Client-Side Script Enforcement for Secure Web Application Mutations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web applications are vulnerable to script injection attacks, which allow malicious data with embedded scripts to compromise user activities and devices, as existing security measures fail to effectively enforce security policies at the client-side during dynamic page modifications.
Innovation Solution
A client-side enforcement mechanism using Mutation-Event Transforms (METs) that specify and enforce security policies as JavaScript functions, transforming mutations to ensure compliance before they take effect, and a replicated code execution approach to verify method calls from the client against a trusted shadow copy on the server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security policies are enforced by checking all script modifications on the client side, then security against script injection attacks is improved, but system performance and execution speed deteriorate due to continuous validation overhead
Solution Approach 1:
The patent applies preliminary action by establishing security policies and validation rules before script execution begins. The system pre-defines which DOM elements and script modifications are permitted, creating a whitelist of acceptable operations. This allows the runtime enforcement mechanism to quickly check against pre-established rules rather than performing complex analysis during each modification event, thus maintaining security while improving execution speed.
Solution Approach 2:
The patent introduces an intermediary enforcement mechanism that sits between the client-side script and the DOM manipulation operations. This intermediary layer intercepts script attempts to modify DOM elements and validates them against security policies before allowing execution. By placing this mediation layer, the system achieves thorough security checking without requiring complete rewriting of all client scripts, thus balancing security and performance.
2Reliability
If security policies restrict all script modifications to prevent attacks, then security is improved, but functionality and adaptability of web applications deteriorate
Solution Approach 1:
The patent applies local quality by implementing fine-grained security policies that differentiate between various DOM elements and script modification contexts. Instead of applying uniform restrictions to all script operations, the system defines element-specific and context-specific security rules. This allows legitimate functional modifications to permitted elements while blocking malicious changes to restricted elements, thus maintaining both security and application functionality.
Solution Approach 2:
The patent implements dynamic security enforcement where policy application adapts based on runtime conditions. The enforcement mechanism evaluates security policies dynamically during script execution, allowing legitimate modifications that meet security criteria while blocking malicious ones. This dynamic approach enables the system to maintain security while preserving necessary application adaptability and functionality.
3Measurement precision
If the server runs a shadow copy of the client application to verify method calls, then detection precision of unauthorized scripts is improved, but device complexity and computational resources worsen
Solution Approach 1:
The patent applies the copying principle by creating a shadow copy of the client application logic that runs on the server. This shadow copy mirrors the client-side execution path and generates expected method call sequences. By comparing actual client calls against the shadow copy's expected sequence, the system achieves high detection precision for unauthorized scripts. The copying approach allows verification without requiring complete reimplementation of security checking logic.
Solution Approach 2:
The patent implements feedback mechanisms where the shadow copy continuously monitors and compares client behavior against expected patterns. When deviations are detected, the system provides feedback by blocking the unauthorized script execution and optionally notifying the user. This feedback loop enables precise detection of malicious activities while maintaining system manageability through automated response protocols.
Data Source
AI summary
A client-side enforcement mechanism may allow application security policies to be specified at a server in a programmatic manner. Servers may specify security policies as JavaScript functions included in a page returned by the server and run before other scripts. At runtime, and during initial loading, the functions are invoked by the client on each page modification to ensure the page conforms to the security policy. As such, before a mutation takes effect, the policy may transform that mutation and the code and data of the page. Replicated code execution may take place at both the client and the server where the server runs its own shadow copy of a client-side application in a trusted execution environment so that the server may check that the method calls coming from the client correspond to a correct execution of the client-side application The redundant execution at the client can be untrusted, but serves to improve the responsiveness and performance of the Web application.