System for verifying a client request

• US 7,703,127 B2
• Filed: 10/17/2007
• Issued: 04/20/2010
• Est. Priority Date: 10/25/1999
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Zoran, Gil, Moran, Tal, El-Hanani, Yuval, Reshef, Eran
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Powers; William S
• Application Number:
  US11/873,869
• Publication Number:
  US 20080066173A1
• Time in Patent Office: 916 Days
• Field of Search: 726/3, 713/153, 713/168
• US Class Current: 726/3
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A system and method are presented for authorizing execution of requested actions transmitted between clients and servers of a data processing system. The method includes receiving a message including a set of actions and simulating execution of the set of actions. A list representing allowable actions and user-definable inputs to the simulated actions is defined. The list of allowable actions and user-definable inputs to the allowable action is then compared to user-requested actions and inputs. When elements within the user-requested actions and inputs are included in the allowable actions and input list, the user-requested actions and inputs are authorized for execution.

Claims

1. A security gateway coupled between clients and servers of a data processing system, comprising:

an evaluator for evaluating transmissions between said clients and servers and for identifying informational content and application programming logic included within each transmission;

a simulator for simulating a processing environment for executing said application programming logic of said transmissions, said simulator including an enumeration engine for triggering events and identifying user-definable inputs to said application programming logic, said simulator providing a list of allowable actions and user-definable input values to said actions; and

a filter for receiving transmissions including user-requested actions and input, comparing said user-requested actions and input to said list of allowable actions and user-definable input values, and passing through said security gateway transmissions having user-requested actions and inputs within said list of allowable actions and input values.

2. The security gateway as set forth in claim 1, comprising a data store, accessible by said simulator and said filter, for storing said list of allowable actions and input values.

3. The security gateway as set forth in claim 1, wherein said simulator comprises a detector for detecting an input control requesting entry of a data value and for assigning a unique place holder to represent said data value, and wherein said filter comprises means for matching a pattern of said unique place holder to said input received from said user.

4. The security gateway as set forth in claim 1, wherein said simulator comprises:

a detector for detecting an input control requesting selection of one of a plurality of predefined data values; and

means for iteratively selecting one of said plurality of predefined data values, continuing simulation of said application programming logic, and building of said list of allowable actions and user-definable inputs with said selected one data value until each of said plurality of predefined data values is selected and listed.

5. The security gateway as set forth in claim 1, wherein said evaluator comprises means for identifying actions of interest within said application programming logic and for tracing inputs to said actions received at a client, and wherein said simulator comprises means for receiving results of said tracing and providing said results as user-selectable inputs to said identified actions are performed within said simulation.

6. The security gateway as set forth in claim 1, wherein the security gateway is a hardware component that is separate and distinct from the servers.

7. The security gateway as set forth in claim 1, wherein the security gateway includes application programming logic executing on at least one of the servers.

8. The security gateway as set forth in claim 1, wherein the security gateway is configured to operate within a sniffer device coupled to a router or a hub, wherein said router or said hub directs communications between at least one of the servers and at least one of the clients.

9. A security gateway coupled between clients and servers of a data processing system, comprising:

a simulator for simulating a processing environment for executing application programming logic included within transmissions between said clients and servers, said simulator including an enumeration engine for triggering events and identifying user-definable inputs to said application programming logic, said simulator providing a list of allowable actions and user-definable input values to said actions; and

a filter for receiving transmissions including user-requested actions and input, comparing said user-requested actions and input to said list of allowable actions and user-definable input values, and passing through said security gateway transmissions having user-requested actions and inputs within said list of allowable actions and input values.