Security for WAP servers

Abstract

A method and system for improving the security and control of internet/network web application processes, such as web applications. The invention enables validation of requests from web clients before the request reaches a web application server. Incoming web client requests are compared to an application model that may include an allowed navigation path within an underlying web application. Requests inconsistent with the application model are blocked before reaching the application server. The invention may also verify that application state data sent to application servers has not been inappropriately modified. Furthermore, the invention enables application models to be automatically generated by employing, for example, a web crawler to probe target applications. Once a preliminary application model is generated it can be operated in a training mode. An administrator may tune the application model by adding a request that was incorrectly marked as non-compliant to the application model.

What is claimed as new and desired to be protected by Letters Patent of the United States is: 
     
       1. A network device for managing a communication over a network, comprising:
 a transceiver configured to intercept an incoming message from a client device and an outgoing message from a server device, wherein an application resides on the server device; and   a processor configured to perform actions including:
 intercepting a request from the client device to the application residing on the server device for content from the application; 
 determining when the request for content is compliant based on a comparison of hidden fields by performing actions, comprising:
 examining the request for an encrypted state token; 
 decrypting the encrypted state token; 
 extracting from the state token a hidden field; 
 comparing the extracted hidden field to values of hidden fields from an application state data store; and 
 when the extracted hidden field is determined to be non-compliant based on the comparison, blocking the request from being forwarded to the application; and 
 
 determining whether the request for content is compliant by comparing the request to a list of allowable complaint requests determined by a current state of the client device with the application and an application model of the application, the application model being automatically generated in part based on a probe of interactions with the application, the probe of interactions being separately generated by the network device absent use of the incoming message from the client device or a response from the server device to the incoming message to obtain responses to the probes that are used to identify at least the list of allowable compliant requests including allowable navigation paths within the application; 
 when the request for content is determined to be compliant based on the comparison of the request, forwarding the request for the content to the application; and 
 when the request is determined to be non-compliant based on the comparison of the request, blocking the request from being forwarded to the application. 
   
     
     
       2. The network device of  claim 1 , wherein the processor is configured to perform actions, further including:
 receiving a response to the request from the application;   storing information about selected hidden fields that are not visible within a display of the response;   forwarding the response to the client device;   receiving another request from the client device, the other request being in response to the received response;   examining the other request to determine when it includes the selected hidden fields and when the included selected hidden fields are modified from the stored selected hidden fields;   when the other request is absent of the selected hidden fields or when one of the hidden fields in modified from the stored selected hidden fields, determining that the other request is noncompliant; and   when the other request is noncompliant, blocking forwarding of the other request to the application.   
     
     
       3. The network device of  claim 1 , wherein comparing the request further comprises:
 examining the request to determine when a field within the request has been altered improperly; and   when a field is determined to be altered improperly, determining that the request is noncompliant, and inhibiting forwarding of the request to the application.   
     
     
       4. The network device of  claim 1 , wherein the application model is tunable during a training period based on a collection of non-compliant requests obtained during the training period. 
     
     
       5. The network device of  claim 1 , wherein comparing the request further comprises:
 examining the request for selected visible fields;   comparing values in the selected visible fields to values obtained by the network device from a prior communication to the client device from the application; and   when the values in the selected visible fields are determined to be non-compliant based on the comparison, blocking the request from being forwarded to the application.   
     
     
       6. A system for managing a communication over a network, comprising:
 a client device configured to provide requests and receive responses over the network;   a server device that is configured to host a network based application; and   a security server device that is interposed between the client device and server device and is configured to perform actions, including:
 intercepting a request from the client device to the application residing on the server device for content from the application; 
 selectively forwarding the request to the application based on determining that the request for content is compliant based on a comparison of the request to compliant requests that are determined from a current state of the client device with the application and an application model of the application device, the application model being automatically generated in part based on a probe of interactions with the application, the probe of interactions being separately generated from the intercepted request or a response to the intercepted request to obtain responses to the probe that are used to identify a list of allowable complaint requests usable by the application model including allowable navigation paths within the application; 
 intercepting the response to the request from the application on the server; 
   extracting values from selected fields within the response, at least one selected field being a hidden field that is not currently visible:
 forwarding the response to the client device forwarding the response to the client device, wherein an extracted value is extracted from the hidden field within the response, and wherein forwarding the response further comprises: 
   generating an encrypted state token associated with the extracted value from the hidden field; and   inserting the encrypted state token into the response:
 within a hidden form field of the response, when the response includes a form; 
 wherein a query string of the response, when the response includes a link; or 
 within a Uniform Resource Locator (URL) path within the response, when the response includes a URL; and 
   receiving a second request from the client device; and   selectively forwarding the second request to the application based on a comparison of information within the second request to the extracted values from the selected fields within the response.   
     
     
       7. The system of  claim 6 , wherein selectively forwarding the second request further comprises:
 examining the second request for an encrypted state token within the hidden form field; and   when a value of the state token when decrypted is determined to be different from the extracted values, blocking the second request from being forwarded to the application.   
     
     
       8. The system of  claim 6 , wherein extracting values from selected fields further comprises extracting values from visible fields that include a user selection from the visible field. 
     
     
       9. The system of  claim 6 , wherein selectively forwarding the request further comprises:
 determining when a field within the request is improperly modified based on information stored from a prior response to the client device from the application; and   when the field is determined to be improperly modified, blocking the forwarding of the request to the application.   
     
     
       10. The system of  claim 6 , selectively forwarding the request further comprise:
 extracting from a state token within the request a hidden field value;   comparing the extracted hidden field value to a value of hidden fields from an application state data store; and   when the extracted hidden field value is determined to be non-compliant based on the comparison, blocking the request from being forwarded to the application.   
     
     
       11. A non-transitory machine readable storage medium that is configured to store instructions and data that when installed on a machine that is interposed between a client device and a server device enable the machine to perform actions, including:
 intercepting a request from the client device to the application residing on the server device for content from the application;   selectively forwarding the request for content to the application based on determining that the request is compliant based on a comparison of the request to allowable requests determined by a current state of the client device with the application and a model of the application; device, the model being automatically generated in part based on probe interactions with the application, the probe of interactions being separately generated by the machine absent use of the intercepted request or a response to the intercepted request to obtain responses to the probe that are used to identify at least the list of allowable compliant requests usable to generate the model including allowable navigation paths within the application;   intercepting the response to the request from the application hosted on the server   extracting values from selected fields within the response, the selected fields including at least one hidden field that is not visible;   forwarding the response to the client device, wherein an extracted value is extracted from the hidden field within the response, and wherein forwarding the response further comprises:
 generating an encrypted state token associated with the extracted value from the hidden field; and 
 inserting the encrypted state token into the response:
 within a hidden form field of the response, when the response includes a form; 
 within a query string of the response, when the response includes a link; or 
 within a Uniform Resource Locator (URL) path within the response, when the response includes a URL; and 
 
   receiving a second request from the client device; and   selectively forwarding the second request to the application based on a comparison of information within the second request to the extracted values from the selected fields within the response.   
     
     
       12. The non-transitory machine readable storage medium of  claim 11 , wherein selectively forwarding the request further comprises:
 determining when a field within the request is improperly modified based on information stored from a prior response to the client device from the application; and   when the field is determined to be improperly modified, blocking the forwarding of the request to the application.   
     
     
       13. The non-transitory machine readable storage medium of  claim 11 , wherein the selected fields comprises at least one visible field. 
     
     
       14. The non-transitory machine readable storage medium of  claim 11 , wherein the selected fields includes a visible field having at least one user selectable option provided by the application. 
     
     
       15. The non-transitory machine readable storage medium of  claim 14 , wherein selectively forwarding further comprises: comparing the user selectable option provided by the application to a provided user selected option in the second request, and when the provided user selected option in the second request is determined to be inconsistent with the user selectable option provided by the application, blocking forwarding of the second request to the application. 
     
     
       16. The non-transitory machine readable storage medium of  claim 11 , wherein the model is automatically generated by:
 examining a set of test requests to the application;   monitoring responses to the test requests;   recording the test requests, monitored responses, and a current state of another client device with the application based on a sequence of test requests; and   identifying a set of allowable requests for a given state of the other client device with the application based on the test requests and monitored responses.   
     
     
       17. A network device for managing communication over a network, comprising:
 a transceiver configured to be capable of intercepting an incoming message from a client device and an outgoing message from a server device, wherein an application resides on the server device; and   one or more processors configured to be capable of performing actions, including:   intercepting a request in an incoming message, from the client device to the application residing on the server device, for content from the application;   automatically generating an application model of the application in part based on a probe of interactions with the application, the probe of interactions being separately generated by the network device without employing the incoming message or a response from the server device to the incoming message to obtain responses to the probes, wherein the probe responses are used to identify at least a list of allowable compliant requests including allowable navigation paths within the application, and wherein the list is based in part on a current state of the client device with the application and the application model;   determining that the request for content is compliant based on a comparison of information in the request with the application model of the application by performing actions, comprising:   examining the request for a protected state token;   unprotecting the protected state token;   extracting a first value from the unprotected state token;   comparing the extracted first value to data in an application state data store, or comparing the request to the list of allowable compliant requests, to indicate that the request is either compliant or non-compliant with the application model; and   forwarding the request for the content to the application based on the request being compliant with the application model;   blocking the request from being forwarded to the application based on the request being non-compliant with the application model;   operating the application in a training mode that records one or more requests for content from the application that are determined to be non-compliant; and   adding the one or more non-compliant requests to the application model.    
     
     
       18. The network device of claim 17, wherein the protected state token is encrypted and the unprotected state token is unencrypted.  
     
     
       19. The network device of claim 17, wherein the one or more processors are further configured for blocking the non-compliant request further comprises one of recording the non-compliant request, or discarding the non-compliant-request.  
     
     
       20. The network device of claim 17, wherein the one or more processors are further configured for blocking the request further comprises responding to the request with an indication that the request was unsuccessful.  
     
     
       21. The network device of claim 17, wherein the one or more processors are further configured for actions further comprising employing one or more of a pattern or a regular expression to automatically identify each non-compliant request that is to be discarded without being reviewed.  
     
     
       22. The network device of claim 17, wherein the probe of interactions is automatically performed by one or more software programs.  
     
     
       23. The network device of claim 17, wherein the application model is employed to control a flow of the navigation paths to one or more defined pages.  
     
     
       24. A system for managing communication over a network, comprising: a client device that is configured to capable of providing requests and receive responses over the network;
 a server device that is configured to be capable of hosting a network based application; and   a security server device that is configured to be capable of performing actions, including:   intercepting a request in an incoming message, from the client device to the application residing on the server device, for content from the application;   automatically generating an application model of the application in part based on a probe of interactions with the application, the probe of interactions being separately generated by the network device without employing the incoming message or a response from the server device to the incoming message to obtain responses to the probes, wherein the probe responses are used to identify at least a list of allowable compliant requests including allowable navigation paths within the application, and wherein the list is based in part on a current state of the client device with the application and the application model;   determining that the request for content is compliant based on a comparison of information in the request with the application model of the application by performing actions, comprising:   examining the request for a protected state token;   unprotecting the protected state token;   extracting a first value from the unprotected state token;   comparing the extracted first value to data in an application state data store, or comparing the request to the list of allowable compliant requests, to indicate that the request is either compliant or non-compliant with the application model; and   forwarding the request for the content to the application based on the request being compliant with the application model;   blocking the request from being forwarded to the application based on the request being non-compliant with the application model;   operating the application in a training mode that records one or more requests for content from the application that are determined to be non-compliant; and   adding the one or more non-compliant requests to the application model.    
     
     
       25. The system of claim 24, wherein the protected state token is encrypted and the unprotected state token is unencrypted.  
     
     
       26. The system of claim 24, wherein the one or more processors are further configured for blocking the non-compliant request further comprises one of recording the non-compliant request, or discarding the non-compliant request.  
     
     
       27. The system of claim 24, wherein the one or more processors are further configured for blocking of the non-compliant request further comprises responding to the request with an indication that the request was unsuccessful.  
     
     
       28. The system of claim 24, wherein the one or more processors are further configured for actions further comprising employing one or more of a pattern or a regular expression to automatically identify each non-compliant request that is to be discarded without being reviewed.  
     
     
       29. The system of claim 24, wherein the probe of interactions is automatically performed by one or more software programs.  
     
     
       30. The system of claim 24, wherein the application model is employed to control a flow of the navigation paths to one or more defined pages.  
     
     
       31. A non-transitory machine readable storage medium that is configured to store instructions and data for managing communication over a network, wherein when the instructions and data are installed on a computer that is enabled to execute the instructions to perform actions, comprising:
 intercepting a request in an incoming message, from a client device to an application residing on a server device, for content from the application;   automatically generating an application model of the application in part based on a probe of interactions with the application, the probe of interactions being separately generated by the network device without employing the incoming message or a response from the server device to the incoming message to obtain responses to the probes, wherein the probe responses are used to identify at least a list of allowable compliant requests including allowable navigation paths within the application, and wherein the list is based in part on a current state of the client device with the application and the application model;   determining that the request for content is compliant based on a comparison of information in the request with the application model of the application by performing actions, comprising:   examining the request for a protected state token;   unprotecting the protected state token;   extracting a first value from the unprotected state token;   comparing the extracted first value to data in an application state data store, or comparing the request to the list of allowable compliant requests, to indicate that the request is either compliant or non-compliant with the application model; and   forwarding the request for the content to the application based on the request being compliant with the application model;   blocking the request from being forwarded to the application based on the request being non-compliant with the application model;   operating the application in a training mode that records one or more requests for content from the application that are determined to be non-compliant; and   adding the one or more non-compliant requests to the application model.    
     
     
       32. A method for managing communication over a network, wherein a computer that is configured to enable execution of the method, performs actions, comprising:
 intercepting a request in an incoming message, from a client device to an application residing on a server device, for content from the application;   automatically generating an application model of the application in part based on a probe of interactions with the application, the probe of interactions being separately generated by the network device without employing the incoming message or a response from the server device to the incoming message to obtain responses to the probes, wherein the probe responses are used to identify at least a list of allowable compliant requests including allowable navigation paths within the application, and wherein the list is based in part on a current state of the client device with the application and the application model;   determining that the request for content is compliant based on a comparison of information in the request with the application model of the application by performing actions, comprising:   examining the request for a protected state token;   unprotecting the protected state token;   extracting a first value from the unprotected state token;   comparing the extracted first value to data in an application state data store, or comparing the request to the list of allowable compliant requests, to indicate that the request is either compliant or non-compliant with the application model; and   forwarding the request for the content to the application based on the request being compliant with the application model;   blocking the request from being forwarded to the application based on the request being non-compliant with the application model;   operating the application in a training mode that records one or more requests for content from the application that are determined to be non-compliant; and   adding the one or more non-compliant requests to the application model.