Abstract:
The invention detects changes in one or more parameter values sent by a server through user space. In one embodiment, a Web server communicates with a client over the Internet. Before sending the parameter value or values to the client, the server performs a pre-processing step, creating a formatted data string. The server then transmits the formatted data string to the client in a URL or a cookie. When the client returns the formatted data string and other data to the server, the server performs a post-processing step to verify that the parameter value or values have not been tampered with. This round trip technique is a departure from approaches that merely detect tampering of data as it passes between two nodes of a network.

Description:
FIELD OF THE INVENTION 
     The invention relates generally to computers and digital processing systems, and more specifically to a system and method providing improved error detection related to transmission of data over a communications link. 
     BACKGROUND OF THE INVENTION 
     The development and expanded use of the Internet in recent decades has provided both opportunities and risks for users. The same network that enables improved communication, access to information, and more affordable marketing presence is not without hazards. Generally speaking, those hazards include the theft of information, corruption or destruction of information, breach of confidential information, and intentional denial of service. 
     This invention addresses the risk of data corruption where a server sends parameters out to a user space and expects to receive the same values in a subsequent communication. As an example, consider a Web site that is hosted on a server and is accessible by any number of client users. For purposes here, a client, user, or client user refers to either a computer workstation configured with a Web browser or the user of such a browser, as appropriate. Where the client is doing more than just reading information posted on the Web site, there may be a two-way exchange of data between the Web server and the client. A common implementation of electronic commerce, for instance, is where a Web site contains products that a user can purchase on-line for a specified price. Such a presentation may reasonably be interpreted as an offer for the sale of goods in the contractual sense: it provides terms that can be accepted by a buyer without subsequent action by the seller. Suppose the Uniform Resource Locator (URL) contains not only the location of the Web page, but also a hidden pricing parameter for a product contained on the Web page. There is a risk that, even though hidden, a user might tamper with the value of the price parameter (most likely changing it to a lower value) prior to placing an on-line order. If the transaction is automatically processed using the changed parameter, then the user&#39;s alteration could result in economic harm to the seller. 
     Unfortunately, it is very difficult to detect or prevent this type of tampering. Security measures that restrict users, for example by employing a firewall, provide little utility since the nature of Web-based e-commerce is that new and previously unknown users must have easy access in order to transact business with the Web server. Moreover, encryption, hashing, and other techniques known in the art designed to detect tampering or to secure data as it passes between point A and point B (between a server and client, in this case) are not adapted to detect tampering of data while it resides at point B. 
     Thus, server applications that pass parameters through user space, and operate on the assumption that the value of one or more parameters will not be changed by a user, are exposed to a vulnerability not effectively managed by known security measures. This and other drawbacks and limitations exist in known approaches to error detection. 
     SUMMARY OF THE INVENTION 
     The invention overcoming these and other drawbacks in the art relates to a system and method that provides an improved technique for error detection related to the transmission of data over a network. 
     It is an object of the invention to mitigate the risk to server applications where parameter values are passed through a user space. 
     It is another object of the invention to provide the added security with minimal impact on the speed at which a server application can be executed. 
     It is another object of the invention to not unduly restrict access to server-based applications by remote users. 
     In one embodiment of the invention, a Web server communicates with a client over the Internet. The client may be configured with a Web browser allowing access to an application that resides on the Web server. The server application may require that a parameter value be passed to the client in a URL, then returned to the server in a subsequent communication. Before sending the parameter value to the client, the server may perform a pre-processing step, resulting in a formatted data string. The server may then transmit the formatted data string to the client. After the client returns the formatted data string and other data to the server, the server may perform a post-processing step to verify that the parameter value or values have not been tampered with. Thus, the pre-processing and post-processing steps operate together to detect whether parameters that pass through a user space have been tampered with. This is a departure from techniques that merely detect tampering of data as it passes between two nodes of a network. 
     The following drawings and descriptions further describe the invention, including several different embodiments of the major system components and processes. The construction of such a system, implementation of such a process, and advantages will be clear to a person skilled in the art of error detection in communication systems. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is the schematic diagram of a system configured to detect errors associated with tampering of parameters in a user space, according to one embodiment of the invention. 
         FIG. 2  is a flow diagram illustrating a method for detecting errors associated with tampering of parameters in a user space, according to one embodiment of the invention. 
         FIG. 3  is a flow diagram detailing a pre-processing step, according to one embodiment of the invention. 
         FIGS. 4-A  through  4 -D are examples of Web-based code and screen displays that may be used to pass parameter values between a client and a server, according to one embodiment of the invention. 
         FIG. 5  is a flow diagram detailing a post-processing step, according to one embodiment of the invention. 
     
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     The invention relates to a data security risk that arises when an application on a server passes parameter values through user space.  FIG. 1  provides a schematic illustration of such a configuration: where a server  100  is connected to a client  110  via a communication link  120 . Other embodiments may include multiple servers or clients. 
     Server  100  is configured to provide certain pre-processing and post-processing functions that enable detection of changes in parameter values that originate at server  100 , are transmitted to client  110 , and are subsequently returned to server  100 . Server  100  may be or include, for instance, a workstation running the Microsoft Windows™ NT™, Windows™ 2000, Unix, Linux, Xenix, IBM AIX, Hewlett-Packard UX, Novell Netware™, Sun Microsystems Solaris™, OS/2™, BeOS™, Mach, Apache, OpenStep™ or other operating system or platform. 
     Client  110  may be a user workstation that may allow for remote access to applications that reside on server  100 . Client  110  may also run its own applications, and may exchange data with server  100 . Client  110  may be or include, for instance, a personal computer running the Microsoft Windows™ 95, 98, Millenium™, NT™, or  2000 , Windows™CE™, PalmOS™, Unix, Linux, Solaris™, OS/2™, BeOS™, MacOS™ or other operating system or platform. Client  110  may include a microprocessor such as an Intel x86-based device, a Motorola 68K or PowerPC™ device, a MIPS, Hewlett-Packard Precision™, or Digital Equipment Corp. Alpha™ RISC processor, a microcontroller or other general or special purpose device operating under programmed control. Client  110  may furthermore include electronic memory such as RAM (random access memory) or EPROM (electronically programmable read only memory), storage such as a hard drive, CDROM or rewritable CDROM or other magnetic, optical or other media, and other associated components connected over an electronic bus, as will be appreciated by persons skilled in the art. Client  110  may also be or include a network-enabled appliance such as a WebTV™ unit, radio-enabled Palm™ Pilot or similar unit, a set-top box, a networkable game-playing console such as Sony Playstation™ or Sega Dreamcast™, a browser-equipped cellular telephone, or other TCP/IP client or other device. It should be appreciated that in other embodiments, there may be multiple clients that have access to any given server. 
     Communication link  120  connects server  100  to client  110 . Communications link  120  may be, include or interface to any one or more of, for instance, the Internet, an intranet, a PAN (Personal Area Network), a LAN (Local Area Network), a WAN (Wide Area Network) or a MAN (Metropolitan Area Network), a frame relay connection, an Advanced Intelligent Network (AIN) connection, a synchronous optical network (SONET) connection, a digital T1, T3, E1 or E3 line, Digital Data Service (DDS) connection, DSL (Digital Subscriber Line) connection, an Ethernet connection, an ISDN (Integrated Services Digital Network) line, a dial-up port such as a V.90, V.34 or V.34bis analog modem connection, a cable modem, an ATM (Asynchronous Transfer Mode) connection, or FDDI (Fiber Distributed Data Interface) or CDDI (Copper Distributed Data Interface) connections. Communications link  120  may furthermore be, include or interface to any one or more of a WAP (Wireless Application Protocol) link, a GPRS (General Packet Radio Service) link, a GSM (Global System for Mobile Communication) link, a CDMA (Code Division Multiple Access) or TDMA (Time Division Multiple Access) link such as a cellular phone channel, a GPS (Global Positioning System) link, CDPD (cellular digital packet data), a RIM (Research in Motion, Limited) duplex paging type device, a Bluetooth radio link, or an IEEE 802.11-based radio frequency link. Communications link  120  may yet further be, include or interface to any one or more of an RS-232 serial connection, an IEEE-1394 (Firewire) connection, a Fibre Channel connection, an IrDA (infrared) port, a SCSI (Small Computer Serial Interface) connection, a USB (Universal Serial Bus) connection or other wired or wireless, digital or analog interface or connection. 
     Server  100  and client  110  may utilize networked enabled code related to communication link  120 . Network enabled code may be, include or interface to, for example, Hyper Text Markup Language (HTML), Dynamic HTML, Extensible Markup Language (XML), Extensible Stylesheet Language (XSL), Document Style Semantics and Specification Language (DSSSL), Cascading Style Sheets (CSS), Synchronized Multimedia Integration Language (SMIL), Java™, Jini™, C, C++, Perl, UNIX Shell, Visual Basic or Visual Basic Script, Virtual Reality Markup Language (VRML) or other compilers, assemblers, interpreters or other computer languages or platforms. 
       FIG. 2  is an overview of a method used to detect the class of errors targeted by the invention. The process may start in step  200  when, for instance, an application on server  100  determines that one or more parameter values will be sent to client  110 , and when those parameter values are expected to be returned to server  100  for a subsequent operation. An example may be where server  100  is sending the price of goods to client  110  and where server  100  expects to receive that same price in return as an input to an automated order entry system. Generally speaking, server  100  may execute pre-processing step  210  on parameter values such as price in order to form a basis for comparison in post-processing step  240  after those same parameter values have been sent to and received from client  110  in steps  220  and  230 , respectively. 
       FIG. 3  illustrates several steps that may be executed once pre-processing step  210  is initiated in step  300 . In step  310 , a transaction label may be assigned to the pre-processing transaction. In one embodiment, step  310  may involve the assignment of a session identification number. In another embodiment, step  310  may perform date and time stamping. Other similar methods for labeling a transaction may be familiar to those skilled in the art. Pre-processing step  210  may further include a hashing step  320  which operates on one or more parameter values to produce one or more resultant numbers. Hashing step  320  may also operate on one or more transaction labels. An embodiment of hashing step  320  may therefore be, or utilize, one or more hashing algorithms, such as MD2, MD4, MD5, RIPEMD, RIPEMD-160, SHA1, Snefru, or Tiger, for example. Hashing step  320  may operate on one or more parameter values or transaction labels resulting in a single number. In another embodiment, hashing step  320  may operate on each of several parameter values and transaction labels separately, resulting in a series of hashes. In step  330 , the results of transaction labeling step  310  and hashing step  320  may be encrypted. In another embodiment, only the results from step  310  or  320  may be encrypted. In yet another embodiment, the results of steps  310  and  320  may not be encrypted at all. Where used, encryption step  330  may employ an algorithm known only to the server: a private key, for instance. Pre-processing step  210  may complete once encrypted values of the transaction label and hash are appended to the parameter values, as depicted in  FIG. 3  by step  340 , to create a formatted data string that is ready to be sent into user space. 
     Send step  220  and receive step  230  may function by passing data strings in a Uniform Resource Locator (URL), in a cookie, or by other techniques known in the art.  FIG. 4-A  depicts how server  100  may send data to client  110  by embedding a URL into a dynamically-generated Web page, according to one embodiment of the invention. In this example, the embedded URL specifies a Hyper-Text Transfer Protocol (HTTP) server in field  400  and a host computer location called widget.sales.com in field  410 . Field  420  is the path, where the /cgi-bin/ string makes special reference to a program called order entry that will execute on server  100  using parameter values 100, 14, 73 and 1, or using 100, 14, 73 and 2, or using 100, 14, 73 and 3, depending upon the link selected by the client user. The parameter values in field  420  may represent, for example, a unit price of 100, a session identification number of 14, and a hash of 73, resulting from pre-processing step  210 . The final parameter value may represent a quantity of goods: 1, 2, or 3. In another embodiment, the parameter values in field  420  may be expressed using parameter labels &amp;price, &amp;sessid, &amp;hash, and &amp;qty, as depicted in  FIG. 4-B . Other labels and other formats may also be used to pass data, in accordance with various communication protocols. 
       FIG. 4-C  illustrates what the browser of client  110  might display, according to the HyperText Markup Language (HTML) code in  FIG. 4-A . 
     Notwithstanding the fact that parameter values in this instance are hidden, a client user may seek to tamper with the values contained in the URL, for example by decreasing the unit price parameter from a value of 100 to a value of 1. Such a change is depicted in  FIG. 4-D . If a client selects the modified link of  FIG. 4-D , the changed price value in field  430  may be sent to server  100  for automatic order entry at the reduced price. 
       FIG. 5  provides one embodiment of post-processing step  240  that may be executed on server  100  in order to detect whether a parameter value, such as price in the example above, has been changed. The process may begin, in step  500 , after data has been received from client  110 . In step  510 , all values that were encrypted, the session identification number and hash for example, may be decrypted. Step  510  may employ a private key known only to server  100 . In step  520 , server  100  may read the transaction label, which may be a session identification number, date and time stamp, or other identifier. A new hash may be performed on one or more parameter values in step  530 . Hashing in step  530  may operate on all parameter values at once, or it may operate separately on each of several parameter values. It may be necessary for hashing step  530  to operate in identical fashion as hashing step  320 . Using the transaction label as an index, the hash or hashes resulting from step  530  may be compared in step  540  to the hash or hashes that resulted from step  320 . If the hash or hashes are the same, then it may be concluded in step  550  that no errors have been detected. If, on the other hand, one or more hash values are not the same, then step  560  may indicate that an error has been detected. 
     The specification and examples provided above should be considered exemplary only. It is contemplated that the appended claims will cover any other such embodiments or modifications as fall within the true scope of the invention.