Active Filter for Web Browser Code Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cross Site Scripting (XSS) attacks pose a significant security vulnerability as malicious executable code can be transmitted between web servers and clients, often going undetected and unauthenticated, posing a risk to both server and client devices.
Innovation Solution
An active filter monitors web browser sessions to identify and verify executable code, ensuring it is digitally signed by a trusted source before execution, and rejecting unauthenticated code, which can be implemented as a web browser component, plugin, gateway device, or server-side service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If executable code is transmitted between web servers and clients without authentication, then code execution freedom is improved, but security vulnerability increases
Solution Approach 1:
The patent applies preliminary action by implementing digital signature verification before code execution. The system checks the digital signature of executable code prior to allowing it to run, preventing XSS attacks while maintaining legitimate code execution. This advance verification resolves the contradiction by ensuring security is established before code is executed.
Solution Approach 2:
The patent uses digital signatures as an intermediary mechanism between code transmission and execution. The digital signature acts as a mediator that authenticates the code's origin and integrity, allowing the system to distinguish between trusted and untrusted code without blocking all execution. This intermediary approach resolves the contradiction by providing a verification layer that maintains both security and execution freedom.
2Reliability
If digital signature verification is implemented for executable code, then security against XSS attacks is improved, but system complexity increases
Solution Approach 1:
The patent applies self-service by leveraging the browser's existing digital signature verification capabilities. Instead of implementing a complex custom verification system, the patent utilizes the browser's built-in security features to automatically verify digital signatures. This self-service approach resolves the contradiction by avoiding additional complexity while maintaining security.
Solution Approach 2:
The patent uses the universal digital signature mechanism that serves multiple functions: authentication, integrity verification, and origin validation. This multi-functional approach eliminates the need for separate verification systems, reducing overall complexity while providing comprehensive security against XSS attacks.
3Adaptability or versatility
If unauthenticated executable code is executed, then functional versatility is improved, but risk of malicious code infiltration increases
Solution Approach 1:
The patent applies preliminary action by verifying digital signatures before code execution. This advance check ensures that only authenticated code is executed, preventing malicious code infiltration while maintaining the ability to execute legitimate code from various sources. The verification occurs prior to execution, allowing functional versatility to be maintained without compromising security.
Solution Approach 2:
The patent uses digital signatures as an intermediary that enables functional versatility while preventing harm. The signature verification mechanism allows the system to accept code from multiple trusted sources without exposing the system to malicious infiltration. This intermediary layer resolves the contradiction by providing a trust framework that supports versatility while blocking harmful code.
Data Source
AI summary
An active filter monitors a web browser session to identify executable code transmitted in the session. The executable code may be analyzed to determine if the code is digitally signed. When the code is digitally signed by the web server or by another trusted source, the code may be executed. When the code is neither digitally signed or when the source is not trusted, the code may be rejected and not executed. The filter may be implemented as a web browser component or plugin, as well as a gateway device, proxy, or other service. The filter may also be implemented on the server side to reject incoming data that may include unauthenticated code.