Web Document Obfuscation Against Injection Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web documents, such as webpages, are vulnerable to web-injection attacks where malware injects malicious code, tricking users into providing sensitive information by exploiting consistent webpage structures.
Innovation Solution
A web document protection module, known as the DOM guard, alters the structure of web documents by obfuscating them, making it difficult for malware to inject additional code by randomizing tag names, attribute order, and inserting random elements, while maintaining the original functionality and appearance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If web documents maintain consistent structure for proper rendering, then usability is improved, but vulnerability to web-injection attacks increases
Solution Approach 1:
The system performs preliminary obfuscation of the web document structure before transmission to the client. Tag names, attributes, and other structural elements are transformed into obfuscated forms in advance, so that when the document reaches the client, its structure is already protected against injection attacks while maintaining rendering functionality through automated de-obfuscation.
Solution Approach 2:
The patent introduces an intermediary obfuscation layer between the web server and the client browser. This intermediary transforms the original web document structure into an obfuscated version that prevents malware from successfully injecting malicious code, while the browser automatically restores the original structure for proper rendering and user interaction.
2Reliability
If web documents are obfuscated to protect against attacks, then security is improved, but complexity of processing increases
Solution Approach 1:
The obfuscation and de-obfuscation processes are designed to be self-service, with the client browser automatically handling the restoration of obfuscated web documents without requiring user intervention. The system embeds within the web document itself the information needed for automatic de-obfuscation, allowing the browser to autonomously restore the original structure while the security protection operates transparently in the background.
Data Source
AI summary
A web document protection module protects web documents against web-injection and other malicious attacks. The web document protection module may be implemented in a user computer, a proxy server computer system, a web server computer system, or other computers. The web document protection module receives a web document, such as a webpage, and alters the web document to change its structure. For example, the web document protection module may obfuscate the web document to make it difficult for malware to find locations in the web document to insert additional program code. The web document protection module provides the obfuscated web document to a web browser for rendering.