Web Form Security via Client-Side Input Obfuscation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web content is vulnerable to malware interference, as malicious applications can automatically scan for vulnerabilities, intercept user input, and transmit data before encryption, posing a security risk for both users and web servers.
Innovation Solution
Modifying web code, such as HTML, CSS, and JavaScript, before serving it to clients, by adding client-side runtime code that hides form-filling activity from malware and encrypts user input, while also changing function names and applying transformations to confuse trained malware, and using instrumentation code to detect non-human interactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If web code is served in original form, then ease of operation is improved, but security against malware is worsened
Solution Approach 1:
The system performs preliminary modification of web code before serving it to clients. An intermediary system intercepts code from the web server, adds protective runtime code and transformations, then serves the modified code to the client. This preliminary action ensures security measures are in place before malware can interfere with the original code.
Solution Approach 2:
An intermediary system is introduced between the web server and the client. This intermediary intercepts web code, modifies it by adding protective elements and transformations, and then forwards it to the client. The intermediary also receives form submissions, reverses transformations, and forwards them to the server, thereby protecting the communication without requiring changes to the original server or client code.
2Reliability
If code modification is applied to protect against malware, then security is improved, but device complexity is worsened
Solution Approach 1:
The security functionality is segmented into distinct components: protective runtime code that runs on the client, transformation logic in the intermediary system, and mapping mechanisms. This segmentation allows the complexity to be distributed and managed separately from the core web application code.
Solution Approach 2:
The intermediary system acts as a mediator that handles all code modification and reversal operations. By centralizing these complex transformations in the intermediary rather than embedding them in the web server or client code, the original systems remain relatively simple while still achieving enhanced security.
3Reliability
If runtime code is added to hide form-filling activity, then security against malware is improved, but productivity is worsened
Solution Approach 1:
Protective runtime code is added preliminarily to intercept and redirect form input before malware can capture it. This code monitors keystrokes and redirects them to hidden fields, providing security without requiring complex real-time processing during form submission.
Solution Approach 2:
The system applies transformations selectively - only to form elements that need protection - rather than transforming the entire codebase. The runtime code focuses specifically on intercepting form input, leaving other code execution paths unchanged and maintaining overall system efficiency.
4Reliability
If function names are changed to confuse malware, then security is improved, but ease of operation is worsened
Solution Approach 1:
The system changes parameter names (function names, variable names) in the served code to obfuscate them from malware. The intermediary system maintains mappings between original and transformed names, allowing it to reverse transformations on form submissions while the client sees only the obfuscated version.
Solution Approach 2:
The intermediary system maintains and manages the naming mappings between original and transformed code elements. This centralizes the complexity of tracking name changes, making the system maintainable despite the obfuscation transformations applied to confuse malware.
Data Source
AI summary
A computer-implemented method includes identifying, in web code to be served to a client, presence of code for generating a form; generating additional, executable code to be run on the client device, the additional, executable code being arranged to identify user input on the client device and modify the form so that data from the user input is received into one or more alternative fields of the form other than a first field to which a user performing the input directed the input; receiving a request from the client device based on completion of input into the form; and converting data from the received request so that data for the one or more alternative fields of the form is directed to the first field of the form for processing by a web server system that initially generated the web code.