Client-Side Storage Security Analysis for Web Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security systems are inadequate in protecting against data loss and exposure due to vulnerabilities in local caches of sensitive data, especially with new standards like HTML5 and restricted mobile computing platforms that hinder data loss prevention systems.
Innovation Solution
A system and method for analyzing client-side storage security by simulating interactions with Internet applications to identify and track sensitive inputs locally stored, providing a security rating and facilitating the removal of sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional scanning techniques are used to protect against data loss, then security protection is provided, but new standards like HTML5 interfere with these techniques making them ineffective
Solution Approach 1:
The system performs preliminary analysis of Internet applications during development or deployment to identify and flag potential security vulnerabilities before they can be exploited. This includes analyzing code for insecure data handling practices, identifying improper local storage of sensitive data, and detecting cross-site scripting vulnerabilities before the application goes live, thereby preventing security issues rather than just responding to them.
Solution Approach 2:
The patent replaces traditional mechanical scanning techniques with advanced analysis methods including static analysis, dynamic analysis, and symbolic execution. These methods can penetrate HTML5 and other modern web standards to detect security vulnerabilities that traditional scanners miss. The system uses automated analysis engines that can understand and analyze modern web application architectures, replacing outdated scanning mechanisms with intelligent analysis systems.
2Reliability
If system-level software is installed to access locally stored data, then data loss prevention capability is improved, but restricted mobile computing platforms prevent installation of such software
Solution Approach 1:
The system introduces an intermediary analysis layer that operates between the user and the Internet application without requiring direct access to the device's file system or installation of system-level software. The intermediary analyzes network traffic, application behavior, and data flow to identify security vulnerabilities and prevent data loss, effectively mediating security protection without needing to bypass platform restrictions.
Solution Approach 2:
The system creates virtual copies or models of the Internet application's data handling processes to analyze security vulnerabilities without directly accessing or modifying actual sensitive data on the device. By analyzing copies of data flows and application behavior, the system can identify security issues and provide protection recommendations without requiring deep system access or installation on restricted platforms.
3Speed
If local caches are created for faster data access, then data access speed is improved, but vulnerabilities to attacks like cross-site scripting increase
Solution Approach 1:
The system applies preliminary anti-action by identifying and neutralizing security vulnerabilities in local caching mechanisms before they can be exploited by attackers. The analysis process detects improper storage of sensitive data in local caches, identifies cross-site scripting vulnerabilities, and provides recommendations to secure or remove vulnerable cached data, preventing attacks before they occur rather than responding after exploitation.
Solution Approach 2:
The system converts the potential harm of local caches into a benefit by using the cached data structures and analysis mechanisms to identify security vulnerabilities. The same local storage mechanisms that create security risks are analyzed to detect vulnerabilities, and the insights gained are used to improve security configurations, effectively turning the security liability into a security improvement opportunity.
Data Source
AI summary
A computer-implemented method for analyzing client-side storage security for Internet applications may include 1) identifying an interactive Internet resource, 2) identifying at least one input field for entering sensitive data within the interactive Internet resource, 3) identifying at least one instance of local client-side storage performed by the interactive Internet resource by simulating at least one interaction with the interactive Internet resource, and 4) comparing the instance of local client-side storage with a content of the input field to determine that the interactive Internet resource performs local client-side storage of sensitive data. Various other methods, systems, and computer-readable media are also disclosed.