Browser Proxy Firewall for DOM Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network and personal firewalls are ineffective against malicious browser plug-ins that run within trusted processes, as they cannot distinguish between legitimate and malicious traffic, making it difficult to protect sensitive data from 'Man in the Browser' attacks.
Innovation Solution
Implementing a Browser Proxy Firewall (BPF) that interposes process-proxy and browser-proxy objects between the browser and external processes, isolating the browser and allowing access only according to predetermined security rules, thereby preventing malicious processes from accessing sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network/personal firewalls are used to filter traffic, then network security is improved, but they become ineffective against malicious plug-ins running within trusted browser processes
Solution Approach 1:
The patent introduces a browser process firewall that acts as an intermediary layer between the browser process and external firewalls. This intermediary monitors and filters DOM access requests at the application level, allowing traditional firewalls to continue filtering network traffic while the new component specifically addresses malicious plug-in access to browser data structures.
Solution Approach 2:
The patent segments the security protection into two distinct layers: network-level filtering by traditional firewalls and application-level DOM access control by the browser process firewall. This segmentation allows each layer to specialize in its domain, with the browser process firewall specifically targeting plug-in access patterns that traditional firewalls cannot detect.
2Ease of operation
If the browser allows full DOM access to external processes, then functionality and ease of operation are improved, but security against malicious processes deteriorates
Solution Approach 1:
The patent implements local quality by applying different access control policies to different processes. The browser process firewall maintains a whitelist of trusted processes that can access the DOM, while blocking access from untrusted or malicious processes. This allows legitimate functionality to continue while preventing harmful access.
Solution Approach 2:
The browser process firewall serves as an intermediary between external processes and the browser's DOM. It intercepts all DOM access requests, verifies the credentials and trust status of the requesting process, and either permits or blocks access accordingly. This mediator approach maintains DOM accessibility for trusted processes while blocking malicious access.
3Reliability
If the browser process firewall implements strict access control, then security is improved, but device complexity increases
Solution Approach 1:
The browser process firewall implements self-service by automatically verifying process credentials, checking whitelist status, and making access decisions without requiring manual configuration for each process. The system maintains its own whitelist database and automatically updates access control decisions based on process identity and trust status.
Solution Approach 2:
The browser process firewall is designed as a universal security component that handles multiple functions: credential verification, whitelist maintenance, DOM access interception, and process identity validation. This multi-functionality consolidates what could be multiple separate security mechanisms into a single integrated component.
Data Source
AI summary
A method for protecting a browser from malicious processes, comprises providing at least one process-proxy object and at least a browser-proxy object, interposed between the browser and a process, such that when the process invokes one of the DOM entry points, the process-proxy object isolates it from the real browser implementation and executes the process-proxy object's code instead.