Browser Extension Data Obfuscation via Intermediary Security Layer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User confidential data is vulnerable to malicious browser extensions that can access and compromise sensitive information, such as bank account details, during web interactions, especially in systems like Windows Vista where users may inadvertently install malicious browser helper objects (BHOs) with unclear purposes.
Innovation Solution
A security method involving the installation of two browser extensions: a primary security extension that obfuscates user data events and a secondary extension that de-obfuscates them, ensuring user confidential data remains secure by manipulating the browser event notification order and disabling malicious access during data processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If browser extensions are installed to provide functionality, then user convenience and features are improved, but security vulnerabilities and data exposure risks increase
Solution Approach 1:
The patent introduces an intermediary security mechanism that sits between the browser extensions and the confidential data. This intermediary layer (the security application) intercepts, obfuscates, and manages data flow to extensions, allowing functional extensions to operate while preventing them from directly accessing unencrypted confidential data. The intermediary resolves the contradiction by enabling extension functionality while blocking direct data exposure paths.
Solution Approach 2:
The security application performs preliminary actions by installing itself as a browser extension before other extensions, and by pre-obfuscating confidential data before it reaches any extensions. This preliminary obfuscation ensures that when extensions need to access data for their functionality, they only receive already-protected obfuscated data, not plain confidential information. This resolves the security risk while maintaining extension adaptability.
2Reliability
If user data is encrypted to protect confidentiality, then security is improved, but data processing capability deteriorates
Solution Approach 1:
The patent applies local quality by selectively obfuscating only the confidential data portions of events while leaving other event data unchanged. The obfuscation is applied locally to specific data fields (such as form inputs containing confidential information) rather than encrypting the entire event structure. This allows extensions to efficiently process non-confidential event data without the overhead of decryption, while confidential data remains protected. The local application of obfuscation resolves the contradiction between confidentiality and processing efficiency.
3Reliability
If security measures are implemented to protect data, then data security is improved, but system complexity increases
Solution Approach 1:
The security application provides self-service by automatically managing the obfuscation and de-obfuscation of confidential data without requiring manual intervention or complex configuration. The system self-regulates by intercepting events, identifying confidential data, applying obfuscation, and then restoring the data after extensions have processed it. This automated self-service approach implements robust security measures while minimizing the complexity burden on the user and system administrators.
Data Source
AI summary
Embodiments in accordance with the invention install a primary security browser extension first in the browser event notification order list and a secondary security browser extension last in the event notification order list. On receipt of a user data event including user confidential data at the primary security browser extension, the user confidential data is obfuscated by the primary security browser extension and the user data event including the obfuscated data is released to a next browser extension in the browser event notification order list. Upon receipt of the user data event at the secondary security browser extension, the obfuscated data is restored with the original user confidential data and the user data event is released for further processing.