Techniques for application security

Patent metadata

Field	Value
Publication number	US-10693901-B1
Application number	US-201615337723-A
Country	US
Kind code	B1
Filing date	Oct 28, 2016
Priority date	Oct 28, 2015
Publication date	Jun 23, 2020
Grant date	Jun 23, 2020

Abstract

Software developers previously dealt with each security threat by incorporating a corresponding set of code lines into individual web applications, which required significant amount of time and code lines for each security threat and the resulting code was hard to maintain or modify. One aspect of the present invention addresses common security concerns in a standardized and centralized approach. All user requests for web applications are centralized to a single input and validated by a Web Security Filter. Selected layers of validation filters (e.g., ESAPI and AntiSamy) could be sequentially applied to the user requests, and those filters can be individually maintained/modified as discrete modules. Not only is this centralized, holistic approach to application security effective against a majority of malicious attacks, it is also saves a lot of time and costs in code development and maintenance.

First claim

The invention claimed is:

1. A server system with a defense mechanism against security threats on application layer, comprising:
at least one application server hosting one or more applications accessible to authorized users;
a single communication interface to which all user requests to any of the hosted applications are routed; and
a security appliance coupled to the single communication interface and configured to:
receive the user requests, and
screen each of the user requests with a selected set of discrete validation filters by sequentially applying the filters to each of the user requests, wherein one of the discrete validation filters applies one or more text-based pattern matching rules to each of the user requests and another one of the discrete validation filters applies application-specific input validation rules to each of the user requests;

wherein each of the discrete validation filters are modularly configured to handle a corresponding security threat and being individually modifiable without affecting another validation filter corresponding to another security threat, and
wherein when one of the user requests is a file upload request, the one of the discrete validation filters that applies the one or more text-based pattern matching rules checks a file type against a list of acceptable file formats and a list of disallowed formats based on both file header and extension.

2. The server system according to claim 1 , wherein at least some of the user requests are HTTP or HTTPS requests.

3. The server system according to claim 1 , wherein one of the selected set of discrete validation filters comprises at least one rule for input validation in connection with the one or more applications.

4. The server system according to claim 3 , wherein the at least one rule for input validation is based on one or more whitelists of threat or attack patterns.

5. The server system according to claim 1 , wherein one of the selected set of discrete validation filters comprises at least one rule for output encoding in connection with the one or more applications.

6. The server system according to claim 1 , wherein one of the selected set of discrete validation filters comprises data cleansing.

7. A method for defending against security threats on application layer in a server system, the method comprising:
intercepting all incoming HTTP or HTTPS requests directed to one or more applications hosted on a protected web server or database in a server system, and
examining each of the incoming HTTP or HTTPS requests by sequentially:
using at least a first one of a set of discrete validation filters to apply one or more text-based pattern matching rules to each of the incoming HTTP or HTTPS requests,
using at least a second one of the set of discrete validation filters to apply application-specific input validation rules to each of the incoming HTTP or HTTPS requests; and

forwarding, based on the examining, a screened subset of the incoming HTTP or HTTPS requests to the protected web server or database,
wherein each of the discrete validation filters is modularly configured to handle a corresponding security threat and is individually modifiable without affecting another validation filter corresponding to another security threat, and
wherein when one of the incoming HTTP or HTTPS requests is a file upload request, the applying the one or more text-based pattern matching rules includes checking a file type against a list of acceptable file formats and a list of disallowed formats based on both file header and extension.

8. The method of claim 7 , further comprising:
applying Bayesian inference to refine results of the application of the text-based pattern matching rules and the application of the application-specific input validation rules.

9. The method of claim 7 , further comprising:
applying a time series statistical modeling to a group of responses returned by the protected web server or database over one or more predetermined time periods.

10. A non-transitory computer readable medium having stored thereon instructions for defending against security threats on application layer in a server system comprising machine executable code which when executed by a processor, causes the processor to:
intercept all incoming HTTP or HTTPS requests directed to one or more applications hosted on a protected web server or database in a server system, and
examine each of the incoming HTTP or HTTPS requests by sequentially:
using at least a first one of a set of discrete validation filters to apply one or more text-based pattern matching rules to each of the incoming HTTP or HTTPS requests,
using at least a second one of the set of discrete validation filters to apply application-specific input validation rules to each of the incoming HTTP or HTTPS requests; and

forwarding, based on the examining, a screened subset of the incoming HTTP or HTTPS requests to the protected web server or database,
wherein each of the discrete validation filters is modularly configured to handle a corresponding security threat and is individually modifiable without affecting another validation filter corresponding to another security threat, and
wherein when one of the incoming HTTP or HTTPS requests is a file upload request, the applying the one or more text-based pattern matching rules includes checking a file type against a list of acceptable file formats and a list of disallowed formats based on both file header and extension.

11. The non-transitory computer readable medium of claim 10 , wherein when executed by the processor, the processor is further configured to apply Bayesian inference to refine results of the application of the text-based pattern matching rules and the application of the application-specific input validation rules.

12. The non-transitory computer readable medium of claim 10 , wherein when executed by the processor, the processor is further configured to apply a time series statistical modeling to a group of responses returned by the protected web server or database over one or more predetermined time periods.

Assignees

• Jpmorgan Chase Bank Na

Inventors

• Chan Jacky C T
• So Boris T H
• Rattray Ainsley G

Classifications

• H04L67/02 Primary

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/1458

  Denial of Service · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/0263

  Rule management · CPC title