White-list Firewall DOM Rendering

Solution Overview

Problem

Existing black-list firewalls in Content Delivery Networks (CDNs) are vulnerable to new threats and require extensive rule configurations, leading to increased overhead and complexity, as they struggle to defend against a high volume of attacks without specific rule definitions for each threat, and are not scalable to handle the large volume of data and attacks effectively.

Innovation Solution

Implementing a white-list firewall that uses the Document Object Model (DOM) to parse and render data, isolating threats by executing executable elements and formatting non-executable ones, allowing for customizable white-list configurations and hybrid black-list rules to enhance security without increasing complexity, and configuring firewalls on a per-CDN customer basis to filter targeted data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If black-list firewalls are used to block known threats, then security against known attacks is improved, but the system becomes vulnerable to new and unknown threats and requires extensive rule configurations

Engineering Contradiction:

Improvesecurity against known attacksVSAvoiddefense against new and unknown threats

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent inverts the traditional black-list approach by implementing a white-list firewall that allows only explicitly permitted content to pass through. Instead of blocking known threats, the system permits only content that matches predefined safe patterns, thereby automatically blocking unknown and new threats by default while maintaining security against known attacks through pattern recognition.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The system changes the fundamental parameter of threat detection from pattern matching (black-list) to pattern generation and validation (white-list). By transforming security rules from explicit blocking patterns to permissive allowing patterns, the system achieves both security against known threats and automatic protection against unknown threats through parameter transformation.

Inventive Principle:

Principle #35Parameter changes

2Reliability

If extensive black-list rules are configured to block more threats, then security coverage is improved, but device complexity and processing overhead increase

Engineering Contradiction:

Improvesecurity coverageVSAvoidrule configuration complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent inverts the traditional black-list approach by implementing a white-list firewall that allows only explicitly permitted content to pass through. Instead of blocking known threats, the system permits only content that matches predefined safe patterns, thereby automatically blocking unknown and new threats by default while maintaining security against known attacks through pattern recognition.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The system extracts and removes the complex rule configuration aspect from the firewall operation. By using white-list pattern matching, the system eliminates the need for extensive manual rule configurations while maintaining comprehensive security coverage, as the pattern-based approach inherently handles both known and unknown threats without requiring granular rule definitions.

Inventive Principle:

Principle #2Taking out (Extraction)

3Reliability

If black-list firewalls process all data through extensive rules, then threat blocking is improved, but processing speed and scalability deteriorate

Engineering Contradiction:

Improvethreat blocking effectivenessVSAvoiddata processing speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent inverts the traditional black-list approach by implementing a white-list firewall that allows only explicitly permitted content to pass through. Instead of blocking known threats, the system permits only content that matches predefined safe patterns, thereby automatically blocking unknown and new threats by default while maintaining security against known attacks through pattern recognition.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The system changes the fundamental parameter of threat detection from pattern matching (black-list) to pattern generation and validation (white-list). By transforming security rules from explicit blocking patterns to permissive allowing patterns, the system achieves both security against known threats and automatic protection against unknown threats through parameter transformation.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS9191363B2White-list firewall based on the document object model

Publication Date: 2015.11.17 DRNC HOLDINGS INC

AI summary

Some embodiments provide firewalls and methods for guarding against attacks by leveraging the Document Object Model (DOM). The firewall renders the DOM tree to produce a white-list rendering of the data which presents the non-executable elements of the data and, potentially, outputs of the executable elements of the data without the executable elements that could be used to carry a security threat. Some embodiments provide control over which nodes of the DOM tree are included in producing the white-list rendering. Specifically, a configuration file is specified to white-list various nodes from the DOM tree and the white-list rendering is produced by including the DOM tree nodes that are specified in the white-list of the configuration file while excluding those nodes that are not in the white-list. Some embodiments provide a hybrid firewall that executes a set of black-list rules over white-listed nodes of the DOM tree.