Proxy Engine Script Shield for XSS Zone Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web users are vulnerable to malicious executable code threats, particularly cross-site scripting (XSS), which allows malicious entities to inject harmful scripts into web pages, despite security measures, as existing filters may not detect executable code hidden in markup language content.
Innovation Solution
A proxy engine intercepts communications between a web browser and script engine, invoking custom event handlers to detect and prevent the execution of malicious scripts in defined script-free zones, using a script shield mechanism to block impermissible script execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If executable code is allowed in web content, then web functionality and interactivity are improved, but security risks increase due to malicious scripts
Solution Approach 1:
The patent segments web content into script-free zones and non-script-free zones using markup language tags. This allows executable code to be permitted in non-script-free zones for functionality, while script-free zones maintain security by blocking script execution. The segmentation resolves the contradiction by spatially separating secure and functional areas within the same web page.
Solution Approach 2:
The patent introduces a proxy engine as an intermediary between the web browser and script engine. The proxy engine intercepts script events, determines whether they originate in script-free zones, and blocks or permits execution accordingly. This intermediary mechanism enables fine-grained control over script execution, allowing functionality where needed while maintaining security where required.
2Reliability
If filtering processes are employed to detect malicious script, then security is improved, but detection precision deteriorates because executable code can be hidden in markup language content
Solution Approach 1:
The patent applies preliminary action by establishing script-free zones in advance using markup language tags before any script execution occurs. The proxy engine is pre-configured to recognize these zones and automatically block script events originating within them. This preliminary structuring of content allows for precise detection and blocking of malicious scripts without requiring complex real-time analysis of hidden code.
3Reliability
If script execution is completely blocked, then security is improved, but web functionality deteriorates due to loss of legitimate script operations
Solution Approach 1:
The patent applies local quality by making different regions of web content have different script execution properties. Script-free zones are designated with specific markup tags where script execution is blocked for security, while non-script-free zones allow script execution for functionality. This local differentiation resolves the contradiction by allowing security and functionality to coexist in different parts of the same web page.
Solution Approach 2:
The proxy engine acts as an intelligent intermediary that selectively permits or blocks script execution based on the origin location. Rather than completely blocking all scripts, it intercepts each script event, determines whether it originates in a script-free zone, and makes an informed decision to allow or deny execution. This selective mediation maintains both security and functionality.
Data Source
AI summary
Processes and techniques for protecting web users from malicious executable code are described. A proxy engine is implemented that intercepts communications between a web browser and a script engine. The proxy engine can invoke a variety of custom event handlers that are configured to handle specific types of events (e.g., script events) that occur in the processing of web content. A script shield event handler detects the presence of script in pre-defined script-free zones and prevents the script from being executed on a user's device.