Client-Side Pre-Validation Component for Web Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for web application security fail to effectively differentiate between innocent and malicious users, leading to inappropriate security actions that impact user experience and increase system performance consumption.
Innovation Solution
A method and apparatus for security validation of user inputs in network applications, where a pre-validation component on the client side validates user inputs based on a subset of security rules provided by the server-side protection means, allowing for differentiation between first and second class users, with tailored security protection actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If server-side protection means validates all user inputs based on complete security rules, then security validation effectiveness is improved, but system performance consumption increases and user experience deteriorates
Solution Approach 1:
The patent segments the security validation process into two parts: client-side pre-validation using a subset of security rules, and server-side validation using the complete security rules. This segmentation allows the system to perform basic validation checks on the client side to filter out obvious violations, reducing the burden on the server while maintaining overall security effectiveness.
Solution Approach 2:
The patent implements preliminary action by performing security validation on the client side before requests reach the server. The pre-validation component checks user inputs against a subset of security rules and filters out obviously violating inputs, so that only potentially valid requests need to be processed by the server, improving overall system performance.
2Reliability
If server-side protection means blocks requests from users violating security rules, then security protection is improved, but innocent users' experience deteriorates
Solution Approach 1:
The patent applies local quality by providing different security rule subsets to different users based on their validation history and behavior patterns. First-class users receive a more comprehensive subset that provides stronger validation, while second-class users receive a less restrictive subset, allowing the system to maintain security for high-risk users while improving experience for low-risk users.
Solution Approach 2:
The patent changes the parameter of security rule subset composition dynamically. By adjusting which security rules are included in the subset provided to the pre-validation component, the system can balance between security protection and user experience based on observed user behavior and validation results.
3Productivity
If client-side pre-validation component validates user inputs, then server-side workload is reduced, but device complexity on client side increases
Solution Approach 1:
The patent introduces an intermediary component - the pre-validation module - that sits between the user and the server. This module handles the complex security validation logic on the client side, filtering requests before they reach the server and reducing server workload, while encapsulating the complexity within a manageable client-side component.
Data Source
AI summary
According to embodiments of the present invention, a computing device provides a security rules subset of a server-side protection element to a pre-validation component deployed at a client side. The computing device validates the user input based on the security rules. The computing device determines, in response to detecting a user input violation and that a violated security rule has/or has not been provided to the pre-validation component, the user as a first or second class of users. The computing device performs different security protection actions to the first and second class of users. The computing device asynchronously performs a dynamic update to the security rule subset provided to the pre-validation component. The security rule subset is screened from the security rules of the server-side protection means. A policy for screening the security rule subset is selected.