Random URI Web Server for Client Screen Falsification Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods are inadequate in preventing client screen falsification due to web injection and memory hacking attacks, as they fail to detect mutant malicious code and require user-dependent solutions, and address space randomization is ineffective against web injection attacks.
Innovation Solution
An apparatus and method that generate random Uniform Resource Identifiers (URIs) and web sources dynamically, allowing clients to compare display web source eigenvalues with generative eigenvalues to determine screen falsification, and verify principal information to ensure data integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional vaccine-based methods are used to detect and eliminate malicious code, then well-known malicious code can be fundamentally eliminated, but the system cannot defend against mutant malicious code and depends on user action
Solution Approach 1:
The patent applies preliminary action by generating random web sources and URIs before the user interacts with the web page. This randomization is performed in advance on the server side, creating a unique fingerprint for each web page instance. When malicious code attempts to inject or modify content, the pre-generated random identifiers ensure that any tampering will result in a mismatch between expected and actual identifiers, enabling detection of mutant or injected code that conventional vaccines cannot recognize.
2Reliability
If memory data access is blocked to prevent forgery, then memory data security is improved, but exclusive software installation is required and new attack methods cannot be coped with
Solution Approach 1:
The patent introduces an intermediary mechanism - random identifiers and fingerprints - that act as a mediator between the web content and the client system. Instead of directly blocking memory access or requiring exclusive software, the system embeds random identifiers within the web page content and uses these as references for verification. This intermediary approach allows security verification through standard web technologies without requiring special software installation or direct memory access blocking, thereby maintaining compatibility while preventing forgery.
3Reliability
If address space randomization is used to cope with buffer overflow attacks, then memory address space security is improved, but web injection attacks cannot be coped with
Solution Approach 1:
The patent applies segmentation by dividing the web page content into multiple segments, each containing random identifiers and fingerprints. Instead of relying on a single randomization mechanism, the system segments the content and embeds multiple reference points throughout the page. This segmentation ensures that even if an attacker successfully injects code into one segment, the random identifiers in other segments will detect the tampering, thereby providing defense against web injection attacks while maintaining the benefits of address space randomization.
Data Source
AI summary
An apparatus and method for preventing falsification of a client screen is provided, in which a web server dynamically generates URIs and provides them to clients, thus preventing the falsification of client screens due to a web injection attack or a memory hacking attack. The apparatus includes a random web generation unit for converting an identical web page into random URIs that are randomly generated, at a request of a plurality of clients, generating different random web sources, and providing the different random web sources to the respective clients. A web falsification determination unit compares display web source eigenvalues respectively generated by the clients with respect to any one of the random web sources with a generative web source eigenvalue for the one of the random web sources, thus determining whether screens corresponding to the random web sources displayed on the respective clients have been falsified.