Mis-matched Font File Prevents Executable Script Execution

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Web-based attacks, such as cross-site scripting (XSS) and cross-site request forgery (CSRF), are difficult to prevent as existing countermeasures like user input validation and character escaping are not effective due to the numerous ways attackers can embed executable code, making it challenging to comprehensively filter and program all possible malicious inputs.

Innovation Solution

The use of purposefully created mis-matched font files that map characters to non-executable code sequences, ensuring that hidden executable code is rendered useless and cannot be executed by the browser while still being displayed as text.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If user input validation and character escaping are used to prevent web-based attacks, then attack prevention is improved, but the complexity of filtering and programming all possible malicious inputs increases

Engineering Contradiction:

Improveattack prevention effectivenessVSAvoidfiltering and programming complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent changes the fundamental parameter of character mapping by introducing a mis-matched font file that maps characters to non-executable code sequences instead of standard executable code. This transforms the execution environment so that any embedded executable code is rendered useless, fundamentally changing how code execution works in the browser without requiring complex filtering mechanisms.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent converts the harmful effect of embedded executable code into a beneficial display by using the mis-matched font to render the code as non-executable text. The harmful executable code is transformed into harmless display content, turning the attack vector into a safety feature that prevents execution while still allowing display.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

2Reliability

If character escaping is used to prevent execution of malicious code, then code execution security is improved, but the ability to display meaningful content is worsened

Engineering Contradiction:

Improvecode execution securityVSAvoiddisplayable content meaning

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent applies local quality by making the font mapping specific to the context of code execution prevention. The mis-matched font file creates a localized transformation where only executable code sequences are affected, while legitimate display content remains intact. This allows selective protection without affecting overall display functionality.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The mis-matched font file acts as an intermediary between the raw code and the display. It translates executable code sequences into non-executable representations while preserving the visual appearance of the content. This intermediary layer enables both security and meaningful display without requiring direct modification of the original content.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20240340305A1Prevention of attacks via requested displayable content

Publication Date: 2024.10.10 GEORGE MASON UNIVERSITY

AI summary

A method and system disable executable script in requested displayable content. Responsive to requesting displayable content, a non-executable code sequence and a mis-matched font file that maps a plurality of characters of the requested displayable content to the non-executable code sequence is received. The non-executable code sequence is displayed as a text string in accordance with the received mis-matched font file.