Active Content Script Signature Validation for Malware Protection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing solutions fail to effectively ensure the trustworthiness of active content in web pages by not providing a method to selectively disable untrusted active content and do not enhance the trust factor of embedded scripts, leaving users vulnerable to malicious software inserted during transit.

Innovation Solution

Dynamic signing of active content at a web server or gateway, including a digital signature and attributes, which is validated by a secure enclave module in the client browser to authenticate origin and authorized use, thereby ensuring the trustworthiness of the content before execution.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If HTTPS protocol is used to encrypt data flow between web browser and server, then data connection security is improved, but embedded scripts within web pages remain unprotected from malware

Engineering Contradiction:

Improvedata connection securityVSAvoidembedded script malware

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the web page content into passive content and active content, applying different security treatments. Passive content receives standard HTTPS protection, while active content (scripts) is further segmented into trusted and untrusted portions through signature validation, allowing selective execution of only the signed, trusted script segments.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a signature validation mechanism as an intermediary layer between the server and browser. This intermediary verifies digital signatures on active content, acting as a mediator that determines whether scripts should be executed, thereby protecting against malware without blocking legitimate functionality.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If conventional security solutions are implemented, then general web security is improved, but selective disabling of untrusted active content within web pages cannot be achieved

Engineering Contradiction:

Improveweb securityVSAvoidselective content disabling capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent applies local quality by treating different portions of web page content differently. Instead of applying a blanket security policy to all content, the system validates signatures individually for each active content element, allowing trusted scripts to execute while blocking only untrusted portions, thus achieving selective disabling capability.

Inventive Principle:

Principle #3Local quality

3Reliability

If content security policy (CSP) is used to prevent loading of inline JavaScript, then browser security is improved, but trust factor enhancement for active content cannot be achieved

Engineering Contradiction:

Improvebrowser securityVSAvoidtrust factor validation

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The patent implements preliminary action by pre-signing active content with digital signatures before deployment. This preliminary authentication allows the browser to verify trustworthiness in advance of execution, enabling precise trust factor measurement and validation rather than relying on blanket CSP restrictions.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS9935995B2Embedded script security using script signature validation

Publication Date: 2018.04.03 JPMORGAN CHASE BANK N A AS ADMINISTATIVE AGENT

AI summary

A technique allows a client computer with a web browser to receive a web page having active content in response to transmitting a request for content. The active content includes a signature and a set of attributes associated with a web domain. The web browser can interpret the signature and the set of attributes as formatted in the active content. Validation of the signature and the set of attributes can be in a secure mode through a secure enclave module.