Browser Script Security via Signature Hash Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting sensitive information from malicious browser-based scripts are limited, as they either restrict client device functionality or impose significant processing and bandwidth burdens on web servers, and there is a need for improved detection and mitigation strategies.
Innovation Solution
A system and method that identifies and verifies the safety of web browser scripts by calculating a signature hash and querying a browser script signature database to apply a script security policy, allowing safe scripts to access sensitive information while blocking malicious ones, thereby protecting sensitive information without overburdening the web server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic virtualization of client device's script interpreter is used to move processing to web-server side, then security protection is improved, but device functionality is limited and server burden increases
Solution Approach 1:
The system segments the security verification function from the script execution function. The client device performs script execution locally to maintain full functionality, while separately verifying script safety through signature hashing and database querying. This segmentation allows both full device functionality and security protection to coexist without compromising either.
Solution Approach 2:
The patent introduces a signature hash and database as intermediaries between the script execution and security verification processes. Instead of directly controlling script execution through virtualization, the system uses cryptographic signatures as a mediator to verify script safety, allowing scripts to execute normally on client devices while maintaining security through the intermediary verification layer.
2Reliability
If dynamic virtualization of script interpreter is implemented, then security is improved, but network bandwidth and processor resources are consumed
Solution Approach 1:
The patent extracts the heavy computational burden of script verification from the server by implementing cryptographic signature hashing and database querying on the client device side. The server only needs to store and retrieve signature hashes, which is a fraction of the processing required for full script virtualization, thereby significantly reducing server processor burden while maintaining security.
Solution Approach 2:
Instead of creating a virtual copy of the entire browser environment on the server, the system creates and verifies a cryptographic copy (signature hash) of the script's identity. This lightweight copying approach allows the server to verify script safety without replicating the complex virtualization infrastructure, reducing both processor burden and network bandwidth requirements.
3Adaptability or versatility
If all scripts are executed on client device, then device functionality is maintained, but malicious scripts can access sensitive information
Solution Approach 1:
The system performs preliminary security verification by calculating and storing cryptographic signature hashes of approved scripts before they are executed. When a script needs to access sensitive information, its signature is queried against the database of pre-verified safe scripts. This preliminary action ensures that only previously approved scripts can execute, preventing malicious scripts from accessing sensitive information while maintaining full device functionality for authorized scripts.
Data Source
AI summary
A computer-implemented method for detecting malicious browser-based scripts may include (1) identifying an attempt by a web browser to access sensitive information stored on a server, (2) identifying a web browser script installed in the web browser, (3) calculating a signature hash for the web browser script, (4) querying, using the signature hash, a browser script signature database that associates web browser script signature hashes with script security indicators, (5) receiving, in response to querying the browser script signature database, a script security indicator associated with the signature hash, and (6) applying, based on the script security indicator associated with the web browser script, a script security policy associated with the web browser script. Various other methods, systems, and computer-readable media are also disclosed.