Application layer security method and system

摘要

A system for implementing an application security layer between an application and a distrusted computer environment comprises: means for receiving an application operation request, wherein the operation request comprises one or more parameters; an identification module for identifying the one or more parameters; and a router module for routing each of the one or more parameters to one or a plurality of application paths according to a routing scheme. A method for protecting an application from executing an illegal or harmful operation request received from a distrusted environment comprises: applying at least one pipes to an application-layer contents of an operation request to determine if the operation request is illegal or harmful to an environment of the application and preventing the application from executing an illegal or harmful operation request. The at least one pipe can be: a database driven pipe involving database operations and is aimed at finding patterns that show malicious intentions in a database request; a deterministic type pipe inspecting incoming operation requests for known vulnerability patterns. A HTML driven pipe ensures that an application operates as designed and implemented by the application owner; an application-node blocking pipe restricts remote user requests from entering application paths that are designated as restricted by an application owner; a cookie-based pipe protecting client side cookies from being modified or manipulated by the user and/or a SOAP pipe protecting web services from servicing harmful client requests or preventing requests for services that remote clients or a specific client is unauthorized to call. The pipe checks each outgoing reply for its parameters names and values, then validates the next client based on a comparison between the incoming and outgoing parameters. A pipe blocks distrusted operation requests from being forwarded to a trusted environment or zone within a trusted network. A pipe validates an incoming parameter value according to pre-defined expression rules.