Dynamic Client-Side Code Retrieval via Server Stubs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web pages and applications expose significant portions of their source code at the client-side, making it vulnerable to unauthorized access and reverse engineering, as existing obfuscation methods are not sufficient to protect this valuable intellectual property.
Innovation Solution
Implement a system where only an initial definition of a web page or application is provided to the client, with client-side code being dynamically retrieved from the server on demand, using stubs or dedicated functions like 'do' to fetch and execute code as needed, ensuring the code is not persistently stored and is difficult to reconstruct.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If all client-side code is provided to the client machine, then the web page or application can be fully executed at the client, but the source code becomes easily accessible and vulnerable to reverse engineering
Solution Approach 1:
The patent divides client-side code into multiple segments: an initial definition containing only stubs or placeholders is provided to the client, while the actual code segments remain on the server. The code is delivered in pieces as needed during execution, preventing complete exposure of source code while maintaining full functionality.
Solution Approach 2:
The patent introduces an intermediary mechanism (code retrieval logic with stubs) that mediates between the client and server. The stubs act as placeholders that trigger dynamic code retrieval from the server, allowing client-side execution without directly exposing the complete codebase to the client.
2Object-affected harmful factors
If code is dynamically retrieved on demand using stubs, then code protection is improved, but the system complexity increases
Solution Approach 1:
The patent implements self-service through automatic code retrieval logic embedded in the client. When a stub is encountered during execution, the system automatically retrieves the corresponding code segment from the server without user intervention, managing complexity through automation rather than manual processes.
Solution Approach 2:
The patent uses preliminary action by pre-defining stubs in the initial page definition that correspond to future code segments. These stubs are prepared in advance with identifiers that match server-side code segments, enabling seamless dynamic retrieval without requiring complex runtime analysis or user input.
3Speed
If code is stored persistently on the client, then execution speed is improved, but code accessibility to malicious users increases
Solution Approach 1:
The patent implements periodic action by retrieving code segments on-demand during execution rather than loading all code upfront. Code is fetched periodically as needed when stubs are encountered, balancing execution speed with security by minimizing the time code resides on the client and reducing the attack window.
Data Source
AI summary
Protecting client-side code is disclosed. In some embodiments, when a request for a page is received from a client, an initial definition of the page is provided to the client wherein the initial definition includes a reference to a piece of client-side code not included in the initial definition and a code retrieval logic which, when executed at the client, results in the piece of client-side code being obtained dynamically from an associated server at runtime when the piece of client-side code is desired to be executed at the client. A client receives such an initial definition of a requested page from an associated server of the page. When an indication that the piece of client-side code is desired to be executed is received, the code retrieval logic is executed to obtain the piece of client-side code dynamically from the associated server.