Browser Process Isolation for Web Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current browsers with multi-process architectures are vulnerable to security breaches, as a single browser process manages information from multiple webpages, risking leakage of sensitive information if compromised by malware or attacks like Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF).
Innovation Solution
The method involves separating browser processes based on access privileges, where each webpage is assigned a specific set of terminal access privileges, and the browser process is executed accordingly, with rendering allowed only if the privileges match, and using a separate process if they do not, thereby preventing unauthorized access and privilege escalation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a single browser process manages information from multiple webpages to enable concurrent browsing, then browsing efficiency and resource utilization are improved, but security is worsened as sensitive information may be leaked if the browser process is compromised by malware
Solution Approach 1:
The patent divides the browser into multiple isolated processes: browser processes (handling high-level operations like downloads and history) and renderer processes (handling webpage rendering and JavaScript execution). Each renderer process is further segmented to handle specific webpages with restricted access to sensitive information. This segmentation ensures that if one renderer process is compromised, the breach is contained and cannot affect other processes or access sensitive data stored in the browser process.
2Reliability
If browser processes are separated for each webpage to enhance security, then security is improved as malware cannot spread across processes, but device complexity increases due to multiple isolated processes
Solution Approach 1:
The patent introduces a shared browser process that provides universal services to multiple renderer processes. This single browser process handles common functions including downloads, history, cookies, and clipboard operations, eliminating the need for each renderer process to have its own separate instance of these components. The renderer processes can be created and destroyed as needed without affecting the persistent browser process, simplifying resource management while maintaining security isolation.
3Use of energy by moving object
If a single browser process handles all operations including downloads and history services, then resource utilization is improved, but the ability to prevent privilege escalation attacks is worsened
Solution Approach 1:
The patent implements asymmetric privilege distribution where the browser process operates with elevated privileges to access sensitive system resources (downloads, history, cookies), while renderer processes operate with restricted privileges limited to their specific webpage contexts. The operating system enforces these different privilege levels, ensuring that renderer processes cannot escalate their privileges to access sensitive information or perform operations outside their designated scope, even if compromised by malware.
Data Source
AI summary
A method for providing a browser using browser processes separated based on access privileges and an apparatus using the method. The method includes acquiring a first address corresponding to a first webpage; acquiring a first set of terminal access privileges based on the first address from a privilege control list and executing a first browser process corresponding to the first set of terminal access privileges; determining whether to allow rendering by comparing the first set of terminal access privileges with a second set of terminal access privileges corresponding to a second webpage when the first browser process attempts to render the second webpage; and if the rendering is not allowed, blocking the first browser process from rendering and rendering the second webpage by executing a second browser process corresponding to the second set of terminal access privileges.