1. Field of the Invention
The present invention relates to a computer system, and deals more particularly with a method, system, and computer readable code for validating that a document or executable to be served from a server is the same original document or executable placed on the server by the legitimate author or owner.
2. Description of the Related Art
Use of the Internet and World Wide Web has skyrocketed in recent years. The Internet is a vast collection of computing resources, interconnected as a network, from sites around the world. It is used every day by millions of people. The World Wide Web (referred to herein as the xe2x80x9cWebxe2x80x9d) is that portion of the Internet which uses the HyperText Transfer Protocol (xe2x80x9cHTTPxe2x80x9d) a protocol for exchanging messages. (Alternatively, the xe2x80x9cHTTPSxe2x80x9d protocol can be used, where this protocol is a security-enhanced version of HTTP.)
A user of the Internet typically accesses and uses the Internet by establishing a network connection through the services of an Internet Service Provider (ISP). An ISP provides computer users the ability to dial a telephone number using their computer modem (or other connection facility, such as satellite transmission), thereby establishing a connection to a remote computer owned or managed by the ISP. This remote computer then makes services available to the user""s computer. Typical services include: providing a search facility to search throughout the interconnected computers of the Internet for items of interest to the user; a browse capability, for selecting Web pages from a server location which are then served or delivered to the user and displayed on the local computer; download facilities, for requesting and receiving information from the Internet including (but not limited to) documents, Web pages, and executable programs; and an electronic mail facility, with which the user can send and receive mail messages from other computer users.
The user working in the Internet environment will have software running on his computer to allow him to create and send requests for information, and to see the results. These functions are typically combined in what is referred to as a xe2x80x9cWeb browserxe2x80x9d, or xe2x80x9cbrowserxe2x80x9d. After the user has created his request using the browser, the request message is sent out into the Internet for processing. The target of the request message is one of the interconnected computers in the Internet network, commonly referred to as a xe2x80x9cserverxe2x80x9d. That server computer will receive the message, attempt to find the data satisfying the user""s request, and return the located information to the browser software running on the user""s computer. This server process is referred to herein as xe2x80x9cservingxe2x80x9d or xe2x80x9cpublishingxe2x80x9d the information.
The information that is available on the Internet is placed there by the owner(s) of the information for the purpose of making it available to users for downloading, reading (i.e. browsing), executing (i.e. executables), etc. (The xe2x80x9cownerxe2x80x9d in this case is the author of the materials or someone who has been delegated to manage the materials on behalf of the author.) Typically, users of the information are only given xe2x80x9cread accessxe2x80x9d, and are not allowed to alter the owner""s original information that is stored on the server. If the material is sensitive in nature and is intended for access by a limited set of users such as a specific company, work group or organization, then typically some form of user authorization process is employed to limit read access to the information only to specific users. This normally involves a security system that Add will ask the user for a predefined password in an attempt to verify the identity of the requesting user. Once the user proves to be authorized to access the material, they are allowed to browse the information, download it, etc. If, on the other hand, the information is intended for public access, then a user authorization process is not used and anyone with access to the Internet has free read access to the information.
The legitimate owners of the information placed on the Internet, as well as the ISPs, must also protect Internet resources such as the Internet servers where owners"" information is stored and accessed by users. The ability to write to these servers, or xe2x80x9cwrite accessxe2x80x9d, is normally controlled by some form of security system that verifies the user has legitimate access to the information (typically the owner or author). Controlling write access to the servers is critical since it is the facility used by legitimate authors or owners to store, update or otherwise maintain the material available to the Internet users. Normally, write access to Internet servers is not granted to typical Internet usersxe2x80x94with the possible exception of personal Web pages that may be offered to Internet users by their ISP. Even then, the ISP protects the Internet servers by typically requiring the user to verify who they are through a security system, and limits the user""s write access on the Internet server to only the data the Internet user owns.
Hackers have been able to bypass the various security systems in the past and, despite continuing efforts to improve security systems, it can be assumed that hackers will continue to penetrate security systems and gain unauthorized access to resources such as the Internet servers. Hackers may access Internet servers for a variety of reasons, and may perform many different kinds of acts once they gain access to a server. They may obtain read access to documents for which they are not authorized. Or, they may alter or remove files or executables that are available to be served to users requesting the information. More malicious acts of hackers include planting viruses, removing files, replacing files with corrupted material, or other acts damaging the server content, or even causing the server to fail completely. The more severe forms of tampering, such as disabling a server site on the Internet, are normally detected quickly since anyone trying to access the server will receive some form of indication of the failure. Other forms of tampering, such as replacing legitimate material with malicious materials or planting a virus, may go undetected for a long period of time. During the time period from the alteration to its detection, the material may have been served to thousands of unsuspecting users. Because of the communication paradigm used for Internet computing, it is typically impossible to notify all the users who have received corrupted information after the fact. Instead, the material will continue to be served until the alteration is detected and appropriate measures are taken (such as removing the material or even disabling the site). There is currently no systematic way to detect altered content in this environment. The owner of material that has been corrupted may be notified by a user who has received the corrupted material. Or, the owner may notice the tampering during a review of the server content. It is, however, unlikely that an owner will perform such a review on a timely basis. It is even more unlikely that a user of the information will be able to detect subtle alterations to the served material.
Even when password protection is in place for read and write access to the information on a server, it is still possible for malicious alteration to occur. There are many well known sniffer attacks where FTP (file transfer protocol) and telnet passwords are intercepted during legitimate transmission and then used by hackers to modify a site. For example, several U.S. government judicial and law enforcement sites have been hacked such that the text and images available from the site were altered. One solution is to use secure shell or secure file transfer to hide the password, but strong encryption is generally required to provide adequate protection. A disadvantage of this solution is that strong encryption is subject to government regulation and, in cases where content does not need to be kept private, the encryption is computational overhead that is generally not necessary.
Accordingly, a need exists for a technique to ensure that a document or executable that is served to a requesting user is unchanged from the version placed there by the legitimate author or owner.
An object of the present invention is to provide a technique whereby the content of material available through the Internet is verified prior to being delivered or served to the requestor.
A further object of the present invention is to provide this technique by authenticating that the author of the material was the legitimate author.
Another object of the present invention is to provide a technique whereby a document or executable deemed to be corrupted is not delivered to the requestor.
Yet another object of the present invention is to provide a technique whereby the author or owner of the materials is notified that the material has been corrupted.
Other objects and advantages of the present invention will be set forth in part in the description and in the drawings which follow and, in part, will be obvious from the description or may be learned by practice of the invention.
To achieve the foregoing objects, and in accordance with the purpose of the invention as broadly described herein, the present invention provides a system, method, and computer-readable code for use in a computing environment having a connection to a network. In a first aspect, the present invention comprises a technique for preventing information from being published over a network in a computing environment after an unauthorized alteration of the information. This technique further comprises: storing one or more files on a storage medium accessible to a first computer in the computing environment; storing a digital signature for each of the files, each of the digital signatures being stored in a location accessible to the first computer; receiving a request for a selected one of the files from a user of a second computer in the computing environment; authenticating, responsive to the receiving, that the requested file was created by an authorized author; and publishing the requested file to the user only when the authenticating has a successful result. This may further comprise notifying the user that the requested file was not found when the authenticating has an unsuccessful result. In addition, an additional notification may be generated when the authenticating has an unsuccessful result, where the notification comprises one or more of an alert and a log record. The authentication may further comprise: retrieving the requested file from the storage medium; computing a cryptographic digest of the retrieved file; decrypting the stored digital signature for the retrieved file; and comparing the computed digest to the decrypted signature, wherein the successful result occurs when the comparison detects that the computed digest and the decrypted signature are identical. Or, the authentication may further comprise: retrieving the requested file from the storage medium; computing a cryptographic digest of the retrieved file; determining whether an entry exists in a validation cache for the requested file, where this entry comprises a previously validated digest for the requested file; comparing the computed digest to the previously-validated digest, wherein the successful result occurs when the comparison detects that the computed digest and the previously-validated digest are identical; validating the retrieved file when the entry does not exist or the comparison detects that the computed digest and the previously-validated digest are not identical; and storing the computed digest in the validation cache for a future invocation of the authentication when the authentication has a successful result. The validation preferably further comprises: decrypting the stored digital signature for the retrieved file; and comparing the computed digest to the decrypted signature, wherein the successful result occurs when this comparison detects that the computed digest and the decrypted signature are identical. The authentication may further comprise: determining whether a certificate of the author is valid, and wherein the successful result occurs only if the certificate is valid, this determination indicating that the certificate is valid if the certificate has either of: a locally-stored trusted status or a trusted status derived from a higher-level trusted certificate authority. In addition, this may further comprise verifying one or more permissions of the author, and these permissions may comprise one or more of: a first permission to create files in a particular directory where the requested file is stored on the storage medium; and a second permission to create files for a particular action type associated with the requested file.
This technique may further comprise initializing the validation cache, wherein the initialization further comprises: retrieving selected ones of the stored files; computing the cryptographic digest for each of the selected files; and storing each of the computed digests in the validation cache.
The decrypting may use a public key of the authorized author. Optionally, a system cache may be used to optimize performance of the system. This further comprises: checking the system cache for the requested file prior to operation of the authentication; bypassing operation of the authentication if the checking locates the requested file in the system cache; and wherein the publishing publishes the located file following operation of the bypassing operation; and storing the retrieved file in the system cache for the future invocation when the authentication has a successful result. Optionally, this bypassing may further require that a cache timestamp of the located file and a timestamp of the requested file on the storage medium are identical.
In this technique, the authorized author may be an automated file generation process. The stored digital signature may be stored externally from the retrieved file. Or, the stored digital signature may be embedded within the retrieved file.
In another aspect, the present Invention comprises a technique for securing Web server content in a computing environment connected to a network. This technique comprises: storing one or more files on a storage medium accessible to a Web server in the computing environment; storing a digital signature for each of the files, each of the digital signatures being stored in a accessible to the Web server; authenticating that selected ones of the stored files were created by an authorized author; and for any of the selected files for which the authentication has an unsuccessful result, making these files unavailable for publishing over the network. Making the files unavailable may further comprise deleting the files from the storage medium. The authentication may further comprise: retrieving each of the selected ones from the storage medium; and validating each of the retrieved ones. The validation may further comprise: computing a cryptographic digest of the retrieved file; decrypting the stored digital signature for the retrieved file; and comparing the computed digest to the decrypted signature, wherein the unsuccessful result occurs when the comparing step detects that the computed digest and the decrypted signature are not identical.
In yet another aspect, the present invention comprises a technique for securely serving an aggregated document from a first server connected to a computer network to a user connected to the network, wherein the aggregated document is comprised of one or more other documents obtained by the first server from one or more other servers in addition to zero or more documents locally accessible to the first server. This technique comprises: requesting the other documents from selected ones of the other servers; receiving the requested documents; validating that each of the received documents was created by an authorized author; and serving the aggregated document to the user only if each of the received files has a successful outcome in a comparison process. The validation may further comprise: computing a cryptographic digest of the received document; retrieving a digital signature for the received document, wherein the digital signature was previously created by an author of the received document; decrypting the retrieved digital signature using a public key of the author; and comparing the decrypted signature to the computed digest, wherein the comparison has a successful outcome only if the decrypted signature and the computed digest are identical.
The present invention will now be described with reference to the following drawings, in which like reference numbers denote the same element throughout.