Script Origin Tagging for Secure Data Transmission Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Web browsers lack a suitable mechanism to prevent sensitive data from being transmitted back to its origin server, either maliciously or during functions like spell checking, especially when dealing with untrusted scripts, which limits the use of Web services due to exposure concerns.
Innovation Solution
Associating an indication of origin with data elements and propagating these indications to generated data elements, restricting transmissions to only permitted destinations identified by the origin, ensuring that sensitive data is not sent to unauthorized nodes within the scripting environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If scripts are allowed to transmit data freely in Web browsers, then script functionality and Web service capabilities are improved, but data security and protection against unauthorized transmission deteriorate
Solution Approach 1:
The patent applies preliminary action by attaching origin indications to data elements before they are processed by scripts. The browser proactively marks data with its origin information (URL, domain, etc.) before the script executes, so that when transmission occurs, the origin indication is already in place to control whether the transmission is permitted. This prevents the need for post-transmission security checks and enables proactive data protection.
Solution Approach 2:
The patent uses an intermediary mechanism by introducing origin indications as a mediating element between data elements and transmission decisions. These origin indications act as metadata that carry information about data provenance and serve as the basis for transmission control policies. The scripting engine uses these intermediary origin indications to make informed decisions about whether to allow data transmission to specific destinations, thereby mediating between script capabilities and security requirements.
2Reliability
If origin indications are attached to all data elements, then data transmission control is improved, but device complexity and processing overhead increase
Solution Approach 1:
The patent applies local quality by attaching origin indications selectively to data elements based on their sensitivity and transmission requirements, rather than uniformly to all data. The system can identify which data elements require origin tracking (e.g., sensitive data, data that may be transmitted) and apply the overhead only to those elements. This allows fine-grained control where origin indications are attached only where necessary, reducing overall processing complexity while maintaining effective data protection where needed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Provided are methods, apparatus and computer programs for tracking the origins of data and controlling transmission of the data. In one embodiment, transmission of sensitive data by script operations is limited, to prevent transmission to any network location other than to the source of that sensitive data, by a new function within a scripting engine of an HTTP client that is responsive to origin tags placed within the data. Origin tags that are associated with data inputs are propagated to any output data items, so that transmission of derived information can also be controlled.