US20030051142A1 - Firewalls for providing security in HTTP networks and applications - Google Patents

Firewalls for providing security in HTTP networks and applications Download PDF

Info

Publication number
US20030051142A1
US20030051142A1 US09859123 US85912301A US2003051142A1 US 20030051142 A1 US20030051142 A1 US 20030051142A1 US 09859123 US09859123 US 09859123 US 85912301 A US85912301 A US 85912301A US 2003051142 A1 US2003051142 A1 US 2003051142A1
Authority
US
Grant status
Application
Patent type
Prior art keywords
system
user
signature
server
request
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US09859123
Inventor
Lluis Hidalgo
Xabier Lleonart
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
GRUPO S21SEC GESTION SA
Original Assignee
GRUPO S21SEC GESTION SA
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks

Abstract

Systems and methods provide security to HTTP applications. Responses sent from a server, such as a web server, are analyzed and a signature is generated for each HTML object in that page. The signature is encrypted and sent to a client along with the contents of the page. When a client later sends a request, the system checks the signature associated with that request with the contents of the request itself. If the values, variables, lengths, and cardinality of the request are validated, then the request is forwarded to the web server. If, on the other hand, the request is invalidated, the request is blocked from reaching the web server, thereby protecting the web server from malicious attacks. The systems and methods offer security without being limited to a session or user.

Description

    FIELD OF THE INVENTION
  • [0001]
    The invention relates generally to systems and methods for providing security in a network and, more particularly, to systems and methods for providing security in hyper-text transfer protocol (HTTP) networks and applications, such as over Internet.
  • BACKGROUND OF THE INVENTION
  • [0002]
    A great variety of devices exist which provide data and/or communication capabilities. One of the most common device for transmitting and receiving data is a computer. Computers include conventional desk top and lap-top computers as well as Personal Digital Assistants (PDAs) and other hand held devices, such as the Palm Pilot PocketPC, and Visor. Other types of devices are also used to transmit and receive data. For instance, some mobile radiotelephones and two way pagers not only provide voice communication capabilities but also enable the transfer and receipt of text messages and can be used to surf the Internet. In addition to mobile radiotelephones and pagers, enhanced television, WebTV, and other interactive television devices provide data capabilities in addition to displaying television programs. These devices are just some examples of devices which are currently available and which can communicate with other devices.
  • [0003]
    To enable communications between any two devices, a protocol is employed which defines the manner in which the two devices can communicate. In fact, in a network of devices, a plurality of protocols may be employed at various layers within the network. These layers include the physical layer, the data link layer, network layer, transport layer, session layer, presentation layer, and application layer. For instance, depending the particular layers, the protocol can govern the transmission of bits, handle errors in transmission, define routing of messages within a network, ensure reliability of transmissions, or define the format of the message.
  • [0004]
    A common protocol associated with the Internet is the Hyper Text Transfer Protocol (HTTP). HTTP is an application layer protocol that allows devices to transfer information over the Internet. For example, web browsers and servers operate HTTP and allow a user to access the World Wide Web (WWW) and a content provider to offer information to end users through a web site in the WWW. HTTP is not specific to any language, although most content providers use hyper-text mark-up language (HTML). Thus, HTTP also encompasses the Wireless Application Protocol (WAP) browsers and servers. For WAP devices, however, the devices use wireless mark-up language (WML) as opposed to HTML.
  • [0005]
    HTTP is a transactional protocol, meaning that it is based on requests from a client, such as a web browser, and responses from a server, such as a web server. With reference to FIG. 1, a client sends a request to a server with this request identifying a method and a universal resource locator (URL). The server receives the request and processes the URL, such as by obtaining information associated with the URL. For each request from a client, there is a response from the server. Thus, if the request was a request for data associated with a URL, the server would respond by obtaining that data and sending it to the client. The requests include reading a web page, submitting a form, etc. As can be seen from FIG. 1, HTTP is very well defined, has a very simple syntax, and provides a foundation upon which applications can be built to provide services.
  • [0006]
    Servers may have a number of HTTP applications. Often, content providers need to offer services through their content servers, be it a simple application that will collect feedback from visitors, or a more complex one like a shopping cart or an e-commerce application. All these applications share a common interface based on HTTP that allows a remote client to interact with the underlying resources, such as files, databases, etc., via a web browser. These applications are called HTTP applications, and often are referred to as WWW or Web Applications. Information is passed to HTTP applications in the request, usually setting parameters or cookies with the information provided by the user when filling in a form.
  • [0007]
    [0007]FIG. 2 shows an example web page and its corresponding HTML. The background of this figure depicts a form, a questionnaire, available from a server hosting the domain with the URL http://www.s21sec.com/caste/cuestionario/cuestionario.htm. When a client enters this URL or selects a link associated with the URL, the request is routed to the server, the server retrieves content associated with that URL and possibly performs some additional actions, and then routes a response back to the client. This response includes the html depicted in the notepad. The client browser interprets the html and renders the interface shown in the background.
  • [0008]
    The HTTP application receives the parameters and process them, sending a response back to the client with the result of the processing. HTTP applications do not depend on the programming languages, just in the interface (HTTP). A HTTP application can therefore be coded in any language, such as but not limited to C, C++, Visual Basic, Perl, or Java. There are well-known mechanisms of interacting with HTTP, such as Common Gateway Interface (CGI), Active Server Pages (ASP), Servlets, PHP, etc, but all of them rely on HTTP for communication between the client and the application.
  • [0009]
    A network environment is beneficial in that devices can communicate with each other but it exposes the devices and systems connected to the network to security risks. Network security is often regarded as protecting network resources from being accessed to ultimately prevent break-ins into company systems. A firewall is commonly located between the network and a company's system in order to prevent such break-ins. When installing a firewall, a main concern is to filter out ports that could be vulnerable to attacks from the outside.
  • [0010]
    As mentioned above, HTTP applications enable devices to gain access to a server's resources. For instance, HTTP applications may involve some kind of interaction between the end user and the backend of the company, be it a database server, file access to the server or just access to an email server. These HTTP applications consequently need privileges over these resources so that they can pass through the firewall, access the database, interact with the underlying operation system, etc. Because HTTP applications can provide access to sensitive areas of a company's system, a malicious user can subvert a vulnerable HTTP application and break into the company's resources and compromise their complete business.
  • [0011]
    A firewall may be ineffective in stopping such attacks. HTTP applications use the same network resources used by content servers, in fact they delegate on the web server to handle network transactions. As long as you need to offer HTTP access to any server, no current firewall can stop a HTTP application level attack. A traditional firewall works at the network and transport layers, but does not offer any kind of application protection. For example, FIG. 3 shows a diagram of a typical firewall 10 installed within a network. The firewall 10 is positioned between a server 12 and clients 8. The firewall 10 provides security to the server 12 on the Telnet and HTTP layers but does not offer any protection to an HTTP application 14.
  • [0012]
    A traditional approach to application security has been source code review and auditing. Source code review occurs after an application has been finished and involves having someone, often a third party, reviewing all the code and fixing any security problems that are discovered. This process is a never-ending task, as the auditor can overlook security bugs that will end up in the reviewed application, so it is not an assurance of full security. As more and more complex applications are being developed and the time-to-market shrinks in order to be the first to offer a service to customers, source code review is no longer an option, as freezing the deployment of an application for days or weeks means lost of business and revenue. A need therefore exists for systems and methods of providing security in a network, especially with HTTP applications.
  • SUMMARY OF THE INVENTION
  • [0013]
    The present invention addresses the problems described above by providing systems and methods offering security on a network. The systems and methods involve signing transmissions sent from a system and then checking return transmissions to make sure that a signature associated with those transmissions match the content in the transmissions. The systems and methods according to the invention generate a signature unique for the transmission based on important features of that transmission. For example, the signature may be based on fields within the transmission, values of those fields, acceptable lengths of variables, etc. The invention is well suited for use over the Internet at servers providing content to users. In this setting, responses sent from the server are analyzed, abstracted, and then signed before being sent to the users. Requests received from the users include the signature and these requests are intercepted prior to being sent to the server. The signature in these requests are decrypted and then compared to the actual contents within the request. If the signature corresponds with the request itself, the request is forwarded to the server. On the other hand, if the contents of the request do not match the signature, the request is blocked from reaching the server.
  • [0014]
    The systems and methods according to the invention can therefore provide security to IP networks, such as the Internet. Among other things, the invention can be used to block attacks to vulnerable sample applications, content server implementation problems, cookie poisoning, input validation, hidden field tampering, buffer overflows, cross-site scripting, and back door attacks. The invention does not rely upon user sessions whereby the invention does not require significant resources of a server and can be easily added to any server. The invention is not limited to a single server but can be employed in a multiple server environment with other network elements, such as load balancers. The invention can also be used with other security measures, such as secure socket layer (SSL). In the preferred embodiment, the system can be configured according to the desires of its end-user. The user can designate certain pages as start pages, meaning that no signature is required to access those pages. The user can also designate certain pages as Except pages, which is especially beneficial in an ISP setting where multiple domains are hosted on a server and where users need to modify those pages. The system preferably logs all errors and blocks and provides this log in an interface to the user.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • [0015]
    The accompanying drawings, which are incorporated in and form a part of the specification, illustrate preferred embodiments of the present invention and, together with the description, disclose the principles of the invention. In the drawings:
  • [0016]
    [0016]FIG. 1 is a diagram illustrating communications between a client and a server;
  • [0017]
    [0017]FIG. 2 illustrates an exemplary web page form along with its underlying HTML code;
  • [0018]
    [0018]FIG. 3 is a diagram of a typical firewall installation;
  • [0019]
    [0019]FIG. 4 is a diagram with a security system according to a preferred embodiment of the invention;
  • [0020]
    FIGS. 5(A) and 5(B) are flow charts of methods for processing responses to clients and requests to servers, respectively;
  • [0021]
    FIGS. 6(A) and 6(B) are more detailed block diagrams of response processing and request processing, respectively;
  • [0022]
    FIGS. 7(A) and 7(B) are process flow diagrams for a response and request, respectively;
  • [0023]
    [0023]FIG. 8 is a flow diagram of a checkout section of an application;
  • [0024]
    [0024]FIG. 9 is an example of an interface provided to a user obtaining customer details;
  • [0025]
    [0025]FIG. 10 is an example of an interface provided to a user from a block of an attack seeking customer details;
  • [0026]
    [0026]FIG. 11 is an example of an interface provided to a user as a result of a block of an attack seeking an arbitrary file writing;
  • [0027]
    [0027]FIG. 12 is an example of a login interface;
  • [0028]
    [0028]FIG. 13 is an example of a configuration select interface;
  • [0029]
    [0029]FIG. 14 is an example of an administrator configurations select page;
  • [0030]
    [0030]FIG. 15 is an example of a general configuration page;
  • [0031]
    [0031]FIG. 16 is an example of an edit page for general options;
  • [0032]
    [0032]FIG. 17 is an example of a customer error page;
  • [0033]
    [0033]FIG. 18 is an example of a key options interface;
  • [0034]
    [0034]FIG. 19 is an example of the size of the key in drop-down menu in the key options interface;
  • [0035]
    [0035]FIG. 20 is an example of the life time key drop-down menu in the key options interface;
  • [0036]
    [0036]FIG. 21 is an example of a node configuration interface;
  • [0037]
    [0037]FIG. 22 is an example of an edit node configuration interface;
  • [0038]
    [0038]FIG. 23 is an example of a domain's main page interface;
  • [0039]
    [0039]FIG. 24 is an example of a domain's edit page;
  • [0040]
    [0040]FIG. 25 is an example of a start page main page;
  • [0041]
    [0041]FIG. 26 is an example of a start page edit page;
  • [0042]
    [0042]FIG. 27 is an example of an accept page interface;
  • [0043]
    [0043]FIG. 28 is an example of an accept pages edit page;
  • [0044]
    [0044]FIG. 29 is an example of a default main page interface;
  • [0045]
    [0045]FIG. 30 is an example of an administrative mail page interface;
  • [0046]
    [0046]FIG. 31 is an example of a user page of a new configuration;
  • [0047]
    [0047]FIG. 32 is an example of a user main page;
  • [0048]
    [0048]FIG. 33 is an example of a user edit page interface;
  • [0049]
    [0049]FIG. 34 is an example of configuration control buttons;
  • [0050]
    [0050]FIG. 35 is an example of a legend provided in a logs interface;
  • [0051]
    [0051]FIG. 36 is an example of a logs page interface;
  • [0052]
    [0052]FIG. 37 is an example of a drop-down menu with the logs page interface; and
  • [0053]
    [0053]FIG. 38 is an example of a restarting page interface.
  • DETAILED DESCRIPTION
  • [0054]
    Reference will now be made in detail to preferred embodiments of the invention, non-limiting examples of which are illustrated in the accompanying drawings.
  • [0055]
    I. Overview
  • [0056]
    The invention relates generally to systems and methods for providing security in a network and with applications. The systems and methods intercept at least some of the requests from clients to a server and also intercept at least some of the responses from the servers to the clients. In general, the systems and methods generate signatures of communications from the server to the client and then check the requests from the client against those signatures. If the requests from the client matches the signature, then the requests are forwarded to the server. On the other hand, when the responses do not match the signatures, the responses are blocked from reaching the server.
  • [0057]
    For the purposes of this description, the invention will be described with reference to systems and methods that provide an HTTP application firewall. For example, the systems provide security to applications hosted on a server and interfaced to a network via HTTP. Thus, the systems and methods provide security to servers and applications on the World Wide Web (WWW). The invention, however, is not limited to strictly HTTP applications nor to servers connected to the Internet. The invention encompasses systems and methods on other types of networks, the use of protocols other than HTTP, and other types of applications. As other examples, the invention encompasses the Wireless Application Protocol (WAP), Intranets, XML applications, and HDML applications.
  • [0058]
    By intercepting the responses and requests, the systems and methods enforce the HTTP protocol as defined in Internet standards, disallowing anybody from trying to break the protected applications, such as by malforming requests or modifying legitimate requests. The preferred systems sit between the client and the server and intercept both the HTTP requests and responses and verify that the contents of the request are not malicious. This verification is based in information derived from the content, such as in HTML, derived from FORM fields, etc. Networks and applications can potentially be vulnerable to a number and variety of attacks. The systems and methods according to the invention prevent and provide assistance in deterring many of such attacks.
  • [0059]
    For example, the systems and methods can protect vulnerable sample applications. A WWW server default installations often include sample pages and applications targeted at showing the server capabilities to a new user. These applications are sometimes vulnerable to attacks, and are actively exploited by crackers. The systems and methods stop access to those pages not directly referred in the website, such as sample applications or files not meant to be published, such as database files, website log files, private documents, etc. too often found on publicly available servers.
  • [0060]
    As another example, the invention can address content server implementation problems. WWW servers can have implementation problems, such as the recently found IIS Unicode bug or the Iplanet 4.0 shtml buffer overflow. These and other problems can, as will be apparent to those skilled in the art, be addressed by the systems and methods of the invention.
  • [0061]
    The invention can be used to prevent cookie poisoning. Applications often rely on cookies in order to keep track of user sessions, or to store transient information, such as login or passwords. Modification of these values can lead to security problems, and are stopped by the systems and methods by using the content signing.
  • [0062]
    Input validation is another example of an application of the invention. Often, an application has to validate all the input it receives from a customer. For example, say an application accepts an email address in a field, but an attacker sends commands that will get executed in the content server. The application has to filter out any bad character by identifying every single point of entry to the application then verifying the client values. The systems and methods of the invention make this task easy and safer by embedding information on the expected values in the page content and by automatically verifying the values when receiving the request from the client.
  • [0063]
    Hidden field tampering is yet another example of an application of the invention. Applications store session information on “hidden” form fields. These fields are not displayed to an end user but are accessible in the HTML page source code or in the URL bar of the browser so they are easily modified by a malicious user. The systems and methods protect modification of these fields by using the content signatures so they can't be modified and if they are modified an alert is logged and the attack blocked.
  • [0064]
    Another application of the invention is with buffer overflows. HTML content has a way to force a client's browser to only allow a limited amount of characters to be entered in a form field. This limitation is enforced by the client, but can be easy overcome. Applications that rely on content length limits often present problems of buffer and heap overflows that ultimately allow remote access to the server. The systems and methods detect and enforce the maximum length of a field, and preferably log and block any attacks.
  • [0065]
    Cross-site scripting is another example of an advantage of the invention. Cross-site scripting is a client problem that consists in fooling a client into believing they are accessing a site while they are really accessing a malicious site. This malicious site can be used to gather user login information, credit card data or just to attack the company name. The systems and methods can address the cross-site scripting problem with invention.
  • [0066]
    By enabling specific parameters when accessing an application, a backdoor could be accessed, or a debug function displaying too much information triggered, which could allow a remote client to break into the server. The systems and methods disallow extra parameters passed to applications, thereby overcoming the backdoor problem.
  • [0067]
    The above examples include a limited set of attacks or hacks that the invention can be employed to prevent or at least discourage. As will be appreciated to those skilled in the art, additional attacks or hacks exist today and additional attacks and hacks will be developed in the future that pose a danger to systems. The invention is therefore not limited to the above examples but instead may be adopted to these other types of attacks and hacks.
  • [0068]
    II. System Diagram
  • [0069]
    The systems according to the invention can be located in various places between the client and the server. The systems inserts themselves between the HTTP protocol and the HTTP application layers and has the ability to intercept any message between both layers so it is able to enforce the interface between HTTP and the application. For example, as shown in FIG. 4, a security system 20 according to one embodiment of the invention can be physically separate from a server 26 and clients 24. The system 20 receives requests from the clients 24 through a network 22 and also receives any responses from the server 26 before being delivered through the network 22 to the clients 24.
  • [0070]
    As is apparent from the figure, the invention is not limited in the types of clients but instead encompasses any type of device or system, including but not limited to digital television, enhanced television, WebTV, or other types of interactive television 24 a; computers 24 b; lap-top computers 24 c; Palm Pilot, PocketPC, Visor, or other Personal Digital Assistants and data devices 24 d; and mobile radiotelephones, interactive pagers, or other communication devices 24 e.
  • [0071]
    The invention is also not limited in the types of systems or devices for which the system 20 provides security or protection. In a common application of the invention, the system 20 is intended to be used with a server 26. The invention, however, is not limited to a client-server environment but instead encompasses peer-to-peer communications, distributed computing, or other network environments.
  • [0072]
    [0072]FIG. 4 illustrates the system 20 as a stand-alone system separate from the server 26 and network 22. The system 20 can be implemented as a network appliance that sits just in front of the web server 26 and works as a proxy server. This standalone version of the system 20 is recommended where performance is an issue or where there is a large number of domains or web servers 26. Setting up the standalone version requires network topology changes, as it has to be set up as a proxy of the HTTP servers 26.
  • [0073]
    The system 20 is not limited to a stand-alone system but instead can positioned anywhere in the network where the system 20 can intercept requests and responses. In the client-server environment, the system 20 can be located anywhere the system 20 can intercept transmissions between the clients and the servers, check the transmissions for any malicious request that could result in an illegal access, and take appropriate action. As another option, the system 20 can be co-resident with the server 26 itself as a content server module version. In this example, the system 20 can be implemented as an extension to an HTTP server, such as IIS, Netscape/Iplanet, and Apache. The system 20 installs in the same machine as the HTTP server and needs no special network configuration in order to work. This configuration of the system 20 is recommended where there are a limited number of domains and servers or where maximum performance and throughput is not needed. Also, this configuration is easier to set-up as it does not require any network topology changes. As a further option, the system 20 can be implemented as part of the network 20 and/or as part of the devices 24.
  • [0074]
    III. Content Signing
  • [0075]
    As mentioned above, systems according to the invention take responses from servers, requests from servers and generates a signature. This signature is then used in deciding if a subsequent request from a client is safe. Preferred methods for processing responses and requests will now be described with reference to FIGS. 5(A) and 5(B).
  • [0076]
    A. Response Processing
  • [0077]
    A flowchart according to a preferred method 30 of intercepting responses is depicted in FIG. 5(A). At 32, the system 20 receives content being sent to a client 24. Typically, server 26 delivers the content in response to a prior request received from the client 24. The invention, however, is not limited to servers 26 that only respond when requested but can also be used with servers 26 that automatically deliver content without any preceding request. At 33, the system 20 analyses the content that is being sent to the client 24. Next, the system abstracts the content and generates an encrypted signature at 35 based on that abstraction. This signature is specific for a particular piece of content or set of content, such as a page with certain prescribed fields and values. The system 20 encrypts the signature at 35 to prevent the client 24 from modifying the signature, thereby to disallow the security measures. Once the signature is encrypted, at 36 the system 20 sends the content with the encrypted signature the client 24.
  • [0078]
    The entire method 30 and system 20 are preferably transparent to both the server 26 and the client 24. In other words, the server 26 operates in the same manner it does without the method 30 being performed and without the system 20 being interposed between the server 26 and the clients 24, whereby preferably no modification needs to be made to the server 25 or any of its applications. The method 30 and system 20 are also transparent to the clients 24 whereby the clients 24 see no difference in operation.
  • [0079]
    B. Request Processing
  • [0080]
    A preferred method 40 of processing requests from clients 24 will now be described with reference to FIG. 5(B). The method 40 begins at 41 with the server 26 receiving a client request. As will become more apparent from the description below, at least some but not necessarily all of the requests will trigger the method 40. When the method 40 is triggered, at 42 the system 20 will intercept the request, decrypted the request, and derive the signature. At 43, the system 20 compares the signature encrypted with the request to the contents of the request itself. During normal operation with no alteration of the request, the signature will correspond with the contents of the request. In such a case, at 44, the system server determines that the request is valid and at 46 forward the request to the server 26 for processing. If, on the other hand, the request has been tampered, then at 44 the system 20 finds that the signature and the request do not correspond and will block the request at 45.
  • [0081]
    C. Content
  • [0082]
    As mentioned above, at 32 the method 30 involves receiving content that is being delivered to the client. By analysing the content, the system 20 determines if a subsequent request from a client 24 is valid. The system 20, however, need not analyse all content being delivered to clients 24 and in fact preferably omits some responses.
  • [0083]
    For example, the system 20 preferably does not sign responses from the server 26 where clients 24 can begin communications with the server 26. In a WWW server 26, these responses might be associated with a home page or other pages where clients 24 should be able to visit freely and which offer low risk of an attack. In the preferred embodiment, as will be described in more detail below, the system 20 allows an administrator to set up certain URL resources as “Start Pages,” meaning that in order to access the resource no signature is needed. Start pages should be configured to be those pages in the website structure that a client 24 can access directly, such as by typing them in the URL bar of a browser, through links available at other sites, or by using bookmark features. These pages include the main welcome or home page, the main page for departments, etc. Because access to Start pages is not restricted, an application should not be designated as a Start page since it will not benefit from the protection of content signing.
  • [0084]
    As another example, in the preferred embodiment the administrator can designate some content as Exception Pages. As with the start pages, setting up URL resources as “Exception Pages” will cause the system 20 to deliver these pages to clients 24 without any content signing. An Exception page is well-suited in those set-ups where some content is out of the control of the organization, such as in an ISP arrangement where users can modify their own web pages. In these types of situations, signing of those pages could compromise security as a malicious user could publish a web page with links to malformed requests that could lead to application security problems.
  • [0085]
    The system 20 preferably prevents access to pages not directly referred from within the content server, or configured as start pages. Thus, if a content server 26 installs applications and sample content that the administrator does not know is there, the system 20 automatically blocks access to such sample content A malicious user is therefore blocked from accessing “sample” pages or applications installed during the content server set-up which, if found vulnerable, are the most widely used kind of attack against content servers 26.
  • [0086]
    D. Analyse and Abstract
  • [0087]
    As mentioned above, the system 20 intercepts the response from the server 26 to a client request, analyses the response, and abstracts the response. By analysing and abstracting, the system 20 can generate a signature for that response and later determine if a client request is valid. Abstraction involves identifying important parts of the content from which the signature can be generated. This signature describes fields and values present in the page.
  • [0088]
    The system 20 can perform this analysis and abstraction in a number of ways. In the preferred embodiment, the system 20 analyses entry points in the content, such as in forms, input fields, etc. and signs them by creating a unique signature that is inserted into the response on-the-fly. This signature is guaranteed to be unique and un-modifiable by encrypting before the system 20 inserts it in the content. The system 20 then relays the page to the client 24 in a process totally transparent to the content designer and to the end user. The content designer does not need to alter its design in order to allow the system 20 to work, nor will the end user see a change on the appearance of the page. It should be understood that the system 20 may determine that other portions or aspects of the response are important and use those other portions or aspects in generating a signature.
  • [0089]
    E. Encryption
  • [0090]
    To prevent signature tampering by a malicious user, the system 20 uses encryption in the signature process. When a request is later received, the system 20 decrypts the request to obtain a plain text version of the signature. This signature is then compared to the contents of the request itself in validating the request. The system 20, for example, can compare signature to the type, value, length and cardinality of the request.
  • [0091]
    While the invention may use any suitable type of encryption, the preferred algorithm is the well-known American Encryption Standard AES adopted as the current secure cipher level by the NSA. The system 20 offers 128, 192 or 256 bit encryption, providing different levels of security at the expense of some efficiency related to the cipher processing. The user can also choose a lifetime for the key, resulting in reduced time frames for a possible, wide-scale, cracking effort against a cipher text. Each configuration of the system 20 has its own key, avoiding security problems related to shared keys. The system 20 allows an administrator to generate keys or to enter them manually from within the configuration interface. Since AES was developed outside of the US, it is not restricted by the US encryption export laws.
  • [0092]
    F. Comparison
  • [0093]
    The system 20 generates the signature of the response at 35 and delivers the response with the encrypted signature at 36. Later, when a request is received from a client 24, the system 20 compares a signature associated with the request to the request. For example, once a user processes a page and accesses an HTTP application at the server 26, such as by submitting a form, following a link, etc., the client 24 sends a request including the signature to the content server. Before the request is delivered to the server 26, the system 20 intercepts the request and performs the comparison.
  • [0094]
    In general, the request is validated based on the expected variables and values and the actual content of the request. If the input matches the expected values, the system 20 provides the request transparently to the HTTP application that will process it. On the other hand, if for any reason the input in the request does not match the expected values, the system 20 blocks the request at 45. In blocking the request, the system 20 may generate a configurable informative error and send this error to the user. The system 20 may also enter the event in an illegal access entry log and optionally providing real-time alerts to an administrator.
  • [0095]
    The system 20 validates input based on the original content information to detect malicious or invalid responses. One way in which the system 20 validates the input is by examining variable count and names to ensure that an application receives exactly the number of variables it is expecting and stopping any access to unknown application functionality, as debug functions or backdoors. The system 20 also checks the value of content. If values are enforced in the page, such as by using “hidden” fields, configuration options, etc., then the system 20 checks to see if they are present in the client request. The system 20 validates the value length of the content in the request. If the content designer enforced a content length, the system 20 validates that the input conforms to that maximum length. If the length was not specified, the system 20 enforces a configured default length to prevent attacks based on buffer or heap overflows. The system 20 monitors the destination URL and allows a client 24 to access to only a designed set of URLs. The system 20 only verifies for these intended URLs so a user cannot jump from one URL to another without the proper permissions.
  • [0096]
    Advantageously, the system 20 does not use cookies in order to track users, all the information needed its embedded in the page sent to the client. As a result, no special configuration is needed on load balancers or user browsers in order to work with the system 20. Also, any privacy concern that could have been raised because of the use of cookies is avoided because the system 20 itself does not use cookies.
  • [0097]
    While the system 20 does not employ cookies in the content signing, the system 20 nonetheless is operable with servers 26 and applications that do employ cookies. The system 20 can perform cookie signing and validation. When an HTTP application sets a cookie on the end user browser, the system 20 intercepts the corresponding HTTP header and signs it, allowing for integrity checks on the cookie once it is sent back to the server in future requests. By signing the cookies, the system 20 prevents a user from modifying cookie contents and thus stops attacks based on cookie poisoning.
  • [0098]
    IV. Operating Environments
  • [0099]
    As mentioned above, the system 20 is not limited in the types of devices 24 nor in the types of systems 26. In the discussion of this document, the environment is a client-server environment with the devices 24 being clients and the system 26 being a server. The system 20 is not limited to a single server 26 but instead supports multiple servers. By signing the page content, the system 20 does not require any special configuration to allow for fault tolerant redundant systems, where more than one system 20 is present or where load balancers are in place. In fact, multiple systems 20 may be deployed in the same domain if all systems 20 share the master key.
  • [0100]
    The system 20 does not have a limit on concurrent user sessions or requests. The system 20 also does not require an excessive amount of memory in order to accommodate user details, as it distributes authentication information amongst servers and clients. The system can therefore run in a network with no added requirements, be it a low end PC or an embedded system where resources are expensive and limited. This feature, and since the system 20 does not make use of cookies or any other special function on the client side, makes the system 20 a “plug and play” technology for use in any network device that has the capability of intercepting traffic, be it a traditional Firewall, a load balancer, a HTTP proxy/accelerator, etc.
  • [0101]
    The system 20 supports additional measures of security, such as Secure Socket Layer (SSL), both in the server module and standalone versions. The system 20 transparently handles SSL connections by hooking itself between the SSL and the application layers, so no special configuration is required to work in SSL environments. In the standalone version, the system 20 decrypts SSL messages as it sits between the server 26 and the client 24. The system 20 automatically handles this conversion by using the secure web server SSL certificate in order to decrypt the traffic between client 24 and server 26.
  • [0102]
    Sometimes, client side applications, such as Javascript, VBScript, Java, and Flash, interact with HTTP applications located in the server 26. These applications often manipulate URLs or form values after the server 26 has sent them to the client 24. When the client 24 sends this request, the system 20 detects manipulation in the request and refuses to pass the request to the application. In order to allow for such applications, the system 20 can be configured to offer two security levels for client side applications. At a low level, the system 20 accepts requests where the content of variables has been modified, as long as the modifications do not go over the predefined maximum length. At a high level, the system refuses to accept any request that has been modified at the client side, except for those variables and values defined in configuration or tagged in the page with tags. Due to the nature of client side applications, it is often impossible to know beforehand when the signature is created how the user will interact with the application and what values will be sent. The system 20 therefore alters the way it provides security to pages that embed client-side applications which cannot be verified in the usual way.
  • [0103]
    By design, the system 20 integrates transparently in a customer network; taking advantage of the resources already in place. The system 20 may be used with load balancing or high availability with no need for reconfiguration. In the event that the system 20 or associated HTTP server went offline, no steps are required in order to synchronize state information with other systems 20 running in a cluster configuration, as information is automatically distributed amongst servers and clients during normal operation. Thus, no request will be lost or affected by latency due to synchronization, even in the event of the system 20 going offline. When the system 20 comes back up, the system 20 will automatically receive the latest configuration from the other nodes and will start to operate securely as from the first request.
  • [0104]
    V. Logs and Alerts
  • [0105]
    The system 20 preferably maintains a log of events, such as a log of all invalid requests received from clients. The system 20 preferably logs all illegal access requests to a human readable log accessible through the web. Additionally, the system 20 can issue alerts or warnings. These alerts may be issued in a variety of ways, such as via e-mail, pager, or other text or voice messaging. The real-time alerts can warn administrators when illegal attempts are being performed whereby the administrator can take appropriate action to counter such attempts. Any illegal access attempt blocked by the system 20 can be a real attempt, as modification of requests require a work on the malicious user side. The system 20 consequently issues no false positives in the log, just plain application attacks blocked by the system 20.
  • [0106]
    VI. Customization
  • [0107]
    The system 20 can be implemented according to the desires of a customer. In other words, the system 20 preferably can be customized for a particular environment according to the desires of a customer. The system 20 allows for a lot of customisation and security settings.
  • [0108]
    The system 20 also offers a “plug and play” configuration option which allows a user with no security knowledge to provide security to the applications hosted on its site, with no need to configure any settings. This “plug and play” configuration is intended for systems 20 protecting multiple domains, such as in a hosting company, where the task of updating and protecting content is outside of the scope of the administrator, leaving that task to the end-user, a user that doesn't necessarily have the knowledge to configure the system 20. According to a preferred set of “plug and play” configuration security settings, the system 20 only signs objects that will access an application, which includes forms and links where parameters are passed. The system 20 does not protect pages nor does it check for signatures where no arguments are involved. This setting allows a server to protect its applications without having to set up start pages. The system 20 does not protect cookies, in order to protect cookies the cookie section of the configuration must be defined. Client side scripting security settings will be set to “LOW,” allowing most of Javascript applications to work while protecting server side applications.
  • [0109]
    The “plug and play” configuration is desired in situation such as the hosting environment but is not ideal for many other situations. For example, the system 20 should not be in a “plug and play” configuration when maximum security is required. The “plug and play” configuration defines a set of security settings, but is no substitute of a properly customized server. The “plug and play” configuration is also not recommended when page content is out of the scope of the organization, such as an ISP that offers web hosting to its users. In this set-up, the Except Pages are recommended as a malicious user could use web access to create pages that, once signed, will allow him to subvert application security.
  • [0110]
    VII. Server Side Tags
  • [0111]
    Server side tags, allows an intermediate application that is screening the content of a web page, to take action based on the content of the tags. These tags are embedded in the web page content by the document author, and are not interpreted by the web browser, but detected and interpreted by an intermediate application such as the system 20. The system 20 uses server side tags in order to “mark” content elements that could be modified by client side applications, maximizing the security of the application.
  • [0112]
    A server side tag example could be:
  • [0113]
    <INPUT TYPE=“text” NAME=“address” CLASS=“hive_email”>
  • [0114]
    This tag won't be interpreted by the client browser, but by the system 20 itself, that will perform its processing based on the value of the tag.
  • [0115]
    VIII. System Architecture
  • [0116]
    A preferred system architecture for the system 20 will now be described with reference to FIGS. 6(A) and 6(B). With reference to FIG. 6(A), a response interception unit 62 receives a response from the webserver 26. The response interception unit 62 passes the response first to a parser, such as the HTML code parsing unit 63. The parser 63 performs the analysis and abstraction of the response to derive important fields. These fields are passed to a signature creation unit 64 which creates a signature for that response. An encryption unit 65 encrypts the signature along with the response and, together, the response and encrypted signature are passed to the web client 24, such as through the Internet.
  • [0117]
    When a request is received from the web client 24, a request interception unit 66 receives the request and sends it to a signature checking unit 67. The signature checking unit 67 employs a decryption unit 68 for deriving the plain text version of the signature. The signature checking unit 67 then compares the signature against the content of the request itself. If the signature checking unit 67 validates the request, then the signature checking unit 67 forwards the request to the web server 26. If the signature checking unit 67 invalidates the request, then the signature checking unit 67 sends the error to an error unit 69. The error unit 69 maintains a log file of all errors and may also generate alerts based on the error received. The error unit 69 may forward these errors to an administrator or other appropriate personnel, such as through e-mail or pager.
  • [0118]
    A more detailed flow diagram of the response processing is shown in FIG. 7(A). The system 20 receives a response from the web server and determines if it is an accept page. If it is, then the processing terminates. If the page is not an accept page, then the parser uses the signature creation unit 64 and encryption unit 65. The processing shown in FIG. 7(A) also involves determining if the response is signable and if it is a start page.
  • [0119]
    With reference to FIG. 7(B) the processing of a request involves receiving the request from a web client at the request interception unit 66 and then sending the request to the signature checking unit 67. The signature checking unit 67 checks whether the request involves a start page and, if not, then employs the decryption unit 68 for deriving the signature. The signature checking unit 67 then checks values, variables, strings, and lengths of the request against the signature. In the event of an error, the signature checking unit 67 forwards the error to the error unit 69.
  • IX. EXAMPLES
  • [0120]
    Some examples will now be provided as to how the system 20 can be used to provide security to HTTP applications. The execution of a shopping cart application that allows a user to buy things through the web will be used in these examples. The shopping cart application is located at http://www.example.com/applications/cart.cgl. This application is quite simple and we will only be seeing the checkout section. The application follows a flow diagram shown in FIG. 8. When the user makes a request with the “action” parameter set to “1”, the application displays a FORM with the number, name and price of the items in its shopping cart as well as a “Checkout” button that will allow him to be billed.
  • [0121]
    An example of some html associated with the application is as follows:
    You are ordering @COUNT@ of @NAME@ at a price of @PRICE@.
    <FORM ACTION=“/cgi-bin/cart.cgi”>
    <INPUT TYPE=“hidden” NAME=“name” VALUE=“@NAME@”>
    <INPUT TYPE=“hidden” NAME=“count” VALUE=“@COUNT@”>
    <INPUT TYPE=“hidden” NAME=“price” VALUE=“@PRICE@”>
    <INPUT TYPE=“hidden” NAME=“name” VALUE=“@NAME@”>
    <INPUT TYPE=“hidden” NAME=“file” VALUE=“bill.txt”>
    <INPUT TYPE=“text” NAME=“destination” VALUE=“”>
    <INPUT TYPE=“submit” NAME=“Checkout”>
    </FORM>
  • [0122]
    The values enclosed in “@” represent the actual values of each variable. When the user clicks on the “Checkout” button, the application receives a request with the “action” parameter set to “2” and a list of items to bill the user for, in the “name,” “count,” and “price” variables. The application writes a receipt to disk, emails the receipt to the merchant, and displays a confirmation message.
  • [0123]
    The following depicts a WriteReceiptToDisk function, which takes the variables sent by the customer in the previous form (file, name, count and price) and writes them to disk, and an EmailConfirmation function, which takes the variables sent by the customer in the previous form (destination, name, count and price) and sends them via email to the address specified in the “destination” parameter:
    WriteReceiptToDisk:
    open(FILE, “> @FILE@”);
    print FILE “@NAME@”;
    print FILE “@COUNT@”;
    print FILE “@PRICE@”;
    EmailConfirmation:
    open(MAIL, “| sendmail @DESTINATION@”);
    print MAIL “@NAME@”;
    print MAIL “@COUNT@”;
    print MAIL “@PRICE@”;
  • [0124]
    The application, even being this simple, presents a number of security vulnerabilities that could be used by a malicious user. For example, through this application, a malicious user can obtain customer details, write arbitrary files on the web server, execute commands on the web server, and make false order bills. The following examples of the system 20 explain how such security vulnerabilities are addressed.
  • [0125]
    A. Obtaining customer details
  • [0126]
    The application writes to a log file each transaction, including personal details on the customer, etc. The name of this log file is included in the form sent to the user and thus is visible to a malicious user just by reading the source code of the HTML page. Accessing customer details is as easy as prefixing the name of the logfile, which is “bill.txt,” to the server pathname, such as with the following:
    http://www.example.com/application/bill.txt
  • [0127]
    Even if the filename was not shown in the web page, a malicious user could take advantage of server problems in order to find out the filename, or just guess it. FIG. 9 illustrates how an attack to a server not protected by the system 20 can be used to obtain customer details. In contrast, the system 20 stops these kind of attacks by requiring a signature in order to access any web page, except for the start pages. Consequently, a malicious user is not allowed to access an arbitrary web page on the server, such as order files, hidden data files, vulnerable samples, etc. without the proper signature. An example of an interface returned to a user as a result of the attack is shown in FIG. 10. As explained in this interface, the resource requested by the user cannot be accessed without the proper signature.
  • [0128]
    B. Arbitrary file writing
  • [0129]
    The system 20 can also prevent arbitrary file writing, which occurs when an application writes to a log file each transaction. The name of the file data is written to is embedded in the form sent to the client and is passed as a user request parameter to the application. A malicious user could modify this parameter in order to point to a different file, effectively writing the order details to any file on the file system. A particularly telling illustration of the severity of this kind of attack is that the application could potentially be directed to overwrite the homepage of the server.
  • [0130]
    The user could request the data to be written to file
  • [0131]
    “/home/httpd/htdocs/index.html ,” by requesting a URL like:
    http://www.example.com/application/cart.cgi?option=
    2&file=/home/httpd/htdocs/i
    ndex.html
  • [0132]
    If the system 20 is in use, the form includes a signature that describes the FORM data and values abstraction. For example, the form may include the HIVEDATA having a value of ABCD, as shown as:
    http://www.example.com/application/cart.cgi?option=
    2&file=bill.txt&HIVEDATA=AB
    CD
  • [0133]
    If a user tries to modify the request parameters, such as by replacing “bill.txt” with “/home/httpd/htdocs/index.html,” the request would be as follows:
    http://www.example.com/application/cart.cgi?option=
    2&file=/home/httpd/htdocs/i
    ndex.html&HIVEDATA=ABCD
  • [0134]
    When the system 20 decrypts the signature, the system 20 will detect that the parameters associated with the request do not match that of the signature. As a result, the system 20 will invalidate the request due to tampering and stop the request from getting to the application. An example of an interface provided to the user in the event of such tampering is shown in FIG. 11.
  • [0135]
    The system 20 stops these and other types of attacks by requiring a signature in order to access any web page, except for the start pages. The signature includes information on the number and acceptable values of the user request parameters and, on receipt of a request, the system 20 checks the signature against the actual values. If the system 20 finds that an attempt to tamper the parameters occurred, the system 20 sends an error message to the user, logs the illegal access attempt, and optionally relays the error to the administrator.
  • [0136]
    C. Remote command execution
  • [0137]
    Some applications are able to be execute remotely commands. For example, an application may send an email to the merchant once the checkout has been completed. The application insecurely calls the “sendmail” program in order to send a mail to the user-provided e-mail address “DESTINATION”:
  • [0138]
    open(MAIL, “| sendmail @DESTINATION@”);
  • [0139]
    A malicious user could set the DESTINATION user parameter in ways that will allow arbitrary commands to be executed on the server, For example, Table 1 below provides two examples of commands that can be executed on the server.
    TABLE 1
    DESTINATION VALUE CODE EFFECT
    ; uname -a “| sendmail ; uname -a” Execution of the “uname”
    command
    & rm -rf / & “|sendmail &rm -rf / &” Deletion of the server
    contents
  • [0140]
    Thus, with a simple URL like:
    http://www.example.com/application/cart.cgi?option=
    2&destination=&rm%20-
    rf%20/&,
  • [0141]
    a malicious user could delete all the files in the server, install a Trojan horse, download company databases, break into the internal network, etc.
  • [0142]
    If the system 20 was used, the form will include a signature that will describe the FORM data and values abstraction. For example, the form may appear as follows:
    http://www.example.com/application/cart.cgi?option=
    2&destination=store@example
    .com&HIVEDATA=XYZO
  • [0143]
    If a user tries to modify the request parameters, as in:
    http://www.example.com/application/cart.cgi?option=
    2&destination=;rm%20-
    rf&HIVEDATA=XYZO
  • [0144]
    The system 20 determines that the signature does not correspond with the parameters in the request. The system 20 will conclude that parameter tampering occurred and stop the request from getting to the application.
  • [0145]
    D. False order billing details
  • [0146]
    The system 20 can also be used to prevent false order billing. An http application associated with billing uses the HTML page to store the number, name and price of items in the shopping cart just before checking out. This information is sent back to the application once the user checks out as user request parameters. The application receives the parameters and creates a receipt based on the values provided by the user. An example of a normal request is as follows:
    http://www.example.com/application/cart.cgi?option=
    2&item=Apples&count=10&pric
    e=100
  • [0147]
    Obviously, a malicious user could modify these parameters, as the price, in order to modify the bill, so he is charged less than the items are worth by trying the following:
    http://www.example.com/application/cart.cgi?option=
    2&item=Apples&count=10&pric
    e=1
  • [0148]
    which could result in charging an amount of “1” instead of “100.”
  • [0149]
    By using the system 20, the form includes a signature that describes the FORM data and values abstraction. Using the same example, the request with the system 20 may appear as follows:
    http://www.example.com/application/cart.cgi?
    option=2&item=Apples&count=10&pric
    e=100&HIVEDATA=DEFG
  • [0150]
    This request includes the HIVEDATA signature of DEFG. If a user tries to modify the request parameters, such as by changing the price with the following request:
    http://www.example.com/application/cart.cgi?
    option=2&item=Apples&count=10&pric
    e=1&HIVEDATA=DEFC
  • [0151]
    then the system 20 decrypts the signature and discovers that the parameters do not match the signature. The system 20 concludes that parameter tampering has occurred and stops the request from getting to the application.
  • [0152]
    E. Internal Processing Example
  • [0153]
    A description of the internal processing associated with operation of the system 20 will be described with reference to obtaining customer details. The system 20 needs a signature from the client in order to access any non-start page. This allows the system 20 to control the site flow, as only URLs referenced from pages in the server 26 can be accessed, preventing access to pages not intended for public consumption, samples, and applications that are not meant to be accessed directly.
  • [0154]
    For an attack of accessing an arbitrary page not referenced directly from the website, the system 20 parses the request and finds that the request is not for a “Start page,” meaning that a signature is needed. The system 20 next looks for a signature in the request, and as there is no signature it will display an error message. The system 20 will exit, preventing any further processing of the request.
  • [0155]
    As mentioned above, the system 20 may be configured for “plug and play.” In this configuration, the system 20 allows a server to securely start processing requests without having to set-up any start page information or any other settings. The system 20 accepts requests for pages without a signature, even if they are not listed under the “Start Pages” configuration tab, as long as the request does not pass parameters to an application. The system 20, for instance, will allow access to the following URLs without requiring a signature:
    http://www.example.com/
    http://www.example.com/departments/
    http://www.example.com/departments/page1.html
    http://www.example.com/application/
    http://www.example.com/application/bill.txt
    http://www.example.com/application/cart.cgi
  • [0156]
    but the following will not be allowed without the proper signature:
    http://www.example.com/application/cart.cgi?a=b
    http://www.example.com/application/cart.cgi?a
  • [0157]
    So, “hidden” or data files accessible from the website will be available to a remote client, even if they are not referenced from within the website. The “plug and play” configuration therefore should not be used when maximum security is desired.
  • [0158]
    For arbitrary file writing, the system 20 checks that the actual values of user request parameters match the expected values embedded in the signature. If there is a mismatch, the system 20 displays an error message and exits. Arbitrary file writing involves a malicious user modifying one of the parameters of a form sent by the server, “file,” which is the filename of a file receiving the user information.
  • [0159]
    When the system 20 detects that a form is being sent to the remote user, the system 20 intercepts the response from the server 26 and adds its own signature to it, allowing for attack detection and avoiding. The form, once parsed by the system 20, looks like:
    You are ordering @COUNT@ of @NAME@
    at a price of @PRICE@.
    <FORM ACTION=“/application/cart.cgi”>
    <INPUT TYPE=“hidden” NAME=“name” VALUE=“Apples”>
    <INPUT TYPE=“hidden” NAME=“count” VALUE=“10”>
    <INPUT TYPE=“hidden” NAME=“price” VALUE=“100”>
    <INPUT TYPE=“hidden” NAME=“action” VALUE=“2”>
    <INPUT TYPE=“hidden” NAME=“file” VALUE=“bill.txt”>
    <INPUT TYPE=“hidden” NAME=“destination” VALUE=“store@example.com”>
    <INPUT TYPE=“hidden” NAME=“HIVEDATA” VALUE=“dASas2342SDFSdfsf324234FSsf”>
    <INPUT TYPE=“submit” NAME=“Checkout”>
    </FORM>
  • [0160]
    This form differs from the original form, the form generated by the web server, because a HIVEDATA hidden field has been added. This field is the “signature” of the whole form, encrypted with a key only known to the server that makes the signature tamper-proof. If a user modifies the signature once it is encrypted, the system 20 will detect this modification and prevent any requests bound to the tampered signature.
  • [0161]
    The signature is an abstraction of the content of the form. The abstraction may therefore include the URL the request came from or the page where the form is. In this example, the URL is http://www.example.com/order.html. The abstraction may also include the URL the request is for or the page to where the form is sent. The “action” field in a form tag in this example is http://www.example.com/application/cart.cgi. The abstraction may also include a description of each argument, including name, value, size and if the field is optional or forced. The analysis and abstraction of the form for this example is shown below in Table 2.
    TABLE 2
    Source URL http://www.example.com/order.html
    Destination URL http://www.example.com/application/cart.cgi
    Variable list
    Name Value Size Optional
    name “Apples” 6 NO
    count  “10” 2 NO
    price “100” 3 NO
    action  “2” 1 NO
    file “bill.txt” 8 NO
    Destination “store@example.com” 17 NO
  • [0162]
    This abstraction is serialized and encrypted, preferably using a symmetric algorithm such as Rijndael. The encryption should allow the server to recover the content of the signature once the client sends back the form contents. The result of the encryption are encoded and embedded inside the form, in the form of a “HIVEDATA” hidden tag. An example of the HIVEDATA tag is as follows:
    <INPUT TYPE=“hidden” NAME=“HIVEDATA” VALUE=“dASas2342SDFSdfsf324234FSsf”>
  • [0163]
    Once the system 20 processes the form, the system 20 sends the form to the client, which sees no difference in the appearance of the web page, as “HIVEDATA” is a hidden field.
  • [0164]
    When the client fills the form and sends it back, the system 20 checks the signature sent by the client against the parameters sent by the client. If the user would have sent the request:
    http://www.example.com/application/cart.cgi?name=Apples&count=10&price=100&act
    ion=2&destination=store@example.com&file=/home/httpd/htdocs/index.html&HIVEDAT
    A= dASas2342SDFSdfsf324234FSsf
  • [0165]
    the system 20 detects that the request is not for a “Start Page,” so it looks for a signature in the request. Once the system 20 has the encrypted signature, the system 20 decrypts it using the symmetric key that it used to encrypt the message in the previous request.
  • [0166]
    If the signature has not been tampered, the system 20 proceeds to compare “side by side” the signature contents with the actual contents sent in the request. The system 20 first makes sure that the signature matches the source and destination URLs, so a signature created for a URL can't be used to access a different URL. Once the URLs have been verified to be correct, the system 20 compares the content of the signature with the actual parameters. If the system 20 finds any mismatch, the system 20 signals an error and exits, preventing the application from the attack.
  • [0167]
    In this example, the system 20 finds a mismatch when checking for the parameter “file,” as the signature tells the system 20 to expect:
    file “bill.txt” 8
  • [0168]
    but instead the system 20 finds:
    file “/home/httpd/htdocs/index.html”
  • [0169]
    In the request, since the content of the variable differs from the content expected and located in the signature, the system 20 denies the request. The checks performed by the system 20 include, but are not limited to, variable name, variable content, variable length, and variable required.
  • [0170]
    X. User Interface
  • [0171]
    As mentioned above, the system 20 can be configured according to the desires of a customer. This configuration preferably can occur through a web based interface. For security reasons, the interface authenticates the user by username and password before allowing an administrator to create, modify or delete configurations or to assign username and passwords to delegated configurations in case the owner or administrator of a domain needs/wants to manage its domain security settings. This interface allows an administrator to assign access rights in a set-up where domain names are controlled by multiple entities, as in the case of a hosting company, or to create default settings that will be automatically set in the delegated configurations. The system 20 stores the configuration in a plain-text human readable file which allows administrators to automate tasks, such as bulk-adding domains or users to the system 20.
  • [0172]
    Some exemplary interfaces will be described below in order to explain how the system 20 can be configured. In these interfaces, the system 20 is called a HIVE™ firewall. The system 20 provides many menus which allow users to easily configure the system 20. The interfaces are preferably very intuitive for most people and should not cause problems to edit configurations, view information, etc.
  • [0173]
    A. Login, Selecting and Deleting a Configuration
  • [0174]
    A principal menu bar that is present all the time during the configuration is shown in FIG. 12. This menu bar includes links to “Configs,” “Logs,” “Restart,” “Logout,” and “About.” Through the Configs link, a user can go to a Configs page where the user can edit a configuration. A Logs link provides access to a page where you can see incidences, errors, etc. A Restart link enables the user to restart the server to apply the last changes that was saved and a Logout link return the user to the login page. The About link shows a page with help about developers, project manager, etc.
  • [0175]
    [0175]FIG. 12 is an example of a login page and is the first place that seen when you would like to configure your HIVE firewall. To access this page, the user only need to enter in the port 81 of the machine where the HIVE firewall is installed. To login, the user inputs the Login and Password and, if the user is an administrator, the user has access to all configurations. If the login and password is of a delegated administrator user, then the user can access only his configuration. The Login and Password is only needed at the beginning of a session and is needed every time that a new session is begun.
  • [0176]
    Once the login and password are entered correctly, the system 20 provides the user with the interface shown in FIG. 13 and the user is prepared to edit the desired configuration. The user may have more than one configuration available to choose to edit. As shown in FIG. 14, the administrator is presented with all of the configurations. The desired configuration is selected and then the user can proceed to edit it by pushing the Edit button.
  • [0177]
    The system 20 allows the administrator to edit, delete and create configurations by selecting the Edit, Delete, or New buttons. Thus, to edit a configuration, the user selects a configuration and clicks on the Edit button. If the user wants to delete a configuration, the user select that configuration and pushes the Delete button. To create a new configuration, the user pushes the New button.
  • [0178]
    B. General Configuration
  • [0179]
    By selecting the “Configs” link from the menu bar, the user can change general options of the configuration. To view the actual general configuration, the user clicks on the General tab and receives an interface such as the one shown in FIG. 15. If the configuration is new, the default name is NoNameXX, where ‘XX’ is the number of the configuration.
  • [0180]
    To edit the actual configuration, the user clicks on the Edit button and the user receives the interface shown in FIG. 16. Through this interface, the user can select Config Name to change the name of the configuration, Config Settings to select the “plug and play” configuration termed EZHive. Even though EZHIVE is “plug and play,” this configuration still allows for a great deal of customisation and security settings. A pure “plug and play” configuration option is defined which allows a user with no security knowledge to provide security to the applications hosted on its site, with no need to configure any settings. The default value is NO.
  • [0181]
    The EZ Hive settings are such that the system 20 will only sign objects that will access an application, including forms and links where parameters are passed. The system 20 will not protect pages, nor check for signatures, where no arguments are involved. This allows a server to protect its applications without having to set up start pages. The system 20 will not protect cookies, in order to protect cookies the cookie section of the configuration must be defined. Client side scripting security settings are set to “LOW,” allowing most of Javascript applications to work, while protecting server side applications. EZ Hive should not be used if maximum security is required. EZ Hive defines a set of security settings, but is no substitute of a properly customized server. Also, EZ Hive should not be used if page content is out of the scope of the organization, such as with an ISP that offers web hosting to its users. In this set-up, Except Pages are recommended, as a malicious user could use web access to create pages that once signed will allow him to subvert application security. With the Save, Reset, and Cancel buttons, the user can save the new general configuration, restore the initial values, or cancel the operation.
  • [0182]
    C. Custom Error Configuration
  • [0183]
    By selecting the Custom Error tab, the user is presented with the interface shown in FIG. 17. This interface provides an option menu to redirect a request to another page when an error occurs. Preferably, the redirected page informs the user of what kind of error has occurred. For example, a URL Error should inform the user that an incorrect URL was rentered, a Signature Not Found (Error) informs the user that an attempt was made to access a page that requires a signature but no signature was present, a Signature Mismatch (Error) informs the user that the signature is valid, but did not corresponds with the URL, and a Tamper Error informs the user that the signature is not valid because the signature has been modified or expired.
  • [0184]
    D. Key Configuration
  • [0185]
    By selecting the “Key” tab, the user receives the interface shown in FIG. 18. This interface is dedicated to configure the parameters of the key, such as length and life time, and to display information about the actual and the old key. The Actual Key shows information about the actual key, with this key being used by the system 20 to sign the parameters which are needed to be signed and to decrypt signatures. The Old key shows the same information as Actual key, but about the key which was used before the actual key. The old key was used to decrypt signatures that were signed with it but the life-time of this key has expired and a new key has been generated.
  • [0186]
    The user can generate a new key and can select its length and its life time. To generate a new key, the user selects the Key button and a new key is generated immediately and the actual key data is copied over the old key data. If a new key is generated two or more times in a short time space, the old key possibly might not be useful. It is possible that data was encrypted with this key but that data signed with the “old-old key” cannot be decrypted. When editing a new configuration, a first key must be generated and saved.
  • [0187]
    The user can alter properties of the keys. For example, as shown in FIG. 19, the user can adjust the key Size or as shown in FIG. 20 the user can adjust the Life Time, both of which determine the level protection of your configuration. More security can be provided to a server 26 by increasing the key size. The default value is 128. With key life-time, the opposite is the case; decreasing the life-time of the key actually increases the security of the server 26. The default value is 1 hour.
  • [0188]
    E. Node Configuration
  • [0189]
    [0189]FIG. 21 provides an example of a node configuration interface. Through this interface, a user can specify the address of a new node, edit an existing node, or delete a node. FIG. 22 illustrates the editing of a node 1.2.3.4 and depicts buttons presenting the user with the options to Save, Reset, or Cancel the changes.
  • [0190]
    F. Domains Configuration
  • [0191]
    [0191]FIG. 21 depicts an example of a domains main page interface where a user can set the domain and the IP where it is mapped. A configuration can take more than one domain, and all are showed in the Available Domains fields. A configuration need at least one domain, and the system 20 will prevent a user from saving a configuration unless at least one domain is specified. In the drop-down menu Protocol, a user can select between http:// or https.// protocol. In the Host bar, the user enters the name of the host specifies the port in the Port bar. In the IP bar, the user inputs the IP address to map with the domain and the port. To edit a domain, the user clicks on the Edit button of the configuration and the user receives a domains edit page interface shown in FIG. 24, where the user can change the configuration as desired.
  • [0192]
    G. Start Pages Configuration
  • [0193]
    A user can define URL resources as “Start Pages,” meaning that in order to access the resource no signature is needed. After selecting “Configs” from the menu bar and then the Start Pages tab, the user receives the Start Page main menu, such as the one shown in FIG. 25. The user must define at least a domain and, if one is not specified, the system 20 will block access to the Start Pages tab. Start pages should be configured to be those pages in the website structure that a user can access directly, such as by typing them in the URL bar of a browser which should include the main welcome page and possibly the main page for departments, etc. Since access to Start pages is not restricted by the system, an application should not be placed as a Start page as it will be vulnerable to attacks.
  • [0194]
    To add a new start page, the user selects the domain, types the new start page in the bar at right of the domain, and then clicks the Add button. To delete a start page, the user clicks on the Delete button at right of the start page that should be erased. To edit a start page, the user clicks on the Edit button of the start page that should be edited. An example of an edit page is shown in FIG. 26, where the user is presented with buttons to Save, Reset or Cancel the changes. When editing a new configuration, the user must define at least one start page, after the configuration is saved.
  • [0195]
    H. Except Pages Configuration
  • [0196]
    A user can set-up URL resources as “Exception Pages” for pages that will not be signed before they are sent to the client. After selecting the “Configs” menu item and then the Except Pages tab, the user is presented with the interface shown in FIG. 27. The user must define at least a domain and, if one is not specified, the system 20 will block access to the Except Pages tab. The Except pages are intended to be used in those set-ups where some content is out of the control of the organization, as in an ISP set-up where users can modify their own web pages and signing of those pages could compromise security, as a malicious user could publish a web page with links to malformed requests that could lead to application security problems.
  • [0197]
    To add a new except page, the user selects the domain, types the new Except page in the bar at right of the domain, and then clicks the Add button. To delete an Except page, the user clicks on the Delete button at right of the except page that should be erased. To edit an Except page, the user clicks on the Edit button of the Except page that should be edited. An example of an Except page edit interface is shown in FIG. 28, where the user is presented with buttons to Save, Reset or Cancel the changes
  • [0198]
    I. Default Configuration
  • [0199]
    An example of a default interface is shown in FIG. 29. Through this interface, an administrator can set the size of a bar campoXXX, or a text box, to protect it.
  • [0200]
    J. Admin Mail Configuration
  • [0201]
    The system 20 allows the user to configure the admin mail where alerts and other notices are delivered. The admin mail, for example, is the email address where all incidences registered in the configuration as URL errors, signature mismatch errors, etc. are sent. The Admin Mail interface is specific for a configuration and the user preferably cannot specify multiple e-mails per error. FIG. 30 is an example of an AdminMail interface where the user is presented with buttons to Save, Reset, or Cancel the changes.
  • [0202]
    K. User Configuration
  • [0203]
    By selecting the User tab, the user receives the interface shown in FIG. 31 which is for a new configuration. Through this interface, the user can change the password that allows access to configure the system 20. If the configuration is new, the user first defines the login and password before saving the configuration. Preferably, only the administrator can change the login of a configuration, but other users can access the User tab to change their own passwords, as shown in the interface in FIG. 32. To change the password, the user clicks on the Edit button in User tab. As shown in FIG. 33, the user enters the password in the Password bar and retypes it in the Confirm Password bar. The user then selects one of the Save, Reset, or Cancel buttons.
  • [0204]
    L. Saving the Configuration.
  • [0205]
    The user can save or cancel the changes in the configuration by selecting the Save Config or Cancel buttons presented at the bottom of the interfaces. Thus, to save the changes, the user clicks the Save Config button and to cancel the editing operation, the user pushes the Cancel button. After selecting either one of these buttons, the user is returned to the configurations select page shown in FIG. 13.
  • [0206]
    M. Logs View
  • [0207]
    As mentioned above, the system 20 maintains a log of all errors and other incidences. The system 20 preferably allows users to view the incidences that are produced in your configuration through the Logs page. FIG. 35 illustrates a partial view of this interface, showing a main heading, and FIG. 36 is an example of a logs interface. The logs interface preferably lists the date when the event was produced, an IP address, server name, requested URL, kind of error, and a description of the message.
  • [0208]
    As shown in FIG. 36, within the log itself, the system 20 indicates the success associated with the event. A yellow triangle sign with an exclamation point alerts the user that a custom error occurred. A red circle with an X in it alerts the user about a possible bad configuration of the system, such as a domain which has no configuration associated with it. A information bubble with an “i” in it informs the user of normal success in the system 20, such as a key has expired, a node configuration was reread, or an initialisation of the master node was completed.
  • [0209]
    [0209]FIG. 37 depicts a drop-down menu, forming part of the interface in FIG. 36, that allows a user select the number of logs to view. To see all the logs, the user selects the All item in the drop-down menu. To see only the most recent events, the user can select the Last 10 item. In displaying the events, the system 20 places the most recent logs at the bottom of the page and the oldest at the top. A Reload button reads the file logs again, for a possible new log/s appears, and the Clear Logs button delete the logs file.
  • [0210]
    N. Restarting the Server
  • [0211]
    Finally, before the changes can take effect, the user should restart the system 20. After the user saves the configuration, the user click the Restart icon on the menu bar. If no problems were encountered, the system 20 presents the user with the interface shown in FIG. 38, informing the user that the server was successfully restarted. This interface disappears after the server has completely restarted.
  • [0212]
    The foregoing description of the preferred embodiments of the invention has been presented only for the purpose of illustration and description and is not intended to be exhaustive or to limit the invention to the precise forms disclosed. Many modifications and variations are possible in light of the above teaching.
  • [0213]
    For example, the invention has been described with reference to a client-server environment in which the transmission from the server is a response and the transmission from the client is a request. As explained above, the invention is not limited to a client-server environment where a transmission occurs only after a request. Further, as should be apparent from the description, the system 20 receives the response from the server 26 prior to receiving the request from the client 24. The request in this context therefore does not precede the response.
  • [0214]
    Further, as explained above, the invention is not limited to HTTP applications but may be extended to other protocols. Additionally, even if HTTP is most commonly associated with the WWW, HTTP and thus the invention can be used in other environments as content server, such as XML documents. While HTML was used to provide examples throughout this document, the invention can be applied to other and new languages, such as by plugging in new content parser libraries.
  • [0215]
    Also, while the examples of the invention describe providing a single signature for one piece of content, such as one page, it should be understood that multiple signatures may be embedded within a single page. For example, one page containing multiple forms may be associated with a signature for each of the forms. The request from the client which has a single form would then send only one of the signatures back to the server.
  • [0216]
    The embodiments were chosen and described in order to explain the principles of the invention and their practical application so as to enable others skilled in the art to utilize the invention and various embodiments and with various modifications as are suited to the particular use contemplated.

Claims (20)

    We claim:
  1. 1. A method of signing communications transmitted over a network, comprising:
    intercepting a communication being forwarded to a first entity from a second entity over the network;
    analyzing the communication;
    abstracting the communication to derive parameters for the communication;
    generating a signature associated with the communication based on the parameters of the communication;
    encrypting the signature to generate an encrypted signature;
    combining the encrypted signature with the communication;
    permitting the communication with the encrypted signature to be forwarded to the first entity over the network;
    wherein the encrypted signature enables a response to the communication from the first entity to be validated by the second entity.
  2. 2. The method as set forth in claim 1, wherein combining the encrypted signature with the communication is transparent to the first entity.
  3. 3. The method as set forth in claim 1, further comprising checking if the communication is a start page and wherein intercepting does not involve intercepting the start page.
  4. 4. The method as set forth in claim 1, further comprising checking if the communication is an except page and wherein intercepting does not involve intercepting the except page.
  5. 5. The method as set forth in claim 1, wherein abstracting comprises setting acceptable values for the parameters.
  6. 6. The method as set forth in claim 1, wherein abstracting comprises setting acceptable lengths for the parameters.
  7. 7. The method as set forth in claim 1, wherein abstracting comprises setting acceptable types for the parameters.
  8. 8. The method as set forth in claim 1, wherein abstracting comprises setting cardinality for the parameters.
  9. 9. The method as set forth in claim 1, further comprising adding a tag to the communication, the tag being used to specify an action to perform on the communication.
  10. 10. The method as set forth in claim 1, further comprising:
    intercepting a second communication being forwarded by the first entity to the second entity;
    decrypting a second signature associated with the second communication;
    comparing the second signature with contents of the second communication;
    forwarding the second communication to the second entity only if the second signature corresponds with the contents of the second communication; and
    blocking the second communication from reaching the second entity if the second signature does not correspond with the contents of the second communication.
  11. 11. A method of validating communications received over a network, comprising:
    intercepting a communication being forwarded by a first entity to a second entity;
    decrypting a signature associated with the communication to generate a decrypted signature;
    ascertaining parameters in the communication based on the decrypted signature;
    comparing the decrypted signature and the parameters with actual contents of the communication;
    forwarding the second communication to the second entity if the parameters in the signature correspond with the actual contents of the communication; and
    blocking the communication from reaching the second entity if the parameters in the decrypted signature do not correspond with the contents of the communication.
  12. 12. The method as set forth in claim 1, wherein comparing the parameters with the actual contents comprises checking values of the parameters.
  13. 13. The method as set forth in claim 1, wherein comparing the parameters with the actual contents comprises checking lengths of the parameters.
  14. 14. The method as set forth in claim 1, wherein comparing the parameters with the actual contents comprises checking cardinality of the parameters.
  15. 15. The method as set forth in claim 1, wherein comparing the parameters with the actual contents comprises checking types of the parameters.
  16. 16. A system for providing security to communications over a network, comprising:
    a response interception unit for intercepting a communication being forwarded to a first entity from a second entity over the network;
    a parsing unit for deriving parameters in the communication;
    a signature creation unit for generating a signature associated with the communication based on the parameters of the communication;
    an encryption unit for encrypting the signature to generate an encrypted signature;
    the parsing combining the encrypted signature with the communication and permitting the communication with the encrypted signature to be forwarded to the first entity over the network;
    wherein the encrypted signature enables a response to the communication from the first entity to be validated by the second entity.
  17. 17. The system as set forth in claim 16, further comprising:
    a request interception unit for intercepting a second communication being forwarded by the first entity to the second entity;
    a decryption unit for decrypting a second signature associated with the second communication to generate a decrypted second signature and for ascertaining a second set of parameters in the second communication;
    a signature checking unit for comparing the second set of parameters defined by the decrypted signature with actual contents of the second communication;
    forwarding the second communication to the second entity if the second set of parameters in the decrypted signature correspond with the actual contents of the communication; and
    blocking the second communication from reaching the second entity if the second set of parameters in the decrypted signature do not correspond with the contents of the second communication.
  18. 18. The system as set forth in claim 16, further comprising an error unit for generating errors when the second set of parameters in the decrypted signature do not correspond with the actual contents of the second communication.
  19. 19. A computer-readable medium for storing software for use in validating communications received over a network, the software for performing a method comprising:
    intercepting a communication being forwarded to a first entity from a second entity over the network;
    analyzing the communication;
    abstracting the communication to derive parameters for the communication;
    generating a signature associated with the communication based on the parameters of the communication;
    encrypting the signature to generate an encrypted signature;
    combining the encrypted signature with the communication;
    permitting the communication with the encrypted signature to be forwarded to the first entity over the network;
    wherein the encrypted signature enables a response to the communication from the first entity to be validated by the second entity.
  20. 20. A computer-readable medium for storing software for use in validating communications received over a network, the software for performing a method comprising:
    intercepting a communication being forwarded by a first entity to a second entity;
    decrypting a signature associated with the communication to generate a decrypted signature;
    ascertaining parameters in the communication based on the decrypted signature;
    comparing the decrypted signature and the parameters with actual contents of the communication;
    forwarding the second communication to the second entity if the parameters in the signature correspond with the actual contents of the communication; and
    blocking the communication from reaching the second entity if the second set of parameters in the decrypted signature do not correspond with the contents of the communication.
US09859123 2001-05-16 2001-05-16 Firewalls for providing security in HTTP networks and applications Abandoned US20030051142A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US09859123 US20030051142A1 (en) 2001-05-16 2001-05-16 Firewalls for providing security in HTTP networks and applications

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US09859123 US20030051142A1 (en) 2001-05-16 2001-05-16 Firewalls for providing security in HTTP networks and applications
US13418725 US8689295B2 (en) 2001-05-16 2012-03-13 Firewalls for providing security in HTTP networks and applications

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US13418725 Continuation US8689295B2 (en) 2001-05-16 2012-03-13 Firewalls for providing security in HTTP networks and applications

Publications (1)

Publication Number Publication Date
US20030051142A1 true true US20030051142A1 (en) 2003-03-13

Family

ID=25330099

Family Applications (2)

Application Number Title Priority Date Filing Date
US09859123 Abandoned US20030051142A1 (en) 2001-05-16 2001-05-16 Firewalls for providing security in HTTP networks and applications
US13418725 Expired - Fee Related US8689295B2 (en) 2001-05-16 2012-03-13 Firewalls for providing security in HTTP networks and applications

Family Applications After (1)

Application Number Title Priority Date Filing Date
US13418725 Expired - Fee Related US8689295B2 (en) 2001-05-16 2012-03-13 Firewalls for providing security in HTTP networks and applications

Country Status (1)

Country Link
US (2) US20030051142A1 (en)

Cited By (99)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030169753A1 (en) * 1997-01-23 2003-09-11 Black Alistair D. Fibre channel arbitrated loop bufferless switch circuitry to increase bandwidth without significant increase in cost
US20030174841A1 (en) * 2002-03-15 2003-09-18 Novell Inc. Methods, systems, and data structures for secure data content presentation
US20030225897A1 (en) * 2002-05-30 2003-12-04 Krawetz Neal A. System and method for managing information requests
US20040093407A1 (en) * 2002-11-08 2004-05-13 Char Sample Systems and methods for preventing intrusion at a web host
US20040128538A1 (en) * 2002-12-18 2004-07-01 Sonicwall, Inc. Method and apparatus for resource locator identifier rewrite
US20040168060A1 (en) * 2003-02-24 2004-08-26 Paul Patrick System and method for authenticating a subject
US20040194027A1 (en) * 2002-12-27 2004-09-30 Akira Suzuki Computerized electronic document producing, editing and accessing system for maintaining high-security
US20040243852A1 (en) * 2003-05-28 2004-12-02 Rosenstein Adam H. Method, system and software for state signing of internet resources
US20040260754A1 (en) * 2003-06-20 2004-12-23 Erik Olson Systems and methods for mitigating cross-site scripting
US20040268139A1 (en) * 2003-06-25 2004-12-30 Microsoft Corporation Systems and methods for declarative client input security screening
US20060080439A1 (en) * 2004-10-13 2006-04-13 Andrew Chud Method and system for reducing bandwidth needed to filter requested content
US20060277218A1 (en) * 2005-06-03 2006-12-07 Microsoft Corporation Running internet applications with low rights
US20060288220A1 (en) * 2005-05-02 2006-12-21 Whitehat Security, Inc. In-line website securing system with HTML processor and link verification
US20070005983A1 (en) * 1997-07-24 2007-01-04 Dickinson Robert D Iii E-mail firewall with stored key encryption/decryption
US20070027886A1 (en) * 2005-08-01 2007-02-01 Gent Robert Paul V Publishing data in an information community
US20070033168A1 (en) * 2005-08-08 2007-02-08 David Minogue Agent rank
US20070174420A1 (en) * 2006-01-24 2007-07-26 International Business Machines Corporation Caching of web service requests
US20070300064A1 (en) * 2006-06-23 2007-12-27 Microsoft Corporation Communication across domains
US20070300020A1 (en) * 2002-12-23 2007-12-27 Boggs Mark S Method regarding a data log related to a programmable logic controller (PLC)
US20080001717A1 (en) * 2006-06-20 2008-01-03 Trevor Fiatal System and method for group management
US20080034413A1 (en) * 2006-08-03 2008-02-07 Citrix Systems, Inc. Systems and methods for using a client agent to manage http authentication cookies
US20080034198A1 (en) * 2006-08-03 2008-02-07 Junxiao He Systems and methods for using a client agent to manage http authentication cookies
US20080034417A1 (en) * 2006-08-03 2008-02-07 Junxiao He Systems and methods for using an http-aware client agent
US7353538B2 (en) 2002-11-08 2008-04-01 Federal Network Systems Llc Server resource management, analysis, and intrusion negation
US20080140665A1 (en) * 2005-08-01 2008-06-12 Ido Ariel Sharing of Data Utilizing Push Functionality and Privacy Settings
US20080183887A1 (en) * 2003-06-30 2008-07-31 Microsoft Corporation Client to server streaming of multimedia content using HTTP
US20080250277A1 (en) * 2001-08-13 2008-10-09 Brother Kogyo Kabushiki Kaisha Information transmission system
US20080263358A1 (en) * 2007-04-18 2008-10-23 Christoph Alme System and method for limiting spyware activity
US20080270789A1 (en) * 2001-06-22 2008-10-30 Tumbleweed Communications Corp. Method and system for messaging security
US20080320211A1 (en) * 2007-06-22 2008-12-25 Kabushiki Kaisha Toshiba Nonvolatile memory control device, nonvolatile memory control method, and storage device
US20090067440A1 (en) * 2007-09-07 2009-03-12 Chadda Sanjay Systems and Methods for Bridging a WAN Accelerator with a Security Gateway
US20090106349A1 (en) * 2007-10-19 2009-04-23 James Harris Systems and methods for managing cookies via http content layer
US20090193129A1 (en) * 2008-01-26 2009-07-30 Puneet Agarwal Systems and Methods for Fine Grain Policy Driven Cookie Proxying
US7761605B1 (en) 2001-12-20 2010-07-20 Mcafee, Inc. Embedded anti-virus scanner for a network adapter
US20110162072A1 (en) * 2009-12-29 2011-06-30 Roee Hay Determining the vulnerability of computer software applications to attacks
US20110165889A1 (en) * 2006-02-27 2011-07-07 Trevor Fiatal Location-based operations and messaging
US20110289556A1 (en) * 2010-05-19 2011-11-24 International Business Machines Corporation Method and Apparatus for Serving Content Elements of a Markup Language Document Protected Against Cross-Site Scripting Attack
US20120030763A1 (en) * 2001-10-01 2012-02-02 Adams Phillip M Counter-invasive software system and method
US8185943B1 (en) * 2001-12-20 2012-05-22 Mcafee, Inc. Network adapter firewall system and method
US8219676B2 (en) 2009-06-22 2012-07-10 Citrix Systems, Inc. Systems and methods for web logging of trace data in a multi-core system
US20120253985A1 (en) * 2010-11-08 2012-10-04 Kwift SAS Method and system for extraction and accumulation of shopping data
US8352467B1 (en) 2006-05-09 2013-01-08 Google Inc. Search result ranking based on trust
US20130031599A1 (en) * 2011-07-27 2013-01-31 Michael Luna Monitoring mobile application activities for malicious traffic on a mobile device
US8412675B2 (en) 2005-08-01 2013-04-02 Seven Networks, Inc. Context aware data presentation
US8417823B2 (en) 2010-11-22 2013-04-09 Seven Network, Inc. Aligning data transfer to optimize connections established for transmission over a wireless network
US8438633B1 (en) 2005-04-21 2013-05-07 Seven Networks, Inc. Flexible real-time inbox access
US8484314B2 (en) 2010-11-01 2013-07-09 Seven Networks, Inc. Distributed caching in a wireless network of content delivered for a mobile application over a long-held request
US8494510B2 (en) 2008-06-26 2013-07-23 Seven Networks, Inc. Provisioning applications for a mobile device
US8561086B2 (en) 2005-03-14 2013-10-15 Seven Networks, Inc. System and method for executing commands that are non-native to the native environment of a mobile device
US8606792B1 (en) 2010-02-08 2013-12-10 Google Inc. Scoring authors of posts
US8621075B2 (en) 2011-04-27 2013-12-31 Seven Metworks, Inc. Detecting and preserving state for satisfying application requests in a distributed proxy and cache system
US8689295B2 (en) 2001-05-16 2014-04-01 International Business Machines Corporation Firewalls for providing security in HTTP networks and applications
US8693494B2 (en) 2007-06-01 2014-04-08 Seven Networks, Inc. Polling
US8700728B2 (en) 2010-11-01 2014-04-15 Seven Networks, Inc. Cache defeat detection and caching of content addressed by identifiers intended to defeat cache
US8738050B2 (en) 2007-12-10 2014-05-27 Seven Networks, Inc. Electronic-mail filtering for mobile devices
US8750123B1 (en) 2013-03-11 2014-06-10 Seven Networks, Inc. Mobile device equipped with mobile network congestion recognition to make intelligent decisions regarding connecting to an operator network
US8761756B2 (en) 2005-06-21 2014-06-24 Seven Networks International Oy Maintaining an IP connection in a mobile network
US8775631B2 (en) 2012-07-13 2014-07-08 Seven Networks, Inc. Dynamic bandwidth adjustment for browsing or streaming activity in a wireless network based on prediction of user behavior when interacting with mobile applications
US8774844B2 (en) 2007-06-01 2014-07-08 Seven Networks, Inc. Integrated messaging
US8787947B2 (en) 2008-06-18 2014-07-22 Seven Networks, Inc. Application discovery on mobile devices
US8799410B2 (en) 2008-01-28 2014-08-05 Seven Networks, Inc. System and method of a relay server for managing communications and notification between a mobile device and a web access server
US8812695B2 (en) 2012-04-09 2014-08-19 Seven Networks, Inc. Method and system for management of a virtual network connection without heartbeat messages
US8811952B2 (en) 2002-01-08 2014-08-19 Seven Networks, Inc. Mobile device power management in data synchronization over a mobile network with or without a trigger notification
US8832228B2 (en) 2011-04-27 2014-09-09 Seven Networks, Inc. System and method for making requests on behalf of a mobile device based on atomic processes for mobile network traffic relief
US8838783B2 (en) 2010-07-26 2014-09-16 Seven Networks, Inc. Distributed caching for resource and mobile network traffic management
US8843153B2 (en) 2010-11-01 2014-09-23 Seven Networks, Inc. Mobile traffic categorization and policy for network use optimization while preserving user experience
US8862870B2 (en) 2010-12-29 2014-10-14 Citrix Systems, Inc. Systems and methods for multi-level tagging of encrypted items for additional security and efficient encrypted item determination
US8862657B2 (en) 2008-01-25 2014-10-14 Seven Networks, Inc. Policy based content service
US8861354B2 (en) 2011-12-14 2014-10-14 Seven Networks, Inc. Hierarchies and categories for management and deployment of policies for distributed wireless traffic optimization
US8868753B2 (en) 2011-12-06 2014-10-21 Seven Networks, Inc. System of redundantly clustered machines to provide failover mechanisms for mobile traffic management and network resource conservation
US8874761B2 (en) 2013-01-25 2014-10-28 Seven Networks, Inc. Signaling optimization in a wireless network for traffic utilizing proprietary and non-proprietary protocols
US8886176B2 (en) 2010-07-26 2014-11-11 Seven Networks, Inc. Mobile application traffic optimization
US8903954B2 (en) 2010-11-22 2014-12-02 Seven Networks, Inc. Optimization of resource polling intervals to satisfy mobile device requests
US8909759B2 (en) 2008-10-10 2014-12-09 Seven Networks, Inc. Bandwidth measurement
US8909202B2 (en) 2012-01-05 2014-12-09 Seven Networks, Inc. Detection and management of user interactions with foreground applications on a mobile device in distributed caching
US8934414B2 (en) 2011-12-06 2015-01-13 Seven Networks, Inc. Cellular or WiFi mobile traffic optimization based on public or private network destination
US8966066B2 (en) 2010-11-01 2015-02-24 Seven Networks, Inc. Application and network-based long poll request detection and cacheability assessment therefor
US9002828B2 (en) 2007-12-13 2015-04-07 Seven Networks, Inc. Predictive content delivery
US9009250B2 (en) 2011-12-07 2015-04-14 Seven Networks, Inc. Flexible and dynamic integration schemas of a traffic management system with various network operators for network traffic alleviation
US9021021B2 (en) 2011-12-14 2015-04-28 Seven Networks, Inc. Mobile network reporting and usage analytics system and method aggregated using a distributed traffic optimization system
US9021048B2 (en) 2010-11-01 2015-04-28 Seven Networks, Inc. Caching adapted for mobile application behavior and network conditions
US9043433B2 (en) 2010-07-26 2015-05-26 Seven Networks, Inc. Mobile network traffic coordination across multiple applications
US9053297B1 (en) * 2011-12-06 2015-06-09 Amazon Technologies, Inc. Filtering communications
US9065765B2 (en) 2013-07-22 2015-06-23 Seven Networks, Inc. Proxy server associated with a mobile carrier for enhancing mobile traffic management in a mobile network
US9077630B2 (en) 2010-07-26 2015-07-07 Seven Networks, Inc. Distributed implementation of dynamic wireless traffic policy
US9084105B2 (en) 2011-04-19 2015-07-14 Seven Networks, Inc. Device resources sharing for network resource conservation
US9161258B2 (en) 2012-10-24 2015-10-13 Seven Networks, Llc Optimized and selective management of policy deployment to mobile clients in a congested network to prevent further aggravation of network congestion
US9173128B2 (en) 2011-12-07 2015-10-27 Seven Networks, Llc Radio-awareness of mobile device for sending server-side control signals using a wireless network optimized transport protocol
US9203864B2 (en) 2012-02-02 2015-12-01 Seven Networks, Llc Dynamic categorization of applications for network access in a mobile network
US20150358384A1 (en) * 2012-01-06 2015-12-10 Apple Inc. Intelligent Data Delivery and Storage Based on Data Characteristics
US9241314B2 (en) 2013-01-23 2016-01-19 Seven Networks, Llc Mobile device with application or context aware fast dormancy
US9307493B2 (en) 2012-12-20 2016-04-05 Seven Networks, Llc Systems and methods for application management of mobile device radio state promotion and demotion
US9326189B2 (en) 2012-02-03 2016-04-26 Seven Networks, Llc User as an end point for profiling and optimizing the delivery of content and data in a wireless network
US9325662B2 (en) 2011-01-07 2016-04-26 Seven Networks, Llc System and method for reduction of mobile network traffic used for domain name system (DNS) queries
US9407608B2 (en) 2005-05-26 2016-08-02 Citrix Systems, Inc. Systems and methods for enhanced client side policy
US9438559B1 (en) * 2003-01-09 2016-09-06 Jericho Systems Corporation System for managing access to protected resources
US9621666B2 (en) 2005-05-26 2017-04-11 Citrix Systems, Inc. Systems and methods for enhanced delta compression
US9692725B2 (en) 2005-05-26 2017-06-27 Citrix Systems, Inc. Systems and methods for using an HTTP-aware client agent
US9832095B2 (en) 2011-12-14 2017-11-28 Seven Networks, Llc Operation modes for mobile traffic optimization and concurrent management of optimized and non-optimized traffic

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8898766B2 (en) * 2012-04-10 2014-11-25 Spotify Ab Systems and methods for controlling a local application through a web page

Citations (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5680461A (en) * 1995-10-26 1997-10-21 Sun Microsystems, Inc. Secure network protocol system and method
US5692124A (en) * 1996-08-30 1997-11-25 Itt Industries, Inc. Support of limited write downs through trustworthy predictions in multilevel security of computer network communications
US5960177A (en) * 1995-05-19 1999-09-28 Fujitsu Limited System for performing remote operation between firewall-equipped networks or devices
US5978787A (en) * 1997-02-28 1999-11-02 Oracle Corporation Report server caching
US6101543A (en) * 1996-10-25 2000-08-08 Digital Equipment Corporation Pseudo network adapter for frame capture, encapsulation and encryption
US6131162A (en) * 1997-06-05 2000-10-10 Hitachi Ltd. Digital data authentication method
US6212636B1 (en) * 1997-05-01 2001-04-03 Itt Manufacturing Enterprises Method for establishing trust in a computer network via association
US6311278B1 (en) * 1998-09-09 2001-10-30 Sanctum Ltd. Method and system for extracting application protocol characteristics
US20020007453A1 (en) * 2000-05-23 2002-01-17 Nemovicher C. Kerry Secured electronic mail system and method
US20020091928A1 (en) * 2000-10-03 2002-07-11 Thaddeus Bouchard Electronically verified digital signature and document delivery system and method
US20020095507A1 (en) * 2001-01-17 2002-07-18 Jerdonek Robert A. Methods for pre-authentication of users using one-time passwords
US20020143885A1 (en) * 2001-03-27 2002-10-03 Ross Robert C. Encrypted e-mail reader and responder system, method, and computer program product
US20020152378A1 (en) * 1999-12-30 2002-10-17 Wallace Clyde Riley Key-based secure network user states
US20030046533A1 (en) * 2000-04-25 2003-03-06 Olkin Terry M. Secure E-mail system
US20030191970A1 (en) * 1997-09-26 2003-10-09 Worldcom, Inc. Secure server architecture for web based data management
US6643650B1 (en) * 2000-05-09 2003-11-04 Sun Microsystems, Inc. Mechanism and apparatus for using messages to look up documents stored in spaces in a distributed computing environment
US6735694B1 (en) * 1997-11-21 2004-05-11 International Business Machines Corporation Method and system for certifying authenticity of a web page copy
US6760844B1 (en) * 1999-07-30 2004-07-06 Unisys Corporation Secure transactions sessions

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6141749A (en) 1997-09-12 2000-10-31 Lucent Technologies Inc. Methods and apparatus for a computer network firewall with stateful packet filtering
US6253374B1 (en) * 1998-07-02 2001-06-26 Microsoft Corporation Method for validating a signed program prior to execution time or an unsigned program at execution time
US6363479B1 (en) * 1998-07-22 2002-03-26 Entrust Technologies Limited System and method for signing markup language data
US7620980B1 (en) 1999-07-21 2009-11-17 Sun Microsystems, Inc. Secure data broker
US20030051142A1 (en) 2001-05-16 2003-03-13 Hidalgo Lluis Mora Firewalls for providing security in HTTP networks and applications

Patent Citations (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5960177A (en) * 1995-05-19 1999-09-28 Fujitsu Limited System for performing remote operation between firewall-equipped networks or devices
US5680461A (en) * 1995-10-26 1997-10-21 Sun Microsystems, Inc. Secure network protocol system and method
US5692124A (en) * 1996-08-30 1997-11-25 Itt Industries, Inc. Support of limited write downs through trustworthy predictions in multilevel security of computer network communications
US6101543A (en) * 1996-10-25 2000-08-08 Digital Equipment Corporation Pseudo network adapter for frame capture, encapsulation and encryption
US5978787A (en) * 1997-02-28 1999-11-02 Oracle Corporation Report server caching
US6212636B1 (en) * 1997-05-01 2001-04-03 Itt Manufacturing Enterprises Method for establishing trust in a computer network via association
US6131162A (en) * 1997-06-05 2000-10-10 Hitachi Ltd. Digital data authentication method
US20030191970A1 (en) * 1997-09-26 2003-10-09 Worldcom, Inc. Secure server architecture for web based data management
US6735694B1 (en) * 1997-11-21 2004-05-11 International Business Machines Corporation Method and system for certifying authenticity of a web page copy
US6311278B1 (en) * 1998-09-09 2001-10-30 Sanctum Ltd. Method and system for extracting application protocol characteristics
US6760844B1 (en) * 1999-07-30 2004-07-06 Unisys Corporation Secure transactions sessions
US20020152378A1 (en) * 1999-12-30 2002-10-17 Wallace Clyde Riley Key-based secure network user states
US20030046533A1 (en) * 2000-04-25 2003-03-06 Olkin Terry M. Secure E-mail system
US6643650B1 (en) * 2000-05-09 2003-11-04 Sun Microsystems, Inc. Mechanism and apparatus for using messages to look up documents stored in spaces in a distributed computing environment
US20020007453A1 (en) * 2000-05-23 2002-01-17 Nemovicher C. Kerry Secured electronic mail system and method
US20020091928A1 (en) * 2000-10-03 2002-07-11 Thaddeus Bouchard Electronically verified digital signature and document delivery system and method
US20020095507A1 (en) * 2001-01-17 2002-07-18 Jerdonek Robert A. Methods for pre-authentication of users using one-time passwords
US20020143885A1 (en) * 2001-03-27 2002-10-03 Ross Robert C. Encrypted e-mail reader and responder system, method, and computer program product

Cited By (183)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030169753A1 (en) * 1997-01-23 2003-09-11 Black Alistair D. Fibre channel arbitrated loop bufferless switch circuitry to increase bandwidth without significant increase in cost
US20070005983A1 (en) * 1997-07-24 2007-01-04 Dickinson Robert D Iii E-mail firewall with stored key encryption/decryption
US8607042B2 (en) 1997-07-24 2013-12-10 Axway Inc. E-mail firewall with stored key encryption/decryption
US8255683B2 (en) 1997-07-24 2012-08-28 Axway Inc. E-mail firewall with policy-based cryptosecurity
US20070245416A1 (en) * 1997-07-24 2007-10-18 Dickinson Robert D Iii E-mail firewall with stored key encryption/decryption
USRE43302E1 (en) 1997-07-24 2012-04-03 Axway, Inc. E-mail firewall with stored key encryption/decryption
US8689295B2 (en) 2001-05-16 2014-04-01 International Business Machines Corporation Firewalls for providing security in HTTP networks and applications
US20080270789A1 (en) * 2001-06-22 2008-10-30 Tumbleweed Communications Corp. Method and system for messaging security
US8407780B2 (en) 2001-06-22 2013-03-26 Axway Inc. Method and system for messaging security
US20080250277A1 (en) * 2001-08-13 2008-10-09 Brother Kogyo Kabushiki Kaisha Information transmission system
US8626858B2 (en) 2001-08-13 2014-01-07 Brother Kogyo Kabushiki Kaisha Information transmission system
US9811408B2 (en) 2001-08-13 2017-11-07 Brother Kogyo Kabushiki Kaisha Information transmission system
US8161124B2 (en) * 2001-08-13 2012-04-17 Brother Kogyo Kabushiki Kaisha Information transmission system
US8732515B2 (en) * 2001-10-01 2014-05-20 Phillip M. Adams Counter-invasive software system and method
US20120030763A1 (en) * 2001-10-01 2012-02-02 Adams Phillip M Counter-invasive software system and method
US9876818B2 (en) 2001-12-20 2018-01-23 McAFEE, LLC. Embedded anti-virus scanner for a network adapter
US8185943B1 (en) * 2001-12-20 2012-05-22 Mcafee, Inc. Network adapter firewall system and method
US8627443B2 (en) 2001-12-20 2014-01-07 Mcafee, Inc. Network adapter firewall system and method
US9055098B2 (en) 2001-12-20 2015-06-09 Mcafee, Inc. Embedded anti-virus scanner for a network adapter
US7761605B1 (en) 2001-12-20 2010-07-20 Mcafee, Inc. Embedded anti-virus scanner for a network adapter
US8811952B2 (en) 2002-01-08 2014-08-19 Seven Networks, Inc. Mobile device power management in data synchronization over a mobile network with or without a trigger notification
US20030174841A1 (en) * 2002-03-15 2003-09-18 Novell Inc. Methods, systems, and data structures for secure data content presentation
US8060629B2 (en) * 2002-05-30 2011-11-15 Hewlett-Packard Development Company, L.P. System and method for managing information requests
US20030225897A1 (en) * 2002-05-30 2003-12-04 Krawetz Neal A. System and method for managing information requests
US8397296B2 (en) 2002-11-08 2013-03-12 Verizon Patent And Licensing Inc. Server resource management, analysis, and intrusion negation
US20080222727A1 (en) * 2002-11-08 2008-09-11 Federal Network Systems, Llc Systems and methods for preventing intrusion at a web host
WO2004044698A3 (en) * 2002-11-08 2004-08-26 Fed Network Systems Llc Systems and methods for preventing intrusion at a web host
US20040093407A1 (en) * 2002-11-08 2004-05-13 Char Sample Systems and methods for preventing intrusion at a web host
US8001239B2 (en) 2002-11-08 2011-08-16 Verizon Patent And Licensing Inc. Systems and methods for preventing intrusion at a web host
US8763119B2 (en) 2002-11-08 2014-06-24 Home Run Patents Llc Server resource management, analysis, and intrusion negotiation
US7353538B2 (en) 2002-11-08 2008-04-01 Federal Network Systems Llc Server resource management, analysis, and intrusion negation
US7376732B2 (en) * 2002-11-08 2008-05-20 Federal Network Systems, Llc Systems and methods for preventing intrusion at a web host
US20080133749A1 (en) * 2002-11-08 2008-06-05 Federal Network Systems, Llc Server resource management, analysis, and intrusion negation
US8429301B2 (en) 2002-12-18 2013-04-23 Ewinwin, Inc. Method and apparatus for resource locator identifier rewrite
WO2004057445A2 (en) * 2002-12-18 2004-07-08 Sonicwall, Inc. Method and apparatus for resource locator identifier rewrite
US20100235543A1 (en) * 2002-12-18 2010-09-16 Gmuender John E Method and apparatus for resource locator identifier rewrite
US7412539B2 (en) 2002-12-18 2008-08-12 Sonicwall, Inc. Method and apparatus for resource locator identifier rewrite
US9094365B2 (en) 2002-12-18 2015-07-28 Dell Software Inc. Method and apparatus for resource locator identifier rewrite
US20040128538A1 (en) * 2002-12-18 2004-07-01 Sonicwall, Inc. Method and apparatus for resource locator identifier rewrite
WO2004057445A3 (en) * 2002-12-18 2004-12-09 Sonicwall Inc Method and apparatus for resource locator identifier rewrite
US7752336B2 (en) 2002-12-18 2010-07-06 Sonicwall, Inc. Method and apparatus for resource locator identifier rewrite
US7856539B2 (en) * 2002-12-23 2010-12-21 Siemens Industry, Inc. Method regarding a data log related to a programmable logic controller (PLC)
US20070300020A1 (en) * 2002-12-23 2007-12-27 Boggs Mark S Method regarding a data log related to a programmable logic controller (PLC)
US20040194027A1 (en) * 2002-12-27 2004-09-30 Akira Suzuki Computerized electronic document producing, editing and accessing system for maintaining high-security
US9251193B2 (en) 2003-01-08 2016-02-02 Seven Networks, Llc Extending user relationships
US9438559B1 (en) * 2003-01-09 2016-09-06 Jericho Systems Corporation System for managing access to protected resources
US7610618B2 (en) * 2003-02-24 2009-10-27 Bea Systems, Inc. System and method for authenticating a subject
US20040168060A1 (en) * 2003-02-24 2004-08-26 Paul Patrick System and method for authenticating a subject
WO2004107132A2 (en) * 2003-05-28 2004-12-09 Caymas Systems, Inc. Method, system and software for state signing of internet resources
WO2004107132A3 (en) * 2003-05-28 2006-04-13 Caymas Systems Inc Method, system and software for state signing of internet resources
US20070271599A1 (en) * 2003-05-28 2007-11-22 Citrix Silicon Valley Systems and methods for state signing of internet resources
US7861087B2 (en) * 2003-05-28 2010-12-28 Citrix Systems, Inc. Systems and methods for state signing of internet resources
US20040243852A1 (en) * 2003-05-28 2004-12-02 Rosenstein Adam H. Method, system and software for state signing of internet resources
US20040260754A1 (en) * 2003-06-20 2004-12-23 Erik Olson Systems and methods for mitigating cross-site scripting
US20040268139A1 (en) * 2003-06-25 2004-12-30 Microsoft Corporation Systems and methods for declarative client input security screening
US7716345B2 (en) * 2003-06-30 2010-05-11 Microsoft Corporation Client to server streaming of multimedia content using HTTP
US20080189430A1 (en) * 2003-06-30 2008-08-07 Microsoft Corporation Client-to-Server Streaming of Multimedia Content Using HTTP
US20080183887A1 (en) * 2003-06-30 2008-07-31 Microsoft Corporation Client to server streaming of multimedia content using HTTP
US7644175B2 (en) * 2003-06-30 2010-01-05 Microsoft Corporation Client-to-server streaming of multimedia content using HTTP
US20060080439A1 (en) * 2004-10-13 2006-04-13 Andrew Chud Method and system for reducing bandwidth needed to filter requested content
US8561086B2 (en) 2005-03-14 2013-10-15 Seven Networks, Inc. System and method for executing commands that are non-native to the native environment of a mobile device
US8438633B1 (en) 2005-04-21 2013-05-07 Seven Networks, Inc. Flexible real-time inbox access
US8839412B1 (en) 2005-04-21 2014-09-16 Seven Networks, Inc. Flexible real-time inbox access
US20060288220A1 (en) * 2005-05-02 2006-12-21 Whitehat Security, Inc. In-line website securing system with HTML processor and link verification
US9692725B2 (en) 2005-05-26 2017-06-27 Citrix Systems, Inc. Systems and methods for using an HTTP-aware client agent
US9407608B2 (en) 2005-05-26 2016-08-02 Citrix Systems, Inc. Systems and methods for enhanced client side policy
US9621666B2 (en) 2005-05-26 2017-04-11 Citrix Systems, Inc. Systems and methods for enhanced delta compression
US20060277218A1 (en) * 2005-06-03 2006-12-07 Microsoft Corporation Running internet applications with low rights
US8078740B2 (en) 2005-06-03 2011-12-13 Microsoft Corporation Running internet applications with low rights
US8761756B2 (en) 2005-06-21 2014-06-24 Seven Networks International Oy Maintaining an IP connection in a mobile network
US8468126B2 (en) 2005-08-01 2013-06-18 Seven Networks, Inc. Publishing data in an information community
US20070027886A1 (en) * 2005-08-01 2007-02-01 Gent Robert Paul V Publishing data in an information community
US8412675B2 (en) 2005-08-01 2013-04-02 Seven Networks, Inc. Context aware data presentation
US20080140665A1 (en) * 2005-08-01 2008-06-12 Ido Ariel Sharing of Data Utilizing Push Functionality and Privacy Settings
US8296293B2 (en) 2005-08-08 2012-10-23 Google Inc. Agent rank
US20110213770A1 (en) * 2005-08-08 2011-09-01 Google Inc. Agent rank
US7565358B2 (en) * 2005-08-08 2009-07-21 Google Inc. Agent rank
US9002856B2 (en) 2005-08-08 2015-04-07 Google Inc. Agent rank
US20070033168A1 (en) * 2005-08-08 2007-02-08 David Minogue Agent rank
US8224826B2 (en) 2005-08-08 2012-07-17 Google Inc. Agent rank
US20070174420A1 (en) * 2006-01-24 2007-07-26 International Business Machines Corporation Caching of web service requests
US20110165889A1 (en) * 2006-02-27 2011-07-07 Trevor Fiatal Location-based operations and messaging
US9055102B2 (en) 2006-02-27 2015-06-09 Seven Networks, Inc. Location-based operations and messaging
US8352467B1 (en) 2006-05-09 2013-01-08 Google Inc. Search result ranking based on trust
US8818995B1 (en) 2006-05-09 2014-08-26 Google Inc. Search result ranking based on trust
US20080001717A1 (en) * 2006-06-20 2008-01-03 Trevor Fiatal System and method for group management
US8489878B2 (en) 2006-06-23 2013-07-16 Microsoft Corporation Communication across domains
US8335929B2 (en) 2006-06-23 2012-12-18 Microsoft Corporation Communication across domains
US8185737B2 (en) 2006-06-23 2012-05-22 Microsoft Corporation Communication across domains
US20070300064A1 (en) * 2006-06-23 2007-12-27 Microsoft Corporation Communication across domains
US8392977B2 (en) 2006-08-03 2013-03-05 Citrix Systems, Inc. Systems and methods for using a client agent to manage HTTP authentication cookies
US20080034198A1 (en) * 2006-08-03 2008-02-07 Junxiao He Systems and methods for using a client agent to manage http authentication cookies
US8561155B2 (en) 2006-08-03 2013-10-15 Citrix Systems, Inc. Systems and methods for using a client agent to manage HTTP authentication cookies
US20080034413A1 (en) * 2006-08-03 2008-02-07 Citrix Systems, Inc. Systems and methods for using a client agent to manage http authentication cookies
US9544285B2 (en) 2006-08-03 2017-01-10 Citrix Systems, Inc. Systems and methods for using a client agent to manage HTTP authentication cookies
US9948608B2 (en) 2006-08-03 2018-04-17 Citrix Systems, Inc. Systems and methods for using an HTTP-aware client agent
US8943304B2 (en) 2006-08-03 2015-01-27 Citrix Systems, Inc. Systems and methods for using an HTTP-aware client agent
US20080034417A1 (en) * 2006-08-03 2008-02-07 Junxiao He Systems and methods for using an http-aware client agent
US9727710B2 (en) * 2007-04-18 2017-08-08 Mcafee, Inc. System and method for limiting spyware activity
US9130974B2 (en) * 2007-04-18 2015-09-08 Mcafee, Inc. System and method for limiting spyware activity
US20150379246A1 (en) * 2007-04-18 2015-12-31 Mcafee Inc. System and Method for Limiting Spyware Activity
US20080263358A1 (en) * 2007-04-18 2008-10-23 Christoph Alme System and method for limiting spyware activity
US8805425B2 (en) 2007-06-01 2014-08-12 Seven Networks, Inc. Integrated messaging
US8693494B2 (en) 2007-06-01 2014-04-08 Seven Networks, Inc. Polling
US8774844B2 (en) 2007-06-01 2014-07-08 Seven Networks, Inc. Integrated messaging
US20080320211A1 (en) * 2007-06-22 2008-12-25 Kabushiki Kaisha Toshiba Nonvolatile memory control device, nonvolatile memory control method, and storage device
US8908700B2 (en) 2007-09-07 2014-12-09 Citrix Systems, Inc. Systems and methods for bridging a WAN accelerator with a security gateway
US20090067440A1 (en) * 2007-09-07 2009-03-12 Chadda Sanjay Systems and Methods for Bridging a WAN Accelerator with a Security Gateway
US20090106349A1 (en) * 2007-10-19 2009-04-23 James Harris Systems and methods for managing cookies via http content layer
US7925694B2 (en) 2007-10-19 2011-04-12 Citrix Systems, Inc. Systems and methods for managing cookies via HTTP content layer
US8738050B2 (en) 2007-12-10 2014-05-27 Seven Networks, Inc. Electronic-mail filtering for mobile devices
US9002828B2 (en) 2007-12-13 2015-04-07 Seven Networks, Inc. Predictive content delivery
US8862657B2 (en) 2008-01-25 2014-10-14 Seven Networks, Inc. Policy based content service
US8090877B2 (en) 2008-01-26 2012-01-03 Citrix Systems, Inc. Systems and methods for fine grain policy driven cookie proxying
US9059966B2 (en) 2008-01-26 2015-06-16 Citrix Systems, Inc. Systems and methods for proxying cookies for SSL VPN clientless sessions
US20090193129A1 (en) * 2008-01-26 2009-07-30 Puneet Agarwal Systems and Methods for Fine Grain Policy Driven Cookie Proxying
US8769660B2 (en) 2008-01-26 2014-07-01 Citrix Systems, Inc. Systems and methods for proxying cookies for SSL VPN clientless sessions
US8838744B2 (en) 2008-01-28 2014-09-16 Seven Networks, Inc. Web-based access to data objects
US8799410B2 (en) 2008-01-28 2014-08-05 Seven Networks, Inc. System and method of a relay server for managing communications and notification between a mobile device and a web access server
US8787947B2 (en) 2008-06-18 2014-07-22 Seven Networks, Inc. Application discovery on mobile devices
US8494510B2 (en) 2008-06-26 2013-07-23 Seven Networks, Inc. Provisioning applications for a mobile device
US8909759B2 (en) 2008-10-10 2014-12-09 Seven Networks, Inc. Bandwidth measurement
US8219676B2 (en) 2009-06-22 2012-07-10 Citrix Systems, Inc. Systems and methods for web logging of trace data in a multi-core system
US9210184B2 (en) * 2009-12-29 2015-12-08 International Business Machines Corporation Determining the vulnerability of computer software applications to attacks
US20110162072A1 (en) * 2009-12-29 2011-06-30 Roee Hay Determining the vulnerability of computer software applications to attacks
US9846728B1 (en) 2010-02-08 2017-12-19 Google Inc. Scoring authors of posts
US8606792B1 (en) 2010-02-08 2013-12-10 Google Inc. Scoring authors of posts
US9442989B1 (en) 2010-02-08 2016-09-13 Google Inc. Scoring authors of posts
US8983974B1 (en) 2010-02-08 2015-03-17 Google Inc. Scoring authors of posts
US8856874B2 (en) * 2010-05-19 2014-10-07 International Business Machines Corporation Method and apparatus for serving content elements of a markup language document protected against cross-site scripting attack
US20110289556A1 (en) * 2010-05-19 2011-11-24 International Business Machines Corporation Method and Apparatus for Serving Content Elements of a Markup Language Document Protected Against Cross-Site Scripting Attack
US9407713B2 (en) 2010-07-26 2016-08-02 Seven Networks, Llc Mobile application traffic optimization
US9077630B2 (en) 2010-07-26 2015-07-07 Seven Networks, Inc. Distributed implementation of dynamic wireless traffic policy
US8886176B2 (en) 2010-07-26 2014-11-11 Seven Networks, Inc. Mobile application traffic optimization
US8838783B2 (en) 2010-07-26 2014-09-16 Seven Networks, Inc. Distributed caching for resource and mobile network traffic management
US9049179B2 (en) 2010-07-26 2015-06-02 Seven Networks, Inc. Mobile network traffic coordination across multiple applications
US9043433B2 (en) 2010-07-26 2015-05-26 Seven Networks, Inc. Mobile network traffic coordination across multiple applications
US8782222B2 (en) 2010-11-01 2014-07-15 Seven Networks Timing of keep-alive messages used in a system for mobile network resource conservation and optimization
US8843153B2 (en) 2010-11-01 2014-09-23 Seven Networks, Inc. Mobile traffic categorization and policy for network use optimization while preserving user experience
US8484314B2 (en) 2010-11-01 2013-07-09 Seven Networks, Inc. Distributed caching in a wireless network of content delivered for a mobile application over a long-held request
US9021048B2 (en) 2010-11-01 2015-04-28 Seven Networks, Inc. Caching adapted for mobile application behavior and network conditions
US8700728B2 (en) 2010-11-01 2014-04-15 Seven Networks, Inc. Cache defeat detection and caching of content addressed by identifiers intended to defeat cache
US8966066B2 (en) 2010-11-01 2015-02-24 Seven Networks, Inc. Application and network-based long poll request detection and cacheability assessment therefor
US20120253985A1 (en) * 2010-11-08 2012-10-04 Kwift SAS Method and system for extraction and accumulation of shopping data
US8539040B2 (en) 2010-11-22 2013-09-17 Seven Networks, Inc. Mobile network background traffic data management with optimized polling intervals
US8417823B2 (en) 2010-11-22 2013-04-09 Seven Network, Inc. Aligning data transfer to optimize connections established for transmission over a wireless network
US9100873B2 (en) 2010-11-22 2015-08-04 Seven Networks, Inc. Mobile network background traffic data management
US8903954B2 (en) 2010-11-22 2014-12-02 Seven Networks, Inc. Optimization of resource polling intervals to satisfy mobile device requests
US8862870B2 (en) 2010-12-29 2014-10-14 Citrix Systems, Inc. Systems and methods for multi-level tagging of encrypted items for additional security and efficient encrypted item determination
US9819647B2 (en) 2010-12-29 2017-11-14 Citrix Systems, Inc. Systems and methods for multi-level tagging of encrypted items for additional security and efficient encrypted item determination
US9325662B2 (en) 2011-01-07 2016-04-26 Seven Networks, Llc System and method for reduction of mobile network traffic used for domain name system (DNS) queries
US9084105B2 (en) 2011-04-19 2015-07-14 Seven Networks, Inc. Device resources sharing for network resource conservation
US9300719B2 (en) 2011-04-19 2016-03-29 Seven Networks, Inc. System and method for a mobile device to use physical storage of another device for caching
US8832228B2 (en) 2011-04-27 2014-09-09 Seven Networks, Inc. System and method for making requests on behalf of a mobile device based on atomic processes for mobile network traffic relief
US8621075B2 (en) 2011-04-27 2013-12-31 Seven Metworks, Inc. Detecting and preserving state for satisfying application requests in a distributed proxy and cache system
US20130031599A1 (en) * 2011-07-27 2013-01-31 Michael Luna Monitoring mobile application activities for malicious traffic on a mobile device
US8984581B2 (en) * 2011-07-27 2015-03-17 Seven Networks, Inc. Monitoring mobile application activities for malicious traffic on a mobile device
US8868753B2 (en) 2011-12-06 2014-10-21 Seven Networks, Inc. System of redundantly clustered machines to provide failover mechanisms for mobile traffic management and network resource conservation
US8934414B2 (en) 2011-12-06 2015-01-13 Seven Networks, Inc. Cellular or WiFi mobile traffic optimization based on public or private network destination
US8977755B2 (en) 2011-12-06 2015-03-10 Seven Networks, Inc. Mobile device and method to utilize the failover mechanism for fault tolerance provided for mobile traffic management and network/device resource conservation
US9053297B1 (en) * 2011-12-06 2015-06-09 Amazon Technologies, Inc. Filtering communications
US9208123B2 (en) 2011-12-07 2015-12-08 Seven Networks, Llc Mobile device having content caching mechanisms integrated with a network operator for traffic alleviation in a wireless network and methods therefor
US9009250B2 (en) 2011-12-07 2015-04-14 Seven Networks, Inc. Flexible and dynamic integration schemas of a traffic management system with various network operators for network traffic alleviation
US9173128B2 (en) 2011-12-07 2015-10-27 Seven Networks, Llc Radio-awareness of mobile device for sending server-side control signals using a wireless network optimized transport protocol
US9277443B2 (en) 2011-12-07 2016-03-01 Seven Networks, Llc Radio-awareness of mobile device for sending server-side control signals using a wireless network optimized transport protocol
US9832095B2 (en) 2011-12-14 2017-11-28 Seven Networks, Llc Operation modes for mobile traffic optimization and concurrent management of optimized and non-optimized traffic
US8861354B2 (en) 2011-12-14 2014-10-14 Seven Networks, Inc. Hierarchies and categories for management and deployment of policies for distributed wireless traffic optimization
US9021021B2 (en) 2011-12-14 2015-04-28 Seven Networks, Inc. Mobile network reporting and usage analytics system and method aggregated using a distributed traffic optimization system
US9131397B2 (en) 2012-01-05 2015-09-08 Seven Networks, Inc. Managing cache to prevent overloading of a wireless network due to user activity
US8909202B2 (en) 2012-01-05 2014-12-09 Seven Networks, Inc. Detection and management of user interactions with foreground applications on a mobile device in distributed caching
US20150358384A1 (en) * 2012-01-06 2015-12-10 Apple Inc. Intelligent Data Delivery and Storage Based on Data Characteristics
US9575968B2 (en) * 2012-01-06 2017-02-21 Apple Inc. Intelligent data delivery and storage based on data characteristics
US9203864B2 (en) 2012-02-02 2015-12-01 Seven Networks, Llc Dynamic categorization of applications for network access in a mobile network
US9326189B2 (en) 2012-02-03 2016-04-26 Seven Networks, Llc User as an end point for profiling and optimizing the delivery of content and data in a wireless network
US8812695B2 (en) 2012-04-09 2014-08-19 Seven Networks, Inc. Method and system for management of a virtual network connection without heartbeat messages
US8775631B2 (en) 2012-07-13 2014-07-08 Seven Networks, Inc. Dynamic bandwidth adjustment for browsing or streaming activity in a wireless network based on prediction of user behavior when interacting with mobile applications
US9161258B2 (en) 2012-10-24 2015-10-13 Seven Networks, Llc Optimized and selective management of policy deployment to mobile clients in a congested network to prevent further aggravation of network congestion
US9307493B2 (en) 2012-12-20 2016-04-05 Seven Networks, Llc Systems and methods for application management of mobile device radio state promotion and demotion
US9241314B2 (en) 2013-01-23 2016-01-19 Seven Networks, Llc Mobile device with application or context aware fast dormancy
US9271238B2 (en) 2013-01-23 2016-02-23 Seven Networks, Llc Application or context aware fast dormancy
US8874761B2 (en) 2013-01-25 2014-10-28 Seven Networks, Inc. Signaling optimization in a wireless network for traffic utilizing proprietary and non-proprietary protocols
US8750123B1 (en) 2013-03-11 2014-06-10 Seven Networks, Inc. Mobile device equipped with mobile network congestion recognition to make intelligent decisions regarding connecting to an operator network
US9065765B2 (en) 2013-07-22 2015-06-23 Seven Networks, Inc. Proxy server associated with a mobile carrier for enhancing mobile traffic management in a mobile network

Also Published As

Publication number Publication date Type
US8689295B2 (en) 2014-04-01 grant
US20120260315A1 (en) 2012-10-11 application

Similar Documents

Publication Publication Date Title
Pearson et al. Trusted computing platforms: TCPA technology in context
Georgiev et al. The most dangerous code in the world: validating SSL certificates in non-browser software
Sun et al. The devil is in the (implementation) details: an empirical analysis of OAuth SSO systems
US5826029A (en) Secured gateway interface
De Keukelaere et al. Smash: secure component model for cross-domain mashups on unmodified browsers
US7249369B2 (en) Post data processing
US7124203B2 (en) Selective cache flushing in identity and access management systems
US6757685B2 (en) Process for executing a downloadable service receiving restrictive access rights to at least one profile file
US6311269B2 (en) Trusted services broker for web page fine-grained security labeling
US7080077B2 (en) Localized access
US6216153B1 (en) Non-extensible thin server that generates user interfaces via browser
US6351810B2 (en) Self-contained and secured access to remote servers
Jackson et al. Forcehttps: protecting high-security web sites from network attacks
US7134137B2 (en) Providing data to applications from an access system
US7313823B2 (en) Anti-alternation system for web-content
US7464162B2 (en) Systems and methods for testing whether access to a resource is authorized based on access information
US8332627B1 (en) Mutual authentication
US20020116642A1 (en) Logging access system events
US7543146B1 (en) Using digital certificates to request client consent prior to decrypting SSL communications
US8321921B1 (en) Method and apparatus for providing authentication and encryption services by a software as a service platform
US6453353B1 (en) Role-based navigation of information resources
US20100024036A1 (en) System and Methods Providing Secure Workspace Sessions
US20020099671A1 (en) Query string processing
US20110283110A1 (en) Secure Communications
US20070282951A1 (en) Cross-domain solution (CDS) collaborate-access-browse (CAB) and assured file transfer (AFT)

Legal Events

Date Code Title Description
AS Assignment

Owner name: GRUPO S21SEC GESTION, S.A., SPAIN

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:HIDALGO, LLUIS MORA;LLEONART, XABIER PANADERO;REEL/FRAME:012246/0608

Effective date: 20010918