White-Box Code Security via Intermediary Control System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing webpages and web applications are inadequate, as they do not effectively prevent attacks and protect sensitive information from unauthorized access or misuse within untrusted browser environments.
Innovation Solution
A method involving white-box protected code executed on a client system, which generates and sends messages to a control system for security tests, allowing for verification of code integrity and other security checks, and receives responses to adjust functionality or configuration settings accordingly, thereby enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If webpages and webapps are processed in untrusted browser environments, then user accessibility and ease of operation are improved, but security and protection against attacks deteriorate
Solution Approach 1:
A control system is introduced as an intermediary between the client system/browser and the webpage/webapp. The control system receives messages from the white-box protected code, performs security tests, and returns responses to control functionality. This intermediary enables security verification without requiring the browser to be trusted, thus maintaining user accessibility while improving security.
Solution Approach 2:
The system implements a feedback loop where the control system receives messages from the protected code, performs security tests, and returns responses that control the functionality. This continuous feedback mechanism allows the system to verify security properties and adjust functionality accordingly, maintaining reliability while preserving ease of operation.
2Reliability
If security tests are performed by a control system, then reliability and security are improved, but device complexity and system architecture deteriorate
Solution Approach 1:
The security verification function is segmented into separate components: the white-box protected code on the client side generates messages, and the control system on the server side performs security tests. This segmentation allows security functionality to be distributed and managed independently, improving reliability without proportionally increasing overall system complexity.
Solution Approach 2:
The control system serves multiple functions: it receives messages from the protected code, performs various security tests (integrity verification, debugger detection, data copying detection), and returns responses to control functionality. This multi-functionality consolidates security operations into a single system component, improving security without requiring separate dedicated systems for each function.
3Reliability
If white-box protected code is executed on client systems, then security against attacks is improved, but loss of information and data protection deteriorate
Solution Approach 1:
The control system acts as an intermediary that receives data from the white-box protected code, performs security tests, and returns responses. This intermediary protects sensitive information by processing it in a controlled environment rather than exposing it directly to the untrusted client system, thus preventing data loss while maintaining attack protection.
Solution Approach 2:
The system extracts critical security verification functions from the client-side code and places them in the control system. By taking out the security testing functionality from the unprotected environment, the system can verify code integrity and protect data without exposing sensitive information to potential attacks on the client system.
Data Source
AI summary
A method for securing a webpage or a webapp processed by a browser executing on a client system, the method comprising the browser executing an instance of white-box protected code, wherein execution of the instance of white-box protected code causes the client system to: generate a message comprising message data for use by a control system to perform one or more security tests, the control system communicably connected to the client system via a network; send the message to the control system to enable the control system to perform the one or more security tests using the message data; receive a response from the control system based, at least in part, on the message; and process the response.