Auto-sandboxing Malicious Web Subcomponents via API Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web browsers lack effective protection against tracking and malicious content, as they rely on user intervention and provide limited defense against ever-cookies, browser fingerprinting, and phishing attacks, with existing security measures being insufficient to prevent access to sensitive information.
Innovation Solution
A method and system that automatically sandbox potentially malicious subcomponents of webpages using an auto-sandbox module, intercepting calls to platform APIs and isolating their execution to prevent access to sensitive data, with detection components generating threat notifications and determining sandbox security levels based on the threat level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If process based sandbox architectures are used to protect memory and restrict permissions, then security is improved, but websites can still access sensitive information via standard HTML APIs
Solution Approach 1:
The patent introduces a sandbox filter as an intermediary component between the website and the platform API. This filter intercepts all calls made by website subcomponents to the platform API, preventing direct access to sensitive information while allowing legitimate functionality. The filter acts as a mediator that can inspect, block, or allow API calls based on security policies, thereby resolving the contradiction between maintaining website functionality and preventing unauthorized access to sensitive data.
2Reliability
If private browsing options are provided to protect against information theft, then user privacy is improved, but the user must opt-in and the entire tab/window is affected, and even private browsing is susceptible to fingerprinting and phishing attacks
Solution Approach 1:
The patent implements automatic detection and sandboxing of potentially malicious subcomponents without requiring user intervention. The system autonomously analyzes website content, identifies suspicious elements, and applies appropriate sandboxing measures. This self-service approach eliminates the need for users to manually opt-in to privacy protection modes while providing more granular and effective security compared to whole-tab sandboxing.
3Reliability
If adblock and similar add-ons are used to block trackers, then protection is improved, but the protection is very limited and malicious websites can circumvent these measures easily
Solution Approach 1:
The patent divides the website into subcomponents (such as iframes, scripts, and other embeddable elements) and applies differential sandboxing policies to each subcomponent based on its security risk. Instead of treating the entire website uniformly or relying on crude blocklists, the system segments the content and isolates potentially malicious parts while allowing legitimate content to execute normally. This granular approach makes it difficult for malicious websites to circumvent protection by hiding within legitimate content.
4Reliability
If Chrome safe-browsing and other security measures are implemented, then protection is improved, but the protection is very limited and some measures rely on user intervention
Solution Approach 1:
The patent implements preliminary analysis and detection of website subcomponents before they are fully executed. The system proactively identifies potentially malicious elements through static analysis and heuristic detection, then pre-applies sandboxing measures to prevent them from accessing sensitive information. This preliminary action eliminates the need for users to intervene after threats are detected and provides continuous automatic protection against evolving malicious content.
Data Source
AI summary
Methods and devices for processing web content are disclosed. The method may include receiving a webpage with a browser and parsing the webpage with the browser to obtain subcomponents from the webpage. The browser identifies whether there is an indication that one or more subcomponents of the webpage are potentially malicious, and when there is an indication that the one or more subcomponents of the webpage are malicious, the browser loads the one or more of the subcomponents of the webpage in an auto-sandbox instance for isolated execution by the browser.