Patent Application
20070299984
The invention and the illustrated embodiments may be better understood, and the numerous objects, advantages, and features of the present invention and illustrated embodiments will become apparent to those skilled in the art by reference to the accompanying drawings. In the drawings, like reference numerals refer to like parts throughout the various views of the non-limiting and non-exhaustive embodiments of the present invention, and wherein:
a) shows a response and a request and the corresponding steps in accordance with one embodiment of the present invention;
Reference will now be made in detail to some specific embodiments of the invention including the best modes contemplated by the inventors for carrying out the invention. Examples of these specific embodiments are illustrated in the accompanying drawings. While the invention is described in conjunction with these specific embodiments, it will be understood that it is not intended to limit the invention to the described embodiments. On the contrary, it is intended to cover alternatives, modifications, and equivalents as may be included within the spirit and scope of the invention as defined by the appended claims. In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention. The present invention may be practiced without some or all of these specific details. In other instances, well known process operations have not been described in detail in order not to unnecessarily obscure the present invention.
In this specification and the appended claims, the singular forms “a,” “an,” and “the” include plural reference unless the context clearly dictates otherwise. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood to one of ordinary skill in the art to which this invention belongs.
Those skilled in the art will appreciate that the invention may be practiced with many computer system configurations, including personal computers, hand-held devices, multi-processor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers and the like. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.
Although not required, the invention will be described in the general context of computer-executable instructions, such as program modules, being executed by a personal computer. Generally, program modules include routines, programs, objects, components, data structures and the like that perform particular tasks or implement particular abstract data types.
With reference to
Also connected to system bus 1006 are a system memory 108 and a host bridge 110. Host bridge 110 connects I/O bus 112 to system bus 106, relaying and/or transforming data transactions from one bus to the other. The system bus 106 and the I/O bus 112 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. The system memory includes read-only memory (ROM) 114 and random access memory (RAM) 116. A basic input/output system 118 (BIOS), containing the basic routines that help to transfer information between elements within the personal computer 100, such as during start-up, is stored in ROM 114.
In the exemplary embodiment, the system 100 may further include a graphics adapter 120 connected to I/O bus 112, receiving user interface information for display device 122. A user may enter commands and information into the system 100 through input devices 130 such as a conventional mouse, a key board 130, or the like. Other input devices 134 may include a microphone, joystick, game pad, satellite dish, scanner or the like. The devices may be connected via an Industry Standard Architecture (ISA) bridge 126, or a Universal Serial Bus (USB) bridge 132 to I/O bus 112, respectively. PCI device such as a modem 138 may be connected to the I/O bus 112 via PCI bridge 136.
The exemplary system 100 may further include a hard disk drive 124 for reading from and writing to a hard disk, connected to the I/O bus via a hard disk interface 140, and an optical disk drive 142 for reading from or writing to a removable optical disk 144 such as a CD-ROM or other optical media. The hard disk drive 124, magnetic disk drive 28, and optical disk drive 142 may be connected to the I/O bus 112 by a hard disk drive interface 140, and an optical drive interface 146, respectively. The drives and their associated computer-readable media provide non-volatile storage of computer readable instructions, data structures, program modules and other data for the system 100. Although the exemplary environment described herein employs a hard disk 124 and a removable optical disk 144, it should be appreciated by those skilled in the art that other types of computer readable media which can store data that is accessible by a computer, such as magnetic cassettes, flash memory cards, digital video disks, Bernoulli cartridges, random access memories (RAMs), read-only memories (ROMs) and the like may also be used in the exemplary operating environment.
A number of program modules may be stored on the hard disk 124, optical disk 144, ROM 118 or RAM 116, including an operating system 148, one or more application programs 150, other program modules 152 and program data 154.
The exemplary system 100 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 156. The remote computer 156 may be another personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the exemplary system 100. The logical connections depicted in
When used in a networking environment, the exemplary system 100 is connected to the local network 158 through a network interface or adapter 160. The exemplary system 100 may use the modem 138 or other means for establishing communications 162 over a wide area network such as the Internet. In a networked environment, program modules depicted relative to the exemplary system 100, or portions thereof, may be stored in the remote memory storage device. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.
The exemplary embodiment shown in
A Web portal arranges Web content into a portal page and provides a common access point to disparate, but related databases and applications of, for example, a business.
A Web portal utilizes re-usable application components such as portlets to access Web accessible information, for example, files published on the corporate intranet to reports on data managed by corporate applications. A portlet is a Web component, which processes and generates dynamic Web content. Portlets may summarize, promote or provide basic access to information resources for users who of business information. Custom portlets can be created by any application or information resource “provider”, based on published API specifications. Developers can create procedures as PL/SQL packages or Java classes.
Web clients interact with portlets through request and response implemented by the portal. Web clients interact with content produced by portlets, for example by submitting forms or following links, sending requests to the portal. The Web portal then forwards the request to the portlets targeted by the user's interactions.
For a Web application 218 such as a business intelligence application to function properly, it maybe advantageous or necessary to include an impromptu component 310, to customize the user's experience by integrating services from different applications in the same portal page. The term “impromptu component” is intended to include application components added by the user of a Web application, or installed by other means, for example automatically, to supplement the functionality of the Web application. An example of an impromptu component is a portlet. The impromptu component Ci 310 is managed by an Impromptu Component Manager (ICM) 312. The ICM 312 may manage more than one impromptu components. In case that the impromptu component Ci 310 is a portlet, the impromptu component manager may be, for example, a portal service. The dispatcher 308 dispatches the request 220 destined to the impromptu component Ci 310 through an indication of destination, for example, “destination=icm&subdestination=ci”. In this non-limiting example, a request is first sent to the Impromptu Component Manager 312 which then dispatches the request to the impromptu component Ci. The expression <target> may be used to represent the indication of destination, for example, “destination=icm&subdestination=ci”. Target is intended to include the indication of the destination of the request when dispatched to an impromptu component of the Web application.
Referring to
The entry point 216, which as a non-limiting example may be a validation engine or more specifically an application firewall, may have a set of validation rules 404 for validating the request. An exemplary method for validating request using validation rules is described in the U.S. patent application Ser. No. 11/187,268 titled “Rich Web Application Input Validation”, filed on Jul. 22, 2005, the entirety of which is hereby incorporated by reference.
The validation rule 404, however, may not include the parameters of an impromptu component 310 in an existing acceptance validation rule, or may include the parameters in an existing rejection validation rule. Therefore, the request directed at an impromptu component may be rejected.
Because of the nature of impromptu components, updating the validation rules may be impractical, sometimes impossible. For example, existing application components C1 302 and C2 306 may have an acceptance validation rule which requires a parameter “home” to have a value of either A or B or C, and the impromptu component Ci 310 has a parameter “home” with the value of 478. It would be impractical or impossible to change the existing acceptance validation rule to accept new parameters of an impromptu component.
Referring to
A target may be signed by using a cryptographic Keyed-Hash Message Authentication Code (HMAC). Standard for the cryptographic keyed HMAC may be found at: http:///csrc.nist.gov/publications/fips/fips198/fips-198a.pdf, the entirety of the document is incorporated hereby by reference. An exemplary method for protecting Web application data is described in the U.S. patent application Ser. No. 11/187,309 titled “Opaque Cryptographic Web Application Data Protection”, filed on Jul. 22, 2005, the entirety of which is hereby incorporated by reference. In one of simple cases, a signed target may comprise, for example, the original target, and the calculated HMAC value for the original target. The calculated HMAC value and the original target may be concatenated to a signed target.
The verification of signed target occurs in the entry point 216. The entry point 216 then performs the same HMAC logic as for the signing. The resulting HMAC value must match the HMAC value that is in the signed target. The two HMACs match only if the target in the request is the exact same as in the response.
It should be apparent to a person skilled in the art that other methods of digital signing may also be used to sign the target. For example, RSA public key digital signature.
b) shows an example of a target.
An additional advantage of Base64 encoding is that the “&” character normally used to delimit the parameters will be replaced, as for example in: “http://www.example.com/m/n/dispatch.exe?<Base64target>&a=main&b=john&c=468”.
Base64 encoding is often associated with a rearrangement of the names and values of a plurality of parameters, the rearrangement produces a new unique parameter. This rearrangement as discussed before is one form of the transformation. When grouping the target parameters into a new unique parameter value, the “&” character must be encoded or replaced. The uniqueness of the parameter of the target is in the context of the request or the response.
Using the example of “http://www.example.com/m/n/dispatch.exe?icmtarget=<target>&a=main&b=john&c=468” where <target>=“destination=icm&subdestination=ci”, “destination” and “subdestination” may be considered as the parameters for the dispatcher 308. The impromptu component, for example, Ci 310 may provide information about travel agencies and has already a parameter “destination=paris”. Without an encoding or other transformation of the characters, the two parameters would conflict and thus render the response ambiguous.
In accordance with another aspect of the present invention, to avoid a conflict, because for example the parameters have the same name, between the parameters of an impromptu component 310 and the parameters of a dispatcher 308, found in a request 220, a transformation, for example, a Base64 encoding is used for parameters of a request 220. Referring to
Another benefit of this approach is that malicious attack may be prevented. Referring to
A request 804 with transformed data, keeps the entire data including the injected destination invisible to the dispatcher, thus preventing the dispatching of the request with signed target to an unintended application component.
Web services make dynamic content of the business intelligence available through the Service-Oriented Architecture (SOA). Web services may be provided in an interoperable manner to carry out a complex business transaction. The standards on which web services are based include Hypertext Transfer Protocol (HTTP), Simple Object Access Protocol (SOAP), Extensible Markup Language (XML), Web Services Description Language (WSDL), and Universal Description, Discovery, and Integration(UDDI). SOAP is an XML-based protocol used to send messages for invoking methods in a distributed environment and is used in a preferred embodiment. Therefore, the client of the present invention may be a client using HTTP, SOAP, XML, WSDL, and UDDI.
The invention can be implemented in digital electronic circuitry, or in computer hardware, firmware, software, or in combinations thereof. Apparatus of the invention can be implemented in a computer program product tangibly embodied in a machine-readable storage device for execution by a programmable processor; and method actions can be performed by a programmable processor executing a program of instructions to perform functions of the invention by operating on input data and generating output. The invention can be implemented advantageously in one or more computer programs that are executable on a programmable system including at least one programmable processor coupled to receive data and instructions from, and to transmit data and instructions to, a data storage system, at least one input device, and at least one output device. Each computer program can be implemented in a high-level procedural or object oriented programming language, or in assembly or machine language if desired; and in any case, the language can be a compiled or interpreted language. Suitable processors include, by way of example, both general and special purpose microprocessors. Generally, a processor will receive instructions and data from a read-only memory and/or a random access memory. Generally, a computer will include one or more mass storage devices for storing data files. Storage devices suitable for tangibly embodying computer program instructions and data include all forms of non-volatile memory, including by way of example semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM disks. Any of the foregoing can be supplemented by, or incorporated in, ASICs (application-specific integrated circuits). Further, a computer data signal representing the software code which may be embedded in a carrier wave may be transmitted via a communication network. Such a computer readable memory and a computer data signal are also within the scope of the present invention, as well as the hardware, software and the combination thereof.
The present invention has been described with regard to one or more embodiments. However, it will be apparent to persons skilled in the art that a number of variations and modifications can be made without departing from the scope of the invention as defined in the claims.
