Web Server Security via Data Splitter and Unidirectional Flow

The patent segments the network communication processing into two distinct paths: a fast path that handles only communication state information (headers, routing data) and a slow path that processes payload information. This segmentation allows the presentation tier to maintain security by processing communications through a secure gateway while avoiding the complexity of processing all communications through high-assurance code. The fast path uses simplified, verified logic for state tracking, while the slow path handles complex payload validation only when necessary.

The patent extracts payload information processing from the main communication flow and routes it through a separate, controlled path. By taking out the payload processing from the general communication handling, the system can apply specialized validation rules only where needed, rather than requiring all communication processing to go through high-assurance code. This extraction reduces the overall complexity while maintaining security for critical operations.

The patent divides communication processing into two segments: state information processing that occurs for every communication (fast path) and payload processing that occurs only when security validation is required (slow path). This segmentation enables the system to maintain high detection capability by validating payloads when necessary, while preserving throughput by using the efficient fast path for routine communications that don't require full payload analysis.

The patent applies partial action by processing only the necessary portions of communications through the secure gateway. Instead of requiring all communications to undergo full payload validation, the system processes state information for all communications (maintaining detection capability) and applies payload processing only when security policies indicate it's necessary. This partial approach maintains security where needed while preserving overall system throughput.

The patent introduces a secure gateway as an intermediary between the presentation tier and the business tier. This gateway enforces unidirectional dataflow from the client through the gateway to the business logic, preventing direct bidirectional communication that could enable data leakage. The intermediary maintains communication flexibility by properly routing and forwarding data according to established protocols, allowing legitimate communication while blocking malicious data exfiltration paths.

The patent creates a copy of the communication data flow that passes through the secure gateway's validation logic. The gateway maintains a verified copy of the communication state and parameters, allowing it to enforce unidirectional dataflow rules while the original communication continues through normal channels. This copying approach enables strict security enforcement without disrupting legitimate communication flexibility.