Web Form Attribute Obfuscation via Proxy Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web forms are vulnerable to malicious attacks from bots and malware that intercept or construct requests to servers, compromising user data and API security.
Innovation Solution
A method and apparatus for protecting web forms by obfuscating form attributes using pseudorandom or random values, encryption with symmetric keys, or a combination of both, with a proxy server situated between the requesting device and the origin server, which modifies the web page to replace or encrypt attribute values and deobfuscates them upon receiving form data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If form attributes are obfuscated using pseudorandom or random values, then security against malicious bots and malware is improved, but the complexity of the system increases due to the need for proxy server intervention
Solution Approach 1:
A proxy server is introduced as an intermediary component between the client and the origin server. The proxy server intercepts web page requests, obfuscates form attributes in the HTML response, and manages the mapping between original and obfuscated attribute values. This intermediary handles the complexity of obfuscation and deobfuscation operations, protecting the origin server while maintaining security.
Solution Approach 2:
The obfuscation of form attributes is performed in advance when the proxy server delivers the web page to the client, before any form submission occurs. The proxy server replaces original form attribute values with obfuscated versions and stores the mapping. This preliminary obfuscation prevents malicious bots from easily intercepting and constructing valid requests, as the actual attribute values are hidden until deobfuscation at the proxy server.
2Reliability
If form attributes are encrypted with symmetric keys, then security against interception and construction of valid requests is improved, but the processing time and computational resources increase
Solution Approach 1:
The patent applies encryption with symmetric keys to transform form attribute values into obfuscated versions. The proxy server encrypts the original attribute values using a symmetric key and stores the encrypted versions in the obfuscated HTML. When form data is submitted, the proxy server decrypts the attributes using the same key. This parameter transformation provides strong security while the use of symmetric key encryption (as opposed to asymmetric) helps minimize computational overhead and processing time.
3Reliability
If form attributes are obfuscated, then malicious software cannot easily intercept or construct valid requests, but the usability and functionality of the web form must be maintained
Solution Approach 1:
The proxy server acts as a transparent intermediary that handles all obfuscation and deobfuscation operations. The client application interacts with the proxy server as if it were the origin server, submitting forms with obfuscated attributes and receiving responses with obfuscated attributes. The proxy server automatically deobfuscates attributes when processing form submissions, ensuring that the client application's usability is maintained while security is enhanced through obfuscation.
Solution Approach 2:
The proxy server creates a modified copy of the web page HTML with obfuscated form attributes. The original HTML structure and functionality are preserved, but the attribute values are replaced with obfuscated versions. This copying approach allows the web form to maintain its original usability and functionality while protecting the actual attribute values from malicious software. The mapping between original and obfuscated values is stored by the proxy server to enable automatic deobfuscation during form processing.
Data Source
AI summary
A request for a web page is received and the requested web page is retrieved. The web page is modified to obfuscate a set of form attribute values into a corresponding set of obfuscated form attribute values. The modified web page is transmitted to the requesting device. The modified web page does not include the set of form attribute values in their original form. Form data for the set of obfuscated form attribute values is received from the requesting device. The set of obfuscated form attribute values is deobfuscated thereby revealing the original set of form attribute values. The form data for the set of original form attribute values is further processed.