Method and system for controlling a computer application program

• US 8,463,921 B2
• Filed: 01/17/2008
• Issued: 06/11/2013
• Est. Priority Date: 01/17/2008
• Status: Active Grant

• Current Assignee: Koninklijke KPN NV
• Original Assignee: Scipioo Holding B.V.
• Inventors: Benschop, Dirk Leonard, Benschop, Henderik Reinout
• Primary Examiner(s): WANG, LIANG CHE A
• Application Number:
  US12/015,862
• Publication Number:
  US 20090187666A1
• Time in Patent Office: 1,972 Days
• Field of Search: 709/217, 709/218, 709/219, 709/225, 709/226, 709/229, 709/232
• US Class Current: 709/229
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

Aspects of the invention relate to a computer-implemented method of controlling a computer application program in a computer system configured for electronically communication with a client. The computer system is configured to have access to a first request set of one or more allowable requests corresponding to a first application state of the computer application program. The computer application program may run on the computer system or on one or more other computer systems. A client request is received at the computer system for the computer application program. The computer application program is in the first application state in relation to said client (using e.g. the client connection). The client request is analysed to determine if the client request matches one of the allowable requests corresponding to the first application state of the computer application program. The computer application program is controlled by instructing this program to execute the client request only if the client request matches an allowable request of the first request set.

Claims

1. A computer-implemented method of controlling a computer application program in a computer system configured for electronic communication with a client and having access to a first request set of one or more allowable requests and a second request set of one or more allowable requests, said computer application program running on said computer system or another computer system in relation to said client, the method comprising:

receiving, at said computer system, a client request from said client for said computer application program in a first application state, wherein the first application state comprises a first page of the computer application program;

analyzing with said computer system whether said client request matches an allowable request of said first request set in response to receiving said client request, wherein the first request set corresponds to said first application state of said computer application program;

instructing said computer application program to execute said client request only when said client request matches one of said allowable requests of said first request set;

changing said first application state to a second application state of said computer application program in response to executing said client request when said client request matches said one of said allowable requests of said first request set, said second application state being different from said first application state, and wherein the second application state comprises a second page of the computer application program;

receiving a further client request from said client device;

analyzing whether said further client request matches an allowable request of said second request set, wherein the second request set corresponds to said second application state of said computer application program; and

instructing said computer application program to execute said further client request only when said further client request matches one of said allowable requests of said second request set.

2. The method according to claim 1, wherein at least one of said first request set or said first application state is obtained from said computer application program running on said computer system or said other computer system.

3. The method according to claim 1, wherein said allowable requests of said first request set relate to application layer requests.

4. The method according to claim 3, wherein said application layer requests comprise at least one of hypertext transfer protocol (HTTP) requests, file transfer protocol (FTP) requests, simple mail transfer protocol (SMTP) requests and telnet requests.

5. The method according to claim 1, further comprising:

determining, by said computer system, a connection state between said client and said computer system;

relating said first application state and a second application state to said connection state.

6. The method according to claim 1, wherein said computer system maintains a threshold amount of client requests per time unit, the method comprising instructing said computer application program to execute said client requests only if the amount of client requests is below said threshold amount.

7. The method according to claim 1, further comprising:

distinguishing between malicious and non-malicious clients;

ranking client requests from said malicious and said non-malicious clients to obtain a queue of non-malicious client requests followed by said malicious client requests;

instructing said computer application program to first execute said non-malicious client requests.

8. The method according to claim 7, further comprising analyzing said malicious client requests from said queue after having instructed said computer application program to execute all non-malicious client requests.

9. The method according to claim 7, wherein said computer system stores a contact history from clients, further comprising ranking clients known from said contact history higher in said queue than clients not known from said contact history.

10. The method according to claim 7, further comprising distinguishing said malicious and non-malicious clients on the basis of at least one of the following:

number of client requests received from clients, contact history of clients with said computer system, type of content of requests, content of requests received from said clients.

11. The method according to claim 1, wherein said client is implemented in a client device and said computer system is connected to at least one communication network to electronically communicate with said client device, the method comprising receiving said client request over said communication network.

12. The method according to claim 1, wherein said computer system or said other computer system comprises a database and said computer application program is a database application program.

13. The method according to claim 12, further comprising:

receiving said first set of allowable database requests from said database application program;

instructing a database operation of said database application program of said database only if said client request matches one of said allowable database requests.

14. A non-transitory computer readable storage media containing a computer program comprising software code portions adapted for, when installed on and executed by an electronic system, performing a method of controlling a computer application program in a computer system configured for electronic communication with a client and having access to a first request set of one or more allowable requests and a second request set of one or more allowable requests, said computer application program running on said computer system or another computer system in relation to said client, the method comprising:

receiving, at said computer system, a client request from said client for said computer application program in a first application state, wherein the first application state comprises a first page of the computer application program;

analyzing whether said client request matches an allowable request of said first request set in response to receiving said client request, wherein the first request set corresponds to said first application state of said computer application program;

instructing said computer application program to execute said client request only when said client request matches one of said allowable requests of said first request set;

changing said first application state to a second application state of said computer application program in response to executing said client request when said client request matches said one of said allowable requests of said first request set, said second application state being different from said first application state, and wherein the second application state comprises a second page of the computer application program;

receiving a further client request from said client device;

analyzing whether said further client request matches an allowable request of said second request set, wherein the second request set corresponds to said second application state of said computer application program; and

instructing said computer application program to execute said further client request only when said further client request matches one of said allowable requests of said second request set.

28. The non-transitory computer readable storage media of claim 14, wherein at least one of said first request set or said first application state is obtained from said computer application program running on said computer system or said other computer system.

29. The non-transitory computer readable storage media of claim 14, the method further comprising:

distinguishing between malicious and non-malicious clients;

ranking client requests from said malicious and said non-malicious clients to obtain a queue of non-malicious client requests followed by said malicious client requests;

instructing said computer application program to first execute said non-malicious client requests.

30. The non-transitory computer readable storage media of claim 14, wherein said computer system maintains a threshold amount of client requests per time unit, the method comprising instructing said computer application program to execute said client requests only if the amount of client requests is below said threshold amount.

31. The non-transitory computer readable storage media of claim 14, wherein said client is implemented in a client device and said computer system is connected to at least one communication network to electronically communicate with said client device, the method comprising receiving said client request over said communication network.

15. A computer system for controlling a computer application program on said computer system or another computer system, said computer system being configured for connecting to at least one client and comprising:

a processing unit having a processor and memory operably coupled to the processor, the processing unit comprising;

a client request receiver configured for receiving a client request and a further client request directed to said computer application program, said computer application program comprising at least a first application state and a second application state, wherein the first and second application state are different application states obtainable by executing said client request and said further client request, respectively;

an analyzer module configured for analyzing whether said client request matches an allowable request of a first request set comprising one or more allowable requests corresponding to said first application state of said computer application program in relation to said client and whether said further client request matches an allowable request of said second request set of one or more allowable requests corresponding to said second application state of said computer program in relation to said client; and

an instruction module configured for instructing said computer application program to execute said client request only when said client request matches one of said allowable requests of said first request set to obtain said second application state and for instructing said computer application program to execute said further client request only when said further client request matches one of said allowable requests of said second request set,

wherein the first application state comprises a first page of the computer application program and the second application state comprises a second page of the computer application program.

16. The computer system according to claim 15, wherein said processing unit further comprises:

an application state detector configured for detecting said first application state and said second application state;

a request set retriever configured for retrieving said first request set and said second request, respectively, in response to detecting said first application state or said second application state.

17. The computer system according to claim 15, wherein said processing unit further comprises a request set receiver configured for receiving said first request set and said second request set.

18. The computer system according to claim 15, wherein said client request receiver is configured for receiving application layer requests, such as hypertext transfer protocol (HTTP) requests, file transfer protocol (FTP) requests, simple mail transfer protocol (SMTP) requests and telnet requests.

19. The computer system according to claim 15, wherein said processing unit further comprises a connection state monitor configured for determining a connection state between said client and said computer system, said computer system being configured such that said first application state and a second application state of said computer application program are related to said connection state.

20. The computer system according to claim 15, wherein said computer system is configured for maintaining a threshold amount of client requests per time unit and wherein said instruction module is configured for instructing said computer application program to execute said client request only if the amount of client requests is below said threshold amount.

21. The computer system according to claim 15, wherein said processing unit further comprises:

a distinguishing module configured for distinguishing between malicious and non-malicious clients;

a ranking module configured for ranking client requests from said malicious and said non-malicious clients to obtain a queue of non-malicious client requests followed by said malicious client requests;

wherein said instruction module is configured for instructing said computer application program to first execute said non-malicious client requests.

22. The computer system according to claim 21, wherein said processing unit further comprises a second analyzer module configured for analyzing said malicious client requests from said queue after said installation module having instructed all non-malicious client requests.

23. The computer system according to claim 21, wherein said processing unit further comprises a storage module for storing a contact history from clients and a ranking module configured for ranking clients known from said contact history higher in said queue than clients not known from said contact history.

24. The computer system according to claim 21, wherein said distinguishing module is configured for distinguishing said malicious and non-malicious clients on the basis of at least one of the following:

number of client requests received from clients, contact history of clients with said computer system, type of content of requests, content of requests received from said clients.

25. The computer system according to claim 15, wherein said computer system is configured for receiving said client requests over communication network.

26. The computer system according to claim 15, wherein said computer application program is a database application program installed on said other computer system.

27. The computer system according to claim 26, wherein said processing unit comprises:

a receiver configured for receiving said first set of allowable database requests from said database application program of said other computer system; and

said instruction module is configured for instructing said database application program to execute a database operation only if said client request matches one of said allowable database requests.