Management of calls to transformed operations and objects

• US 10,652,275 B2
• Filed: 04/05/2018
• Issued: 05/12/2020
• Est. Priority Date: 01/20/2014
• Status: Active Grant

• Current Assignee: Shape Security Inc. (F5 Incorporated)
• Original Assignee: Shape Security Inc. (F5 Incorporated)
• Inventors: Zhou, Xiaoming, Hoover, Roger, Shekyan, Sergey, Call, Justin
• Primary Examiner(s): Higa, Brendan Y
• Application Number:
  US15/945,944
• Publication Number:
  US 20180227325A1
• Time in Patent Office: 768 Days
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/128 involving web programs, i.e. using technology especially used in internet, generally interacting with a web browser, e.g. hypertext markup language [HTML], applets, java
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 9/30181 Instruction operation extension or modification
• CPC Class Codes: G06F 9/548 Object oriented; Remote method invocation [RMI] non-remote method invocation G06F9/449
• CPC Class Codes: H04L 41/0253 using browsers or web-pages for accessing management information
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561

Abstract

In an embodiment, a method comprises intercepting a first set of instructions from a server computer that define one or more objects and one or more original operations that are based, at least in part, on the one or more objects; modifying the first set of instructions by adding one or more supervisor operations that are based, at least in part, on the one or more objects; transforming the one or more original operations to produce one or more transformed operations that are based, at least in part, on the one or more supervisor operations; rendering a second set of instructions which define the one or more supervisor operations and the one or more transformed operations; sending the second set of instructions to a remote client computer.

Claims

1. A system comprising:

one or more processors;

one or more non-transitory storage media storing instructions which, when executed by the one or more processors, cause;

based on a first set of instructions, generating a second set of instructions that define one or more supervisor operations, which when executed by a runtime environment on a computer, cause the runtime environment to;

generate one or more objects in a memory on the computer,

intercept a call to a particular object of the one or more objects in the memory on the computer,

send a set of telemetry data to a server computer indicating the particular object was referenced;

sending, to a remote client computer, the first set of instructions and the second set of instructions.

2. The system of claim 1, wherein the one or more supervisor operations are configured to cause the runtime environment to determine the call to the particular object was made by a first operation.

3. The system of claim 2, wherein the one or more supervisor operations are configured to cause the runtime environment to determine the first operation is allowed to reference the particular object.

4. The system of claim 3, wherein the particular object is a second operation;

wherein the one or more supervisor operations are configured to cause the runtime environment to perform the second operation in response to the runtime environment determining that the first operation is allowed to reference the particular object.

5. The system of claim 4, wherein the one or more supervisor operations are configured to cause the runtime environment to include, in the set of telemetry data, data indicating that the first operation was allowed to reference the particular object and that the second operation was performed.

6. The system of claim 3, wherein the particular object is a second operation;

wherein the one or more supervisor operations are configured to cause the runtime environment to terminate the call without performing the second operation in response to the runtime environment determining that the first operation is not allowed to reference the particular object.

7. The system of claim 6, wherein the one or more supervisor operations are configured to cause the runtime environment to include, in the set of telemetry data, data indicating that the first operation was not allowed to reference the particular object and that the call was terminated without performing the second operation.

8. The system of claim 2, wherein a first identifier is assigned to the particular object;

wherein the one or more supervisor operations are configured to cause the runtime environment to assign a second identifier to the particular object and to include, in the set of telemetry data, data that indicates whether the first operation referenced the particular object by the first identifier or the second identifier.

9. The system of claim 1, wherein a first alias is assigned to the particular object;

wherein the one or more supervisor operations are configured to cause the runtime environment to assign a second alias to the particular object and to include, in the set of telemetry data, data that indicates whether the call to the particular object was made using the first alias or the second alias.

10. The system of claim 1, wherein the particular object is a first operation;

wherein the one or more supervisor operations are configured to cause the runtime environment to transform the first operation into a second operation and, in response to receiving the call to the particular object, to;

perform the first operation and collect a first result;

perform the second operation and collect a second result;

determine whether the first result is equal to the second result.

11. The system of claim 10, wherein the one or more supervisor operations are configured to cause the runtime environment, to include, in the set of telemetry data in response to determining that the first result is equal to the second result, data indicating that the first operation was successfully transformed into the second operation.

12. The system of claim 10, wherein the one or more supervisor operations are configured to cause the runtime environment to include, in the set of telemetry data in response to determining that the first result is not equal to the second result, data indicating that the first operation was not successfully transformed into the second operation.

13. A method comprising:

based on a first set of instructions, generating a second set of instructions that define one or more supervisor operations, which when executed by a runtime environment on a computer, cause the runtime environment to;

generate one or more objects in a memory on the computer,

intercept a call to a particular object of the one or more objects in the memory on the computer,

send a set of telemetry data to a server computer indicating the particular object was referenced;

sending, to a remote client computer, the first set of instructions and the second set of instructions.

14. The method of claim 13, wherein the one or more supervisor operations are configured to cause the runtime environment to determine the call to the particular object was made by a first operation.

15. The method of claim 14, wherein the one or more supervisor operations are configured to cause the runtime environment to determine the first operation is allowed to reference the particular object.

16. The method of claim 15, wherein the particular object is a second operation;

wherein the one or more supervisor operations are configured to cause the runtime environment to perform the second operation in response to the runtime environment determining that the first operation is allowed to reference the particular object.

17. The method of claim 16, wherein the one or more supervisor operations are configured to cause the runtime environment to include, in the set of telemetry data, data indicating that the first operation was allowed to reference the particular object and that the second operation was performed.

18. The method of claim 15, wherein the particular object is a second operation;

wherein the one or more supervisor operations are configured to cause the runtime environment to terminate the call without performing the second operation in response to the runtime environment determining that the first operation is not allowed to reference the particular object.

19. The method of claim 18, wherein the one or more supervisor operations are configured to cause the runtime environment to include, in the set of telemetry data, data indicating that the first operation was not allowed to reference the particular object and that the call was terminated without performing the second operation.

20. The method of claim 14, wherein a first identifier is assigned to the particular object;

wherein the one or more supervisor operations are configured to cause the runtime environment to assign a second identifier to the particular object and to include, in the set of telemetry data, data that indicates whether the first operation referenced the particular object by the first identifier or the second identifier.

21. The method of claim 13, wherein a first alias is assigned to the particular object;

wherein the one or more supervisor operations are configured to cause the runtime environment to assign a second alias to the particular object and to include, in the set of telemetry data, data that indicates whether the call to the particular object was made using the first alias or the second alias.

22. The method of claim 13, wherein the particular object is a first operation;

wherein the one or more supervisor operations are configured to cause the runtime

environment to transform the first operation into a second operation and, in response to receiving the call to the particular object, to;

perform the first operation and collect a first result;

perform the second operation and collect a second result;

determine whether the first result is equal to the second result.

23. The method of claim 21, wherein the one or more supervisor operations are configured to cause the runtime environment, to include, in the set of telemetry data in response to determining that the first result is equal to the second result, data indicating that the first operation was successfully transformed into the second operation.

24. The method of claim 21, wherein the one or more supervisor operations are configured to cause the runtime environment to include, in the set of telemetry data in response to determining that the first result is not equal to the second result, data indicating that the first operation was not successfully transformed into the second operation.