Self-healing content security policy

Abstract

Systems and methods provide self-healing content security policies (CSPs). According to some aspects, CSP violation information is received that identifies a CSP violation of a CSP header and a violation source of the CSP violation. And comparing violation sources of the CSP violation with the trusted source list. Based on the comparison, a first trust source in the list of trust sources is identified as matching a violation source of the CSP violation. In response to identifying the first source of trust as matching the violation source, a CSP definition associated with the CSP header is updated to include a source value based on the violation source or the first source of trust to provide an updated CSP definition.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Indian Patent Application No. 202311049317 filed in India on July 21, 2023, entitled “DYNAMIC SOURCE VALUES FOR CONTENT SECURITY POLICIES”, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present application relates to the field of content security, and more specifically, to a self-healing content security strategy. Background Art

[0004] Content Security Policy (CSP) is a security mechanism that helps detect and mitigate certain types of attacks, including cross-site scripting (XSS) and data injection attacks. Web application administrators can define CSP sets that specify the types of resources (such as scripts, style sheets, and images) that are allowed to load and execute for web applications and the valid sources of each type of resource in the different types of resources. By setting these policies, administrators can limit potential vulnerabilities that malicious actors may exploit. When a client device requests a web application, a CSP header with a directive is returned as a response, where the directive indicates the types of resources that can be loaded (e.g., JavaScript, CSS, images, etc.) and the valid sources of these resources. The browser or other application that executes the web application on the client device checks the CSP directive and enforces the defined restrictions, thereby blocking or allowing requests based on the specified policy. This helps ensure that only trusted sources are allowed to interact with web applications, thereby reducing the risk of code injection and other malicious activities. Summary of the invention

[0005] Some aspects of the present technology relate to, among other things, a CSP management system that facilitates CSP management, deployment, and violation reporting. The CSP management system allows an administrator to generate and edit CSP definitions for various web applications, and stores the CSP definitions in a repository. When a client device requests a particular web application, the CSP management system retrieves the CSP definition for the web application, generates a CSP header based on the CSP definition, and provides the generated CSP header as a response header to the client device making the request. When a CSP violation occurs, information about the violation is provided to the CSP management system. The information may include, for example, information identifying the source of the violation (i.e., a source called by a web application that is not specified by the CSP header) and the CSP header / definition. The CSP management system compares the source of the violation with a list of trusted sources. If the CSP management system determines that the source of the violation matches a trusted source, the CSP management system causes the corresponding CSP definition to be updated to include a source value based on the source of the violation / matched trusted source. Thus, when a CSP header is subsequently generated using the updated CSP definition, the CSP header includes the added origin value, so that if the web application attempts to call the origin corresponding to the previous violating origin, the call will no longer result in a violation.

[0006] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Embodiments of the present technology are described in detail below with reference to the accompanying drawings, in which:

[0008] Figure 1 is a block diagram illustrating an exemplary system according to some embodiments of the present disclosure;

[0009] Figure 2 is a block diagram illustrating an example CSP management system according to some embodiments of the present disclosure;

[0010] Figure 3 is a diagram illustrating example instructions defined for a CSP according to some embodiments of the present disclosure;

[0011] Figure 4 is a diagram illustrating an example CSP header according to some embodiments of the present disclosure;

[0012] Figure 5 is a diagram illustrating an example of comparing a violating source to a list of trusted sources according to some embodiments of the present disclosure;

[0013] Figure 6is a flow chart illustrating a method of updating a CSP based on a CSP violation according to some embodiments of the present disclosure; and

[0014] Figure 7 is a block diagram of an exemplary computing environment suitable for use in embodiments of the present disclosure. DETAILED DESCRIPTION

[0015] Overview

[0016] Traditionally, the administrator responsible for each web application hard-codes the CSP header into each web application. This can be difficult to maintain for an enterprise, especially when there are a large number of web applications with different dependencies and different development teams responsible for various web applications. As used herein, the term "web application" broadly refers to any application, document, or other code that is accessed by a client device over a network and executed and / or rendered by an application (e.g., a web browser) on the client device. The term covers web pages that include dynamic content, interactive elements, or other functionality, etc.

[0017] In order to address these challenges associated with the conventional use of CSP, in some aspects, the technology described herein provides a CSP management system for managing CSPs for Web applications. Among other things, the CSP management system facilitates CSP management, deployment, and violation reporting. The CSP management system provides a repository of CSP definitions. Each CSP definition can correspond to one or more Web applications and include a source value that identifies a valid source (e.g., a domain) for the corresponding Web application. An administrator can use an existing CSP definition, modify an existing CSP definition, and / or create a new CSP definition. When a Web application is requested by a client device, a CSP definition for the Web application is retrieved from a repository (e.g., a CSP definition data storage device or cache), a CSP header is generated based on the CSP definition, and the generated CSP header is sent to the client device as a response header. Any CSP violation that occurs when a Web application is executed on a client device is reported to the CSP management system that records the violation. Thus, the CSP management system provides administrators with the ability to view violations and manage CSP definitions based on violations.

[0018] According to some aspects of the technology described herein, a CSP management system facilitates updating CSP definitions based on CSP violations. When an application (e.g., a web browser) executing a web application on a client device attempts to call a resource from a source that is not specified by the relevant instructions of the CSP header, a CSP violation occurs. When a CSP violation occurs, information about the violation is provided to the CSP management system, the information including, for example, information about the violation source (i.e., the source that is called but not specified by the CSP header), the web application, the CSP header / definition, and / or the relevant instructions. The CSP management system compares the violation source with a list of trusted sources. Trusted sources include known safe sources (i.e., whitelists), such as the entity's own sources and trusted third-party sources. If the CSP management system determines that the violation source matches the trusted source, the CSP management system updates the relevant CSP definition to include a source value corresponding to the violation source / matched trusted source. Therefore, when the client device subsequently requests the web application, the CSP header includes the source value so that if the web application calls the source corresponding to the violation source, the source will no longer cause a violation.

[0019] The update of the CSP definition can be performed automatically, semi-automatically, or manually. When performed automatically, the CSP management system automatically identifies the relevant instructions of the CSP header (for example, based on information about the CSP violation) and adds a source value to the instruction. When performed semi-automatically, a user interface is initially provided to the management device, which identifies the source of the violation as matching the trusted source and includes a user interface element for selecting to update the CSP definition. If the administrator selects the user interface element, the CSP management system automatically updates the CSP definition to include the source value. When performed manually, a user interface is provided to the management device, which identifies the source of the violation as matching the trusted source. The administrator can view the information and use the management device to access the relevant CSP definition to the CSP repository and update the CSP definition by adding the source value.

[0020] Various aspects of the technology described herein provide multiple improvements over the prior art. For example, aspects of the technology described herein improve the security of Web applications by providing a centralized platform for managing CSPs of various Web applications. The ability of the CSP management system to update the CSP header based on violations caused by trusted sources improves performance. Specifically, the updated CSP header will no longer cause violations when the Web application calls the corresponding source. By allowing resources to be retrieved from trusted sources, the performance of the Web application is also improved. Advantageously, the embodiments described herein can also be used to improve the efficiency of computing and network resources. Specifically, compared with the conventional method of manually updating the hard-coded CSP header in the Web application, the centralized update of the CSP header for multiple Web applications based on CSP violations provides more efficient utilization of computing resources (e.g., higher throughput and reduced network latency, lower packet generation costs, etc.).

[0021] Example Content Security Policy System

[0022] Now referring to the accompanying drawings, Figure 1 is a block diagram showing an exemplary system 100 for CSP management, deployment and violation reporting according to an embodiment of the present disclosure. It should be understood that this arrangement and other arrangements described herein are set forth only as examples. In addition to or in place of the arrangements and elements shown, other arrangements and elements (e.g., machines, interfaces, functions, sequences, functional groupings, etc.) may be used, and some elements may be omitted entirely. In addition, many of the elements described herein are functional entities that may be implemented as discrete or distributed components or in combination with other components and implemented in any suitable combination and location. The various functions performed by one or more entities described herein may be performed by hardware, firmware and / or software. For example, the various functions may be performed by a processor that executes instructions stored in a memory.

[0023] System 100 is an example of a suitable architecture for implementing some aspects of the present disclosure. System 100 includes user device 102, management device 104, and CSP management system 106, among other components not shown. Figure 1 Each of the illustrated user device 102, management device 104, and CSP management system 106 may include one or more computer devices, such as those discussed below. Figure 7 The computing device 700. Figure 1As shown, the user device 102, the management device 104 and the CSP management system 106 can communicate via a network 108, which may include, but is not limited to, one or more local area networks (LANs) and / or wide area networks (WANs). Such network environments are common in offices, enterprise-wide computer networks, intranets, and the Internet. It should be understood that within the scope of the present technology, any number of user devices and server devices may be employed within the system 100. Each device may include a single device or multiple devices collaborating in a distributed environment. For example, the CSP management system 106 may be provided by multiple server devices that together provide the functionality of the CSP management system 106 as described herein. In addition, other components not shown may also be included within the network environment.

[0024] The CSP management system 106 facilitates the management, deployment, and violation reporting of CSPs. For example, an entity with multiple web applications can use the CSP management system 106 to manage the CSPs of its web applications. The CSP management system 106 can be implemented using one or more server devices, one or more platforms with corresponding application programming interfaces, cloud infrastructure, etc. Figure 2 Additional details related to various components of CSP management system 106 are described.

[0025] Among other things, the CSP management system 106 allows an administrator who is responsible for managing the CSP to generate and / or edit CSP definitions. In some configurations, the CSP management system 106 also logs violation reports against the CSP and provides information about CSP violations to the administrator. For example, the CSP management system 106 can provide one or more user interfaces to the management device 104 for CSP management and violation reporting. Figure 1 As shown, management device 104 includes an application 112 for interacting with CSP management system 106. Application 112 may be, for example, a web browser or a dedicated application for providing functionality such as that described herein.

[0026] The CSP management system 106 also facilitates deployment of a CSP header when a user device, such as the user device 102, requests a web application. When a request for a web application is received from the user device 102, the CSP management system 106 retrieves a CSP definition for the requested web application, generates a CSP header based on the CSP definition, and provides the CSP header as a response header to the user device 102. Figure 1 As shown, client device 102 includes an application 110 for interacting with CSP management system 106. Application 110 may be, for example, a web browser or a dedicated application for providing functionality such as that described herein.

[0027] The user device 102 and the management device 104 each include any type of computing device that can be used by a user and an administrator. For example, in one aspect, the user device 102 and the management device 104 each include the computing device described herein. Figure 7 Types of computing devices 700 described. By way of example and not limitation, user device 102 and management device may be embodied as a personal computer (PC), a laptop computer, a mobile device or mobile device, a smartphone, a tablet computer, a smart watch, a wearable computer, a personal digital assistant (PDA), an MP3 player, a global positioning system (GPS) or device, a video player, a handheld communication device, a gaming device or system, an entertainment system, an in-vehicle computer system, an embedded system controller, a remote control, an appliance, a consumer electronic device, a workstation, or any combination of these described devices, or any other suitable device.

[0028] Next go to Figure 2 , provides an illustration of a CSP management system 206 (which may correspond to Figure 1 2 is a block diagram of various aspects of a CSP management system 106 of the present invention. The CSP management system 206 includes multiple components for CSP management, deployment, and violation reporting, including a CSP manager service 208, a front end 212, and a CSP reporting service 216. The components of the CSP management system 206 may be other components that provide additional functionality beyond the features described herein.

[0029] In one aspect, the functions performed by the components of the CSP management system 206 are associated with one or more applications, services, or routines. Specifically, such applications, services, or routines may be run on one or more user devices, servers, may be distributed on one or more user devices and servers, or implemented in the cloud. In addition, in some aspects, these components of the CSP management system 206 may be distributed on a network (including one or more servers and client devices), in the cloud, and / or may reside on a user device. In addition, these components, the functions performed by these components, or the services performed by these components may be implemented on appropriate abstraction layers of a computing system (such as an operating system layer, an application layer, a hardware layer, etc.). Alternatively or additionally, the functions of these components and / or the technical aspects described herein may be performed at least in part by one or more hardware logic components. For example, but not limited to, exemplary types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like. Additionally, while functionality is described herein with respect to specific components shown in the example system 200, it is contemplated that in some aspects the functionality of these components may be shared or distributed across other components.

[0030] CSP Management: The CSP manager service 208 of the CSP management system 206 facilitates the generation and modification of CSP definitions and stores the CSP definitions in the CSP definition data store 210. The CSP manager service 208 provides management devices 204 (which may correspond to Figure 1 The management device 104 of the embodiment of the present invention provides a user interface to manage CSP definitions. In some cases, the user interface is provided by a CSP portal, which allows administrators to access and interact with various aspects of the CSP. Among other things, the user interface allows administrators using the management device 204 to generate new CSP definitions, access and modify CSP definition templates, and access and modify existing CSP definitions. The user interface also allows administrators to associate CSP definitions with various web applications. A single CSP definition or a group of CSP definitions can be associated with a single web application or a group of web applications. When a single CSP definition is associated with multiple web applications, only the single CSP definition needs to be edited to update the CSP header for each web application in these web applications. This is in contrast to traditional CSP management, in which the CSP header for each web application is hard-coded, which requires editing each CSP header every time a change affecting multiple CSPs is required (for example, when adding a new domain).

[0031] In some configurations, the CSP manager service 208 can control different administrators' access to and / or ability to modify different CSP definitions stored in the CSP definition data store 210. For example, permissions to a single CSP definition or a group of CSP definitions can be defined based on administrator roles.

[0032] A CSP definition can include one or more directives. A directive is a specific instruction that defines the security policy for handling various types of resources for a web application. Each directive targets a specific type of resource and determines how the user device should handle it. As an example, the following is a list of common directives in a CSP:

[0033] default-src: Specifies the default policy for resources without specific directives.

[0034] script-src: Specifies the source from which JavaScript code or other scripts can be loaded.

[0035] style-src: Specifies the allowed sources for CSS style sheets.

[0036] img-src: Specifies the source from which images can be loaded.

[0037] font-src: Specifies the allowed sources for fonts.

[0038] connect-src: Specifies the source that can be requested using the scripting interface.

[0039] frame-src: Specifies the allowed sources for embedded frames or iframes.

[0040] media-src: Specifies a source from which media (e.g., audio or video content) can be loaded.

[0041] - object-src: Specifies the allowed sources for plug-ins or embedded objects (such as Flash or Java applets).

[0042] form-action: Specifies valid sources that can be used as targets for form submissions.

[0043] Each directive can specify one or more valid sources defined in the directive using source values, such as a specific domain (e.g., ebay.com), a domain with a wildcard pattern (e.g., *.ebay.com covering all subdomains within the ebay.com domain), or a keyword such as "self" (referring to the current domain) or "none" (the resource type is not allowed). Sources can be defined in directives using static source values ​​and dynamic source values. Static source values ​​are the following: the source value specified in the directive remains unchanged when the CSP definition is used to generate the CSP header. Dynamic source values ​​are the following: the source value specified in the directive is used to dynamically generate the source value included in the CSP definition when the web application is requested, as described in further detail below in the CSP deployment section. Each dynamic source value can be dynamic at the top-level domain, second-level domain, and / or subdomain. By properly configuring these directives, administrators can enforce stricter security policies and reduce the risk of various types of content-based attacks.

[0044] As an example to illustrate, Figure 3 A screenshot is provided showing a user interface for editing a style-src directive 302 for a CSP definition. For example, using Figure 2 An administrator of the management device 204 can request an existing CSP definition, or generate a CSP definition from scratch or using a template. If an existing CSP definition is requested, the CSP manager service 208 accesses the requested CSP definition in the CSP definition repository 210 and provides one or more user interfaces to the management device 204, allowing the administrator to view and / or modify each instruction of the CSP definition.

[0045] like Figure 3As shown, style-src directive 302 for the example CSP definition includes a portion 304 for specifying a source value. Source values ​​306 and 308 are examples of dynamic source values ​​that are used to dynamically generate source values ​​for a CSP header that is generated according to the CSP definition during deployment. Each of these source values ​​306 and 308 has a hashtag of the dynamic portion of the instruction source value. Source values ​​306 and 308 provide examples of being dynamic at the top-level domain. However, as described above, dynamic source values ​​can also be dynamic at other levels (e.g., at second-level domains and / or subdomains). Source values ​​310 and 312 are examples of static source values ​​that remain unchanged for a CSP header generated according to the CSP definition during deployment. As shown Figure 3 As shown, each of the dynamic source values ​​306 and 308 and the static source values ​​310 and 312 can include wildcards. In these examples, wildcards are used so that the source values ​​306, 308, 310, 312 include subdomains.

[0046] CSP deployment: The CSP management system 206 includes a front end 212 that facilitates the deployment of CSPs. When a user device 202 requests a web application, the front end 212 receives the request and retrieves a CSP definition for the requested web application from a repository of CSP definitions. For example, the front end 212 can retrieve the CSP definition from a CSP definition data store 210 or a CSP cache 214 associated with the front end 212.

[0047] The front end 212 generates a CSP header as a response header based on the retrieved CSP definition, and provides the generated CSP header to the user device 202. The generated CSP header provides a set of instructions, and the instruction set specifies one or more source values ​​for each instruction as set forth in the CSP definition. For each dynamic source value in the CSP definition, the front end 212 dynamically generates the source value included in the CSP header according to the domain of the requested web application. As described above, the dynamic source value in the CSP header specifies a dynamic portion, which can be a top-level domain, a second-level domain, and / or a subdomain. Based on which portion of the dynamic source value is dynamic, the source value included in the CSP header is dynamically generated using the corresponding level of the domain of the requested web application.

[0048] As an example, in some cases, a CSP header may correspond to a web application that varies for different geographic regions, where each region has a different top-level domain (e.g., .de, .ca, .co.jp, .co.uk, etc.). In this example, when a web application for a specific geographic region is requested, a dynamic source value with a dynamic top-level domain portion will cause the source value of the CSP header to be generated using the top-level domain of the requested web application. Thus, when a web application for Canada is requested, the .ca source value in the CSP header returned in the response will be generated using the dynamic source value in the CSP definition. However, when a web application for the United Kingdom is requested, the .co.uk source value in the CSP header returned in the response will be generated using the dynamic source value in the CSP definition.

[0049] Figure 4 An example CSP header 402 generated from a CSP definition is provided. The CSP header 402 includes a style-src directive 404 and other directives (e.g., a connect-src directive, a script-src directive, a frame-ancestors directive, a default-src directive). Figure 3 The style-src directive 302 in the CSP definition example is used to generate the style-src directive 404 of the CSP header 402. Figure 4 In the example of , the requested web application includes the top-level domain .de (i.e., a web application for Germany). Therefore, for any dynamic source value in the CSP definition with a dynamic top-level portion, the .de top-level domain is used to generate the source value for CSP definition 402. For example, source value 406 (*ebay.de) has been generated based on dynamic source value 306 (*ebay.#ebaysite#), and source value 408 (*.ebaystatic.de) has been generated based on dynamic source value 308 (*ebaystatic.#ebaysite#). The style-src 404 instruction also includes a source value 410 (*ebaystatic.cn) corresponding to static source value 310 (*ebaystatic.cn) and a source value 412 (*googleapis.com) corresponding to static source value 312 (*googleapis.com). From Figure 4 As can be seen, each of the source values ​​406 , 408 , 410 , 412 in the CSP header 402 includes the wildcard character based on the inclusion of the wildcard character in the corresponding dynamic source values ​​306 , 308 and static source values ​​310 , 312 from the CSP definition 302 .

[0050] CSP violation reporting: The CSP reporting service 216 of the CSP management system 206 receives CSP violations from user devices, such as the user device 202, and records the CSP violations in the CSP violation data store 218. A CSP violation occurs when a web application on the user device attempts to call a resource from a source that is not specified in the relevant instructions from the CSP header for the web application. In some configurations, the CSP header is configured to include a URL of the CSP reporting service 216, which the client device uses to route information when a CSP violation occurs. For example, the CSP header 402 includes a portion "report-uri" that specifies the URL "https: / / monitor.ebay.com / csp-report". When the web application attempts to call a source that is not specified in the associated instructions of the CSP header, an application (e.g., a web browser) executing the web application on the user device 202 calls the URL to provide information about the violation, including information identifying the violating source (i.e., the source that was attempted but not included in the associated instructions of the CSP header) and information identifying, for example, the web application, the CSP that was violated, and / or the instructions of the CSP that were violated.

[0051] As described above, the CSP reporting service 216 stores a CSP violation log in the CSP violation data store 218. The CSP violation log includes information related to each CSP violation reported to the CSP reporting service 216. For example, for each CSP violation, the CSP violation log may store information identifying the source of the violation, the web application that attempted to call the source of the violation, the CSP definition that caused the violation, and the instructions of the CSP definition that caused the violation. The CSP manager service 208 interacts with the CSP violation data store 218 to access the violation information and generate a report that is provided to the management device 204. In some cases, the CSP management system 206 incorporates a search engine (such as an Elasticsearch search engine) to allow an administrator to search for CSP violations. Among other things, the administrator can update the CSP definition with information related to the violation recorded in the CSP violation data store 218 to resolve the violation.

[0052] In some cases, the violation sources included in the violation log are trusted sources. Trusted sources are sources that are considered safe sources by the entity. In this case, the CSP management system 206 facilitates updating the CSP definition to include these trusted sources so that they do not trigger violations. Specifically, the CSP management system 206 maintains a list of trusted sources for the entity. The list of trusted sources may include, for example, the entity's own domains and trusted third-party domains (e.g., trust domains for payment, advertising, tracking, security, etc.). According to some aspects, the CSP manager service 208 compares the sources listed in the violation log in the CSP violation data storage 218 with the list of trusted sources to identify the trusted sources in the violation log.

[0053] As an example to illustrate, Figure 5 An example is provided showing identification of trusted sources in a violation log. Specifically, Figure 5 A list of trusted sources 504 and a list of sources from a violation log (e.g., stored in Figure 2 The violation source list 502 of the CSP violation data storage 218 is as follows. Figure 5 As shown, the list of violating sources 502 includes the violating source 506 "srv.main.ebayrtm.com", and the list of trusted sources 508 includes the trusted source 508 "*.ebayrtm.com". Since the violating source 506 matches the trusted source 508 (based on the wildcard in the trusted source 508, i.e., srv.main.ebayrtm.com is a subdomain that matches *ebayrtm.com), the violating source 506 is added to the list of valid sources 510 in violation. Figure 5 As shown, violation source 506 is associated with a CSP definition 512 ("samplecsp") and a specific instruction 514 ("style-src") of CSP definition 512 (ie, the relevant instruction and CSP definition that caused the violation).

[0054] When a match is found between a violating source and the list of trusted sources, the CSP management system 206 facilitates updating the CSP definition corresponding to the CSP header that caused the violation so that the CSP definition includes the trusted source. Figure 5 In the context of the example in , based on identifying "srv.main.ebayrtm.com" as matching a trusted source, the directive "style-src" of the CSP definition "samplecsp" can be updated to include the source "srv.main.ebayrtm.com" (or "*.ebayrtm.com").

[0055] In some configurations, the updating of CSP definitions is fully automatic. Specifically, Figure 2The CSP manager service 208 updates the relevant instructions of the CSP definition to include the identified source. For example, continue Figure 5 For example, the CSP manager service 208 will automatically add "srv.main.ebayrtm.com" (or "*.ebayrtm.com") as a source value to the "style-src" directive of the "samplecsp" CSP definition.

[0056] In some configurations, the updating of the CSP definition is semi-automatic. Specifically, the CSP manager server 208 provides a user interface to the management device 204, the user interface having information identifying the identified match and providing an option to approve the update of the corresponding CSP definition. If the administrator selects the option to approve the update, the CSP manager service 208 updates the relevant instructions of the CSP definition to include the identified source. For example, continue Figure 5 In the example of ...

[0057] In another configuration, the update of the CSP definition is manual. Specifically, the CSP manager service 208 provides a user interface to the management device 204, the user interface having information identifying the identified match (e.g., information identifying the following: the violation source that matches the trust source, the CSP definition that caused the violation, and / or the instruction of the CSP that caused the violation), and the administrator can decide whether to manually update the corresponding CSP definition based on the provided information. For example, continue Figure 5 For example, CSP manager service 208 can provide a user interface to management device 204 indicating that "srv.main.ebayrtm.com" triggered a violation of the "style-src" directive for the "samplecsp" CSP. The administrator can view this information and determine whether to manually update the corresponding CSP definition.

[0058] Example approach for self-healing CSP

[0059] Reference now Figure 6, a flow chart illustrating a method 600 for updating a CSP based on a CSP violation is provided. The method 600 may be performed by, for example Figure 2 The method 600 and any other method described herein may be performed by a CSP management system 206. Each block of the method 600 and any other method described herein includes a computing process performed using any combination of hardware, firmware, and / or software. For example, various functions may be performed by a processor executing instructions stored in a memory. The method may also be embodied as computer usable instructions stored on a computer storage medium. To name a few, the methods may be provided by a standalone application, a service, or a hosted service (standalone or in combination with another hosted service), or a plug-in to another product.

[0060] As shown at block 602, information for a CSP violation is received. The CSP violation information identifies a CSP header that caused the CSP violation and a source of the violation. As discussed herein, a CSP violation occurs when an application (e.g., a web browser) executing a web application attempts to call a source that is not included in the relevant instructions of the CSP header. The source is identified as a violating source.

[0061] The violating source of the CSP violation is compared to a list of trusted sources, as shown at block 604. The list of trusted sources includes secure sources for the entity, including, for example, the entity's own sources and / or known third-party sources. Based on the comparison, the first trusted source in the list of trusted sources is identified as matching the violating source of the CSP violation, as shown at block 606.

[0062] In response to identifying the first trusted source as matching the violating source, the CSP definition associated with the CSP header is updated to include a source value based on the violating source or the first trusted source, as shown at block 608. This provides an updated CSP definition that includes the source value. Thus, when the CSP definition is subsequently used to generate a CSP header for the web application in response to a request for the web application from a client device, the CSP header includes the source value such that if the web application attempts to call a source corresponding to the previous violating source, the source will no longer cause a violation.

[0063] The updating of the CSP definition at block 608 may be performed automatically, semi-automatically, or manually. When performed automatically, the system (e.g., via Figure 2 The CSP manager service 208 of the CSP header automatically identifies the relevant instructions of the CSP header (e.g., based on the information about the CSP violation) and adds a source value to the instruction. The source value is based on the source of the violation and / or the first trusted source that matches. For example, using Figure 5For example, the system may automatically update the "style-src" directive of the "samplecsp" CSP definition by adding a source value of "srv.main.ebayrtm.com" or "*.ebayrtm.com". When performed semi-automatically, initially a management device (e.g., Figure 2 The system automatically updates the CSP definition to include the source value. When executed manually, the system automatically updates the CSP definition to the management device (e.g., Figure 2 The management device 204 of the embodiment provides a user interface that identifies the violation source as matching the first trusted source. The administrator can view this information and use the management device to access the relevant CSP definition from the CSP repository and update the CSP definition by adding the source value.

[0064] Exemplary Operating Environment

[0065] Having described the embodiments of the present disclosure, an exemplary operating environment in which embodiments of the present technology can be implemented is described below to provide a general context for various aspects of the present disclosure. Figure 7 , an exemplary operating environment for implementing embodiments of the present technology is shown and generally designated as computing device 700. Computing device 700 is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality of the technology. Neither should computing device 700 be interpreted as having any dependency or requirement relating to any one or combination of components illustrated.

[0066] The present technology may be described in the general context of computer code or machine-usable instructions, which include computer-executable instructions (such as program modules) executed by a computer or other machine (such as a personal data assistant or other handheld device). Generally, program modules, including routines, programs, objects, components, data structures, etc., refer to code that performs a specific task or implements a specific abstract data type. The present technology may be practiced in a variety of system configurations including handheld devices, consumer electronics, general-purpose computers, more specialized computing devices, etc. The present technology may also be practiced in distributed computing environments, where tasks are performed by remote processing devices linked through a communications network.

[0067] refer to Figure 7, computing device 700 includes bus 710 that directly or indirectly couples the following devices: memory 712, one or more processors 714, one or more presentation components 716, input / output (I / O) ports 718, input / output components 720, and an illustrative power supply 722. Bus 710 represents one or more buses (such as an address bus, a data bus, or a combination thereof). Although for clarity, Figure 7 The various boxes of FIG. 1 are represented by lines, but in reality, depicting the various components is not so clear, and the lines may more accurately be gray and fuzzy. For example, a presentation component such as a display device may be considered an I / O component. In addition, a processor has memory. The inventors recognize that this is the nature of the art and reiterate that Figure 7 The figures are merely illustrative of exemplary computing devices that may be used in conjunction with one or more embodiments of the present technology. No distinction is made between such categories as "workstation," "server," "laptop," "handheld device," etc., as all of these categories are in the same Figure 7 and refers to “computing devices”.

[0068] The computing device 700 typically includes a variety of computer-readable media. Computer-readable media can be any available media that can be accessed by the computing device 700, and includes volatile and non-volatile media, removable and non-removable media. By way of example and not limitation, computer-readable media can include computer storage media and communication media.

[0069] Computer storage media includes volatile and nonvolatile, and removable and non-removable media implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules or other data. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage devices, magnetic cassettes, magnetic tape, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by the computing device 700. Computer storage media themselves do not include signals.

[0070] Communication media typically embodies computer-readable instructions, data structures, program modules, or other data in the form of a modulated data signal (such as a carrier wave or other transmission mechanism), and includes any information transmission medium. The term "modulated data signal" refers to a signal that is set or changed in a manner that encodes the information in the signal, and the signal has one or more characteristics. By way of example and not limitation, communication media include wired media such as a wired network or a direct wired connection, and wireless media such as acoustic, RF, infrared, and other wireless media. Combinations of any of the above should also be included within the scope of computer-readable media.

[0071] Memory 712 includes computer storage media in the form of volatile and / or non-volatile memory. Memory may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard disk drives, optical disk drives, etc. Computing device 700 includes one or more processors that read data from various entities such as memory 712 or I / O components 720. Presentation component 716 presents data indications to a user or other device. Exemplary presentation components include display devices, speakers, printing components, vibration components, etc.

[0072] I / O port 718 allows computing device 700 to be logically coupled to other devices including I / O component 720, some of which may be built-in. Illustrative components include microphones, joysticks, game controllers, satellite dishes, scanners, printers, wireless devices, etc. I / O component 720 may provide a natural user interface (NUI) that processes air gestures, voice, or other physiological inputs generated by a user. In some cases, the input may be sent to an appropriate network element for further processing. NUI may implement any combination of the following: voice recognition, touch and stylus recognition, facial recognition, biometric recognition, gesture recognition both on and near the screen, air gestures, head and eye tracking, and touch recognition associated with a display on computing device 700. Computing device 700 may be equipped with a depth camera such as a stereo camera system, an infrared camera system, an RGB camera system, and a combination thereof for gesture detection and recognition. In addition, computing device 700 may be equipped with an accelerometer or gyroscope capable of detecting motion.

[0073] The present technology has been described with reference to specific embodiments which are intended in all respects to be illustrative rather than restrictive. Alternative embodiments will become apparent to those of ordinary skill in the art to which the present technology pertains without departing from the scope of the present technology.

[0074] Various components used herein have been identified, and it should be understood that any number of components and arrangements can be used to implement the desired functions within the scope of the present disclosure. For example, for conceptual clarity, the components in the embodiments depicted in the accompanying drawings are shown with lines. Other arrangements of these and other components can also be implemented. For example, although some components are depicted as single components, many elements described herein can be implemented as discrete or distributed components or combined with other components, and implemented in any suitable combination and position. Some elements can be omitted completely. In addition, the various functions performed by one or more entities described herein can be performed by hardware, firmware and / or software as described below. For example, various functions can be performed by a processor that executes instructions stored in a memory. Therefore, in addition to or in place of the arrangements and elements shown, other arrangements and elements (for example, machines, interfaces, functions, commands, and functional groups) can also be used.

[0075] The embodiments described herein may be combined with one or more of the specifically described alternatives. Specifically, the claimed embodiments may include references to more than one other embodiment in the alternatives. The claimed embodiments may specify additional limitations of the claimed subject matter.

[0076] The subject matter of embodiments of the present technology is specifically described herein to meet statutory requirements. However, this description itself is not intended to limit the scope of this patent. On the contrary, the inventors have contemplated that the claimed subject matter may also be embodied in other ways in combination with other prior art or future technologies to include different steps or combinations of steps similar to the steps described in this document. In addition, although the terms "step" and / or "box" may be used herein to refer to different elements of the method employed, these terms should not be interpreted as implying any particular order between or among the various steps disclosed herein, unless the order of the various steps is explicitly described.

[0077] For purposes of this disclosure, the word "includes" has the same broad meaning as the word "comprising," and the word "access" includes "receiving," "referencing," or "retrieving." Further, the word "communicates" has the same broad meaning as the word "receiving" or "sending," which is facilitated by a software or hardware-based bus, receiver, or transmitter using the communication media described herein. Furthermore, unless otherwise indicated, words such as "a," "an," and "an" include the plural as well as the singular. Thus, for example, where there are one or more features, the constraint of "a feature" is satisfied. Furthermore, the term "or" includes conjunctions, disjunctions, and both (a or b therefore includes a or b, and a and b).

[0078] For the purpose of the above detailed discussion, embodiments of the present technology are described with reference to a distributed computing environment; however, the distributed computing environment described herein is exemplary only. Components may be configured to perform novel embodiments in the embodiments, where the term "configured to" may refer to "programmed to" perform a specific task or implement a specific abstract data type using code. In addition, while embodiments of the present technology may generally refer to the technical solution environments and schematic diagrams described herein, it should be understood that the described technology may be extended to other implementation contexts.

[0079] From the foregoing it will be seen that the technology is well adapted to attain all of the ends and purposes set forth above, and other advantages which are obvious and inherent to the system and method. It will be appreciated that certain features and subcombinations are of utility and may be employed without reference to other features and subcombinations. This is contemplated by the claims and is within the scope of the claims.

Claims

1. A computer-implemented method comprising: receiving content security policy (CSP) violation information, wherein the CSP violation information identifies a CSP violation of a CSP header and a violation source of the CSP violation; Comparing the violation source of the CSP violation with a list of trusted sources; Identifying a first trusted source in the trusted source list that matches a violating source of the CSP violation; as well as In response to identifying the first trusted source as matching the violating source, causing a CSP definition associated with the CSP header to include a source value based on the violating source or the first trusted source to provide an updated CSP definition.

2. The computer-implemented method of claim 1 , wherein: The method further comprises: receiving a request for a web page; retrieving the updated CSP definition from a repository of CSP definitions; generating an updated CSP header based on the updated CSP definition, the updated CSP header including the source value; and The CSP header is provided as a response header to the requested web page.

3. The computer-implemented method of claim 1 , wherein: The CSP violation information identifies a directive of the CSP header; and wherein the directive of the CSP header is updated to include the source value.

4. The computer-implemented method of claim 1 , wherein: Causing a CSP definition associated with the CSP header to include the source value comprises: The CSP definition is automatically updated to include the source value to provide the updated CSP definition.

5. The computer-implemented method of claim 4, wherein: Automatically updating the CSP definition to include the source value includes: identifying instructions corresponding to the CSP violation; and Directives in the CSP definition are automatically updated to include the source value.

6. The computer-implemented method of claim 1 , wherein: Causing a CSP definition associated with the CSP header to include the source value comprises: A user interface is provided to an administrative device, the user interface having a notification regarding the CSP violation, the notification identifying the source of the violation as matching the first trusted source.

7. The computer-implemented method of claim 6, wherein: The user interface includes a user interface element for approving an update of the CSP definition, and wherein causing the CSP definition associated with the CSP header to include the source value further comprises: receiving, via the user interface element, input approving an update to the CSP definition; and In response to the input, the CSP definition is updated to include the source value to provide the updated CSP definition.

8. One or more computer storage media storing computer usable instructions that, when used by a computing device, cause the computing device to perform operations comprising: receiving content security policy (CSP) violation information, wherein the CSP violation information identifies a CSP violation of a CSP header and a violation source of the CSP violation; Comparing the violation source of the CSP violation with a list of trusted sources; Identifying a first trusted source in the trusted source list that matches a violating source of the CSP violation; as well as In response to identifying the first trusted source as matching the violating source, causing a CSP definition associated with the CSP header to include a source value based on the violating source or the first trusted source to provide an updated CSP definition.

9. One or more computer storage media according to claim 8, wherein: The operations also include: receiving a request for a web page; retrieving the updated CSP definition from a repository of CSP definitions; generating an updated CSP header based on the updated CSP definition, the updated CSP header including the source value; and The CSP header is provided as a response header to the requested web page.

10. One or more computer storage media according to claim 8, wherein: The CSP violation information identifies a directive of the CSP header; and wherein the directive of the CSP header is updated to include the source value.

11. One or more computer storage media according to claim 8, wherein: Causing a CSP definition associated with the CSP header to include the source value comprises: The CSP definition is automatically updated to include the source value to provide the updated CSP definition.

12. One or more computer storage media according to claim 11, wherein: Automatically updating the CSP definition to include the source value includes: identifying instructions corresponding to the CSP violation; and Directives in the CSP definition are automatically updated to include the source value.

13. The one or more computer storage media of claim 8, wherein: Causing a CSP definition associated with the CSP header to include the source value comprises: A user interface is provided to an administrative device, the user interface having a notification regarding the CSP violation, the notification identifying the source of the violation as matching the first trusted source.

14. One or more computer storage media according to claim 13, wherein: The user interface includes a user interface element for approving an update of the CSP definition, and wherein causing the CSP definition associated with the CSP header to include the source value further comprises: receiving, via the user interface element, input approving an update to the CSP definition; and In response to the input, the CSP definition is updated to include the source value to provide the updated CSP definition.

15. A computer system comprising: one or more processors; as well as One or more computer storage media storing computer usable instructions that, when used by the one or more processors, cause the one or more processors to perform operations comprising: receiving content security policy (CSP) violation information, wherein the CSP violation information identifies a CSP violation of a CSP header and a violation source of the CSP violation; Comparing the violation source of the CSP violation with a list of trusted sources; identifying a first trusted source in the trusted source list that matches a violating source of the CSP violation; and In response to identifying the first trusted source as matching the violating source, causing a CSP definition associated with the CSP header to include a source value based on the violating source or the first trusted source to provide an updated CSP definition.

16. The computer system of claim 15, wherein: The operations also include: receiving a request for a web page; retrieving the updated CSP definition from a repository of CSP definitions; generating an updated CSP header based on the updated CSP definition, the updated CSP header including the source value; and The CSP header is provided as a response header to the requested web page.

17. The computer system according to claim 15, wherein: Causing a CSP definition associated with the CSP header to include the source value comprises: The CSP definition is automatically updated to include the source value to provide the updated CSP definition.

18. The computer system of claim 17, wherein: Automatically updating the CSP definition to include the source value includes: identifying instructions corresponding to the CSP violation; and Directives in the CSP definition are automatically updated to include the source value.

19. The computer system of claim 15, wherein: Causing a CSP definition associated with the CSP header to include the source value comprises: A user interface is provided to an administrative device, the user interface having a notification regarding the CSP violation, the notification identifying the source of the violation as matching the first trusted source.

20. The computer system of claim 19, wherein: The user interface includes a user interface element for approving an update of the CSP definition, and wherein causing the CSP definition associated with the CSP header to include the source value further comprises: receiving, via the user interface element, input approving an update to the CSP definition; and In response to the input, the CSP definition is updated to include the source value to provide the updated CSP definition.

Images