Browser Context Emulation Detection for Proxy Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Unmanaged client computing devices can bypass security policies by renaming files to evade restrictions, such as converting document files to image files to download them, which undermines security measures.
Innovation Solution
Implement multi-layer browser-based context emulation detection through a proxy that parses request and response headers and bodies, injects JavaScript code to maintain context, and enforces policies based on context detection rules, ensuring accurate policy enforcement without installing agents on client devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security policies are implemented by routing browser activity through a proxy, then security control is improved, but users can bypass policies by renaming files (e.g., converting .docx to .png), which reduces measurement precision
Solution Approach 1:
The patent moves from single-layer file extension detection to multi-layer context detection by adding dimensions: response header analysis, response body inspection, and JavaScript code injection. This multi-dimensional approach detects the true file context regardless of renaming, resolving the contradiction between security enforcement and detection accuracy
Solution Approach 2:
The patent introduces JavaScript code as an intermediary between the browser and the proxy server. This injected code maintains and transmits file context information through subsequent requests, enabling the proxy to accurately detect file types even when renamed, thus improving measurement precision while maintaining security policy enforcement
2Measurement precision
If file context detection is performed through response inspection, then detection accuracy is improved, but system complexity increases due to multi-layer parsing and code injection
Solution Approach 1:
The patent segments the context detection process into distinct layers: response header parsing, response body inspection, and JavaScript code injection. Each layer handles specific detection tasks independently, which improves measurement precision while making the complex system more manageable through modular organization
Solution Approach 2:
The patent performs preliminary actions by injecting JavaScript code into the response during the initial interaction. This code establishes context tracking capabilities in advance, enabling accurate detection in subsequent requests without requiring complex real-time analysis, thus improving detection accuracy while managing system complexity
Data Source
AI summary
Methods, systems and computer program products are provided for multi-layer, browser-based context emulation detection, which may be implemented by a proxy for browsers. A policy may be enforced against requests if a request context indicates a restricted context. Context may be detected and indicated in a response header and body based on one or more context detection/indication rules. Context may be indicated by marking or not marking resources indicated in responses. Code may be injected to cause the client web browser to indicate context. A response may be forwarded to the client with a response header context, a response body context, and/or injected code, which a client browser may process to generate a request with one or more indications of request context.