Closed Shadow DOM Isolation for Secure Web Data Input
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web browser security systems are vulnerable to malicious attacks that intercept sensitive data by overriding built-in APIs and accessing shadow DOMs, allowing attackers to capture user input such as passwords and credit card information.
Innovation Solution
Generating a closed shadow DOM using original browser operations and instantiating an iFrame within the same domain to isolate sensitive data, preventing malicious scripts from accessing the data by using stored native browser methods and maintaining security without the need for separate domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a standard DOM is used to allow access to web page elements, then ease of operation is improved, but security is worsened as attackers can access sensitive data
Solution Approach 1:
The patent divides the DOM into two separate segments: a standard DOM for general web page elements and a shadow DOM for sensitive data elements. This segmentation allows normal web operations to continue using the standard DOM while sensitive data is isolated in the shadow DOM, preventing attackers from accessing sensitive information through the standard DOM interface.
Solution Approach 2:
The shadow DOM acts as an intermediary layer between the standard DOM and sensitive data elements. It provides a controlled interface that allows web pages to access sensitive data through defined methods while blocking unauthorized access paths that would otherwise exist in a standard DOM implementation.
2Reliability
If cross-domain iFrames are used to isolate sensitive data, then security is improved, but device complexity is worsened due to domain management requirements
Solution Approach 1:
The patent merges the isolation benefits of cross-domain iFrames with same-domain operation. By using shadow DOM within the same domain, it combines the security isolation capability with simplified domain management, eliminating the need for complex cross-domain communication protocols while maintaining security boundaries.
Solution Approach 2:
The shadow DOM is nested within the standard DOM structure, creating a hierarchical relationship where the shadow DOM provides an additional layer of isolation without requiring a separate domain context. This nesting allows sensitive data to be embedded within the normal document structure while maintaining security boundaries.
3Ease of operation
If built-in APIs are made accessible for web page functionality, then ease of operation is improved, but security is worsened as attackers can override APIs to capture data
Solution Approach 1:
The patent applies different quality characteristics to different parts of the DOM. Standard DOM elements maintain full API accessibility for normal operations, while shadow DOM elements have restricted API access that prevents overriding. This local differentiation allows web pages to function normally while protecting sensitive data from API-based attacks.
Data Source
AI summary
Systems and methods are provided for storing, at a storage device communicatively coupled to a computer, one or more operations to be executed for a web browser. A closed shadow document object model (DOM) may be generated by a component of a web page to be displayed in the web browser using the one or more of the stored operations. The closed shadow DOM may be configured to receive sensitive data or restricted data. The component of the web page that receives the sensitive data or restricted data may instantiate an inline frame (iFrame) with a same domain as the component. The web page to receive the sensitive data or restricted data via the instantiated iFrame may be displayed on a displayed device from an input device communicatively coupled to the computer for a component of the web page.