Intermediary Rendering for Client Server Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security techniques fail to effectively prevent malicious attacks, such as 'Man in the Browser' attacks, by not adequately protecting non-secure communications between web browsers and servers, allowing fraudsters to intercept sensitive information.
Innovation Solution
An intermediary computer system intercepts and modifies instructions and requests between web browsers and servers, using attribute and DOM maps to generate new identifiers, thereby preventing malicious requests and protecting sensitive data by rendering different instructions for each request, making it difficult for attackers to determine field identifiers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional client/server communication is used without intermediaries, then communication speed and simplicity are maintained, but security against malicious attacks deteriorates
Solution Approach 1:
An intermediary computer system is introduced between the web browser and web server to intercept, modify, and forward communications. The intermediary generates modified instructions with different field identifiers and forwards them to the browser, while maintaining a mapping between original and modified identifiers. This intermediary layer protects against malicious attacks by preventing attackers from directly accessing or predicting field identifiers, while still allowing legitimate communications to pass through with appropriate modifications.
2Productivity
If field identifiers are kept consistent for caching purposes, then communication efficiency is improved, but security against attacks deteriorates
Solution Approach 1:
The intermediary extracts and separates the identifier transformation function from the original client/server communication. By maintaining a mapping table between original field identifiers and modified field identifiers, the system allows the server to use consistent original identifiers for caching while the browser receives modified identifiers with different values. This extraction of the identifier mapping function enables both efficient caching on the server side and enhanced security on the client side simultaneously.
3Reliability
If instructions are modified for each request to enhance security, then attack resistance is improved, but processing overhead increases
Solution Approach 1:
The intermediary performs preliminary actions by pre-generating modified instructions with different field identifiers before actual client requests are processed. The mapping between original and modified identifiers is established in advance, allowing the intermediary to quickly substitute identifiers during request processing without significant overhead. This preliminary preparation of modified instructions enables enhanced security while minimizing processing time during actual communications.
Data Source
AI summary
In an embodiment, a method comprises intercepting, from a server computer, a first set of instructions that define one or more objects and one or more operations that are based, at least in part, on the one or more objects; generating, in memory, one or more data structures that correspond to the one or more objects; performing the one or more operations on the one or more data structures; updating the one or more data structures, in response to performing the one or more operations, to produce one or more updated data structures; rendering a second set of instructions, which when executed by a remote client computer cause the remote client computer to generate the updated data structures in memory on the remote client computer, wherein the second set of instructions are different than the first set of instructions; sending the second set of instructions to the remote client computer.