Script Verification via Digital Signature Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Third-party script files pose integrity and security risks for websites, as they can be tampered with or hacked, compromising website performance and user data security, especially when served from uncontrolled domains.
Innovation Solution
Implementing a system where script vendors generate and update hashes and digital signatures for their script files, which are then verified by browsers and servers to ensure authenticity and integrity, allowing only trusted scripts to execute and automatically disabling or removing unverified scripts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If third-party script files are used to enhance website functionality, then website features and services are improved, but security risks and integrity compromises increase
Solution Approach 1:
The system performs preliminary verification of script integrity by checking digital signatures and hashes before the script is executed. The server retrieves the script file and its associated signature/hash, verifies the signature using the vendor's public key, and compares the calculated hash with the stored hash before allowing execution. This preliminary verification prevents tampered scripts from compromising website security while still allowing legitimate third-party scripts to enhance functionality.
2Reliability
If script verification processes are implemented, then security and integrity are improved, but system complexity and processing time increase
Solution Approach 1:
The system introduces an intermediary verification layer between the web server and script execution. The server acts as an intermediary that retrieves scripts from third-party sources, verifies their digital signatures and hashes, and only allows execution if verification succeeds. This intermediary approach centralizes the security verification logic, making the system more secure without requiring complex client-side verification mechanisms. The verification process uses standard cryptographic operations (RSA signatures, SHA-384 hashing) that are computationally efficient.
3Reliability
If hash verification is performed for each script request, then integrity is ensured, but processing speed and productivity decrease
Solution Approach 1:
The system performs hash verification as a preliminary action before script execution, but optimizes the process by calculating the hash only after retrieving the script content. The server retrieves the script file, calculates its SHA-384 hash, and compares it with the stored hash value. This preliminary verification ensures integrity without requiring continuous hashing during execution, maintaining processing speed while ensuring data integrity.
Data Source
AI summary
Systems and methods of the present invention provide for one or more server computers communicatively coupled to a network and configured to: identify, within a data store: a web page including a script tag; and a URL in the script tag referencing a location for a second server hosting a script file. The server computer(s) execute a request that accesses the script file and a signature file generated by a private key, associated with the script file, and stored on the second server computer. If the signature file contains a signature that cannot be authenticated using the public key associated with the private key, execution of the script tag is disabled, and a notification is generated.