The commerce server system according to claim 1 wherein the assured pipeline includes a proxy operating between burbs, wherein messages between burbs must pass through the proxy.

7. The commerce server system according to claim 6 wherein the assured pipeline further includes means for enforcing a type enforcement mechanism to restrict communication between processes bound to different burbs.

8. A method of conducting electronic commerce over a plurality of networks, including an external network and an internal network, wherein the internal network includes an administration server, the method comprising:

connecting a network interface to each of the plurality of networks, wherein the step of connecting includes the steps of connecting an external network interface to the external network and an internal network interface to the internal network;

defining a plurality of burbs, wherein the plurality of burbs includes a first and a second burb, wherein the first burb includes a first protocol stack and the second burb includes a second protocol stack separate from the first protocol stack;

assigning the external network interface to the first burb;

assigning the internal network interface to the second burb;

binding processes to burbs;

establishing an assured pipeline between the first and second protocol stacks;

receiving an electronic commerce request from the external network;

routing the electronic commerce request up one or more layers of the first protocol stack and through the assured pipeline to the second protocol stack; and

routing the electronic commerce request through the second protocol stack to the administration server.

9. The method according to claim 8, wherein binding includes preventing a process from accessing burbs other than the burb to which the process is bound and limiting transfer of incoming packets such that incoming packets can only go to processes bound to the burb associated with the network interface the packet arrived on;

and

wherein establishing an assured pipeline includes defining a proxy and ensuring that data passing between processes bound to the first and second burbs must pass through the proxy before moving between the first and second burbs.

10. The method according to claim 8, wherein each burb has its own routing table and wherein routing the electronic commerce request up one or more layers of the first protocol stack and through the assured pipeline to the second protocol stack includes examining an incoming packet to determine if its destination is an address in the first burb'"'"'s routing table.

11. The method according to claim 8, wherein the step of binding processes to burbs includes the steps of:

defining a plurality of types;

assigning each data object to one of the plurality of types, wherein the step of assigning data objects includes defining type enforcement rules for accesses by processes to said data objects; and

applying a type enforcement check of accesses by processes to data objects.