Headless Browser Security via Instruction Sanitization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Browsers are vulnerable to malicious attacks where attackers embed instructions in web content, leading to the installation of malware on client computers, which can compromise sensitive data and execute unauthorized operations.

Innovation Solution

Implementing a headless browser that intercepts instructions from a server, executes them without presenting a user interface, and generates new instructions to be sent to a client application, thereby preventing malicious code execution and enhancing security by separating the browser backend from the frontend and using a hardened client application with security mechanisms.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a browser executes instructions received from a web server to generate user interfaces, then the browser can present complex interactive content to users, but the browser becomes vulnerable to malicious attacks where attackers embed malicious instructions in web content

Engineering Contradiction:

Improvebrowser functionalityVSAvoidmalware installation risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The browser is divided into two separate components: a headless browser that executes instructions on the server and a frontend client application that presents the user interface. This segmentation allows the server to validate and sanitize instructions before they reach the client, preventing malicious code execution while preserving full browser functionality through the client application.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The headless browser acts as an intermediary between the web server and the client application. It receives instructions from the server, executes them in a controlled environment without a user interface, validates the results, and then sends sanitized output to the client application. This intermediary layer blocks malicious instructions from reaching the vulnerable client browser.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If a browser restricts functionality to prevent malware installation, then security is improved, but the browser loses the ability to execute necessary instructions and present complex user interfaces

Engineering Contradiction:

ImprovesecurityVSAvoidbrowser functionality

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

By separating the instruction execution function (headless browser on server) from the interface presentation function (client application), the system allows full functionality to be executed in the controlled server environment while the client application only receives validated, sanitized output, thus maintaining both security and functionality.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The headless browser creates a copy of the instruction execution process on the server side. Instead of restricting the client browser's functionality, the system replicates the execution capability on the server where instructions can be safely validated and sanitized before being presented to the user through the client application.

Inventive Principle:

Principle #26Copying

3Object-affected harmful factors

If a headless browser executes instructions without presenting a user interface, then malicious code execution is prevented, but the system requires additional infrastructure and complexity

Engineering Contradiction:

Improvemalware installation riskVSAvoidsystem architecture

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The headless browser serves as a necessary intermediary that adds a validation layer between the server and client. While this introduces architectural complexity, it creates a controlled execution environment that prevents malicious code from reaching the client, justifying the added infrastructure through enhanced security.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system replaces the traditional mechanical browser execution model with a virtualized headless execution environment on the server. This substitution allows instructions to be executed in a controlled, sandboxed manner without requiring a physical user interface, preventing malware installation while maintaining functionality through automated validation.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS10834082B2Client/server security by executing instructions and rendering client application instructions

Publication Date: 2020.11.10 SHAPE SECURITY INC

AI summary

In an embodiment, a method comprises intercepting, from a server computer, a first set of instructions that define a user interface; executing, using a headless browser, the first set of instructions without presenting the user interface; rendering a second set of instructions, which when executed by a client application on a client computer, cause the client computer to present the user interface, wherein the second set of instructions are different than the first set of instructions; sending the second set of instructions to the client computer.