Runtime Shield for Web Browser Security via Input Redirection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer programs, especially web browsers, are vulnerable to security exploits due to complex and error-prone input handling logic, which can lead to unintended behavior or attacks, with scripts and HTML tags posing significant risks.
Innovation Solution
Implementing a runtime shield that redirects function calls and input processing without altering the program's executable code, using pre-generated and tested mitigations to disable insecure functionality, filter input, mitigate scripting vulnerabilities, and protect exception handlers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If complex input handling logic is implemented to process user input, then the program's functionality is improved, but security vulnerabilities increase due to parsing errors and unintended behavior
Solution Approach 1:
The patent introduces an intermediary component that sits between the vulnerable input handling logic and the rest of the system. This intermediary monitors and controls function calls, intercepting potentially malicious inputs before they reach the vulnerable parsing logic, thereby maintaining security without requiring changes to the original complex input handling code
Solution Approach 2:
The system performs preliminary actions by pre-configuring security policies and validation rules before input processing occurs. These pre-established security measures are automatically applied to filter and validate inputs before they reach the vulnerable functions, preventing security issues before they can manifest
2Reliability
If the program's executable code is modified to fix security vulnerabilities, then security is improved, but the original program functionality may be altered or lost
Solution Approach 1:
Rather than modifying the original program code, the patent employs an intermediary layer that preserves the original executable code intact. This intermediary component applies security fixes and input validation without altering the program's core functionality, maintaining both security and original behavior
Solution Approach 2:
The system creates a protective layer that essentially copies or replicates the security validation logic separately from the original program. This allows security measures to be applied independently without modifying the original code, preserving the program's intended functionality while adding security protections
3Reliability
If comprehensive input filtering is implemented to block malicious inputs, then security is improved, but legitimate input processing may be hindered
Solution Approach 1:
The system implements feedback mechanisms where the intermediary component learns from blocked and accepted inputs. By analyzing patterns in legitimate versus malicious inputs, the system refines its filtering rules to become more accurate over time, reducing false positives that would hinder legitimate input processing while maintaining security
Solution Approach 2:
The security filtering parameters are dynamically adjusted based on the context and type of input being processed. Rather than applying rigid filtering rules, the system modifies validation parameters adaptively to match the expected characteristics of legitimate inputs for different functions, allowing efficient processing of valid data while blocking malicious variations
Data Source
AI summary
In various embodiments, redirection techniques can be utilized to protect against insecure functionality, to mitigate scripting vulnerabilities, and to protect vulnerable exception handlers. In at least some embodiments, a program can be protected from a security vulnerability by using a runtime shield which changes the behavior of the program while it is running. The shield effectively provides a redirection solution that addresses the vulnerability while, at the same time, does not alter the particular program's executable code.