Client Device Sensitive Data Leakage Prevention via Third-Party Code Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing networked applications face challenges in detecting and preventing the improper transmission of sensitive data when third-party code is executed on client devices, as this code may not be developed or analyzed by the application deployment system, potentially leading to data leaks.
Innovation Solution
A client device is equipped with a browser or application that identifies sensitive data inputs, monitors third-party code executions, and prevents or reports any attempts to transmit sensitive data to unauthorized systems by analyzing message requests and using instrumentation or breakpoints to intercept and analyze communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If third-party code is executed on the client device to provide application features, then the application functionality and versatility are improved, but the risk of sensitive data leakage to unauthorized systems increases
Solution Approach 1:
The patent introduces an intermediary monitoring system that sits between the third-party code and the sensitive data. This intermediary (implemented through instrumentation of the code interpreter or breakpoint mechanisms) intercepts and analyzes messages before they are transmitted, allowing third-party code to execute freely while preventing unauthorized data transmission. The intermediary validates message contents against identified sensitive data patterns and blocks or alerts on potential leaks.
Solution Approach 2:
The system implements continuous feedback by monitoring third-party code execution in real-time and comparing transmitted messages against identified sensitive data. When a potential data leak is detected, the system provides immediate feedback through alerts to the application deployment system or by preventing the transmission. This closed-loop feedback mechanism allows the system to adapt and respond to unauthorized data transmission attempts dynamically.
2Reliability
If monitoring is implemented to detect sensitive data transmission by third-party code, then data security is improved, but the device complexity and computational overhead increase
Solution Approach 1:
The system performs preliminary action by identifying and flagging sensitive data fields before third-party code execution begins. The application deployment system or operator designates specific fields as containing sensitive data through flags or security scans. This pre-identification creates a reference set of sensitive data patterns that the monitoring system can quickly compare against transmitted messages, reducing the complexity of real-time analysis.
Solution Approach 2:
The monitoring system creates copies of transmitted messages from third-party code for analysis, rather than directly intercepting and blocking original communications. By working with message copies, the system can perform comprehensive security analysis without disrupting the normal execution flow or requiring complex inline interception mechanisms. The original message transmission can proceed while the copy is analyzed for sensitive data patterns.
3Measurement precision
If comprehensive monitoring of all third-party code communications is performed, then detection precision is improved, but the processing time and productivity are reduced
Solution Approach 1:
The system applies local quality by focusing monitoring efforts specifically on identified sensitive data fields and their transmission paths, rather than uniformly monitoring all communications. The instrumentation or breakpoint mechanisms are strategically placed only where sensitive data is likely to be transmitted. This selective monitoring approach maintains high detection precision for sensitive data while minimizing the processing overhead associated with analyzing unrelated communications.
Solution Approach 2:
The system implements partial action by monitoring only the specific messages and communication channels that are relevant to sensitive data transmission, rather than analyzing all third-party code communications in exhaustive detail. The monitoring focuses on messages that contain or reference identified sensitive data fields, allowing the system to achieve adequate detection precision for security purposes while processing a manageable subset of communications that maintains application execution speed.
Data Source
AI summary
An application deployment system provides one or pages of an application to a client device. The pages may specify application code for performing functions and presenting content of the application by the client device as well as a reference to third-party code. As users interact with the page on the client device, the user may interact with the page to add sensitive data for transmission to the application deployment system or receive sensitive data from the application deployment system. To detect and prevent inappropriate use by the third party code, messages relating to the third-party code is monitored for requests to send messages that contain information matching the user information. When there is a match, the message may be prevented from transmission or the application developer notified about the sensitive data request.