Web Extension POST Data Scanning via Service Daemon
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web browsers like Microsoft Edge do not support sync mode for XHR, leading to challenges in data leak prevention and security analytics, as they lack the capability to effectively scan and block POST data before it is sent, unlike browsers like Google Chrome and Mozilla Firefox.
Innovation Solution
A method and system that initiates a POST request, runs a JavaScript script to send the data, pauses the script to scan the POST data, determines whether to block or allow the data, and then resumes the script based on the determination, using a DLP service/daemon and kernel driver to interact with the security analytics system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If web extensions use async mode for XHR to maintain browser compatibility (especially with Microsoft Edge), then device compatibility is improved, but data security and leak prevention capability deteriorate because the extension cannot effectively scan and block POST data before it is sent
Solution Approach 1:
The patent introduces a service/daemon as an intermediary component that runs in sync mode with the web extension. This service acts as a mediator between the extension and the browser's network stack, enabling data scanning and security checks even in browsers that don't support native sync mode for web extensions. The service intercepts and inspects network traffic, allowing security functionality to be implemented without requiring direct sync mode support from the browser.
2Reliability
If web extensions use sync mode for XHR to enable data scanning and blocking capability, then data security is improved, but device compatibility deteriorates because not all browsers support sync mode with local hosts
Solution Approach 1:
The patent segments the security functionality into two parts: a web extension component that runs in the browser and a service/daemon component that runs in sync mode. This segmentation allows the sync-mode-dependent functionality to be isolated in the service component, which can be implemented in languages like C++ that have better system-level access and can work around browser limitations. The web extension itself maintains broad compatibility while delegating security-critical operations to the service.
Solution Approach 2:
The patent moves the sync mode implementation from the web extension dimension (JavaScript running in the browser sandbox) to the service/daemon dimension (native code running with higher privileges). This dimensional shift allows the system to bypass browser-imposed limitations by operating at a different level of the system stack where sync mode and direct system access are available.
3Object-affected harmful factors
If JavaScript runs as a single-threaded sandboxed application with restricted permissions, then security isolation is improved, but the ability to implement sync mode and effective data scanning deteriorates
Solution Approach 1:
The service/daemon acts as an intermediary that bridges the sandboxed JavaScript environment and the unsandboxed native environment. The web extension running in the sandbox can communicate with the service running outside the sandbox, allowing the service to perform operations (like sync mode XHR and system-level scanning) that are prohibited within the sandbox while still benefiting from the security isolation of the sandboxed extension.
Data Source
AI summary
A method, system and computer-usable medium for collecting and scanning data (i.e., web POST data) before the data is sent. A POST request is sent from a client device to server. The request is through a web browser running a script language listing. The script language listing is paused, while the data is held and scanned. A determination is made to allow or block the data before the data is sent through the POST request.