SYSTEMS AND METHODS FOR INTERCEPTING, PROCESSING, AND PROTECTING USER DATA THROUGH WEB APPLICATION PATTERN DETECTION

• US 20140282464A1
• Filed: 03/10/2014
• Published: 09/18/2014
• Est. Priority Date: 03/18/2013
• Status: Active Grant

• Current Assignee: Cloudmask
• Original Assignee: Cloudmask
• Inventors: El-Gillani, Tarek
• Granted Patent: US 9,361,085 B2
• Time in Patent Office: Days
• US Class Current: 717/168
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 16/9574 of access to content, e.g. by caching
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06F 8/33 Intelligent editors
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

Systems and methods of intercepting user data of a web application are provided. After web application resources are obtained for execution on a client device, methods that process user data of the web application are added to create modified web application resources. Certain runtime application calls are intercepted. This can be achieved by modifying the actual code to replace calls to certain functions with calls to the added methods, or by using overloading. The data processing may add data security functionality.

Claims

1. A processor implemented method on a device, the method comprising:

receiving web application resources associated with a web application;

modifying the web application resources by adding methods at least some of which pertain to processing of user data of the web application.

2. The method of claim 1 wherein for at least one of the added methods:

the added method overloads a runtime API method such that calls to the runtime API method are intercepted during execution.

3. The method of claim 1 further comprising:

initiating further modification of the web application resources to produce modified resources by replacing calls to at least one first method that pertains to processing of user data with calls to at least one of the added methods such that calls to the first methods are intercepted prior to execution.

4. The method of claim 1 wherein for at least one of the added methods:

the added method overloads a runtime API call such that calls to the runtime API method are intercepted during execution;

the method further comprising;

initiating modification of the web application resources to produce modified resources by replacing calls to at least one first method that pertains to processing of user data with calls to at least one of the added methods such that calls to the first methods are intercepted prior to execution, wherein the at least one first method is a method for which a method has not been added that overloads a call to the first method.

5. The method of claim 1 wherein each added method that pertains to the processing of user data processes user data without modifying control data for the web application.

6. The method of claim 1 wherein the added methods comprise:

at least one data handler that processes user data;

a rules engine that applies rules for each intercepted call to determine whether to process the user data with a data handler of the at least one data handler and/or to select which data handler to be used to process the user data.

7. The method of claim 6 wherein applying rules matching comprises attempting to identify patterns associated with an application runtime that pertain to the exchange of user data.

8. The method of claim 7 wherein attempting to identify patterns comprises attempting to identify at least one of the following patterns involving exchange of user data:

loading HTML or Script URL in which user data is sent as part of the URL or in which HTML/Script content contains user data from as server;

an HTML Form action carried out through HTTP (client data to server);

asynchronous messaging calls.

9. The method of claim 1 wherein at least one added method implements a security feature.

10. The method of claim 1 wherein least one added method implements a security feature by:

i) processing outgoing data by;

a) tokenizing the user data to produce tokenized user data and returning the tokenized user data;

b) encrypting the user data to produce encrypted user data;

c) creating a mapping between the encrypted user data and the tokenized user data;

ii) the security feature processes incoming data by;

d) extracting tokenized data;

e) demapping the tokenized data to obtain corresponding encrypted user data;

f) decrypting the encrypted user data to produce cleartext data;

g) returning cleartext data.

11. The method of claim 10 wherein encrypting and decrypting are performed using one or more user'"'"'s public/private key pairs.

12. The method of claim 10 further comprising storing the mapping locally.

13. The method of claim 10 further comprising storing the mapping using a remote mapping service.

14. The method of claim 3 further comprising upon initiating modification, locally modifying the web application resource.

15. The method of claim 3 further upon initiating modification, modifying the web application resource with a remote logic analyzer service.

16. The method of claim 1 further comprising:

receiving and installing a modification to an application runtime that contains the added methods.

17. The method of claim 16 wherein installing a modification comprises installing a browser extension.

18. The method of claim 1 wherein functionality that modifies the web application resources is part of the client runtime.

24. A computer readable storage medium having computer executable instructions stored thereon that when executed by a computer cause the computer to perform the method of claim 1.

19. A processor implemented method of processing data comprising:

i) in respect of outgoing data;

a) tokenizing the data to produce tokenized data and returning the tokenized data;

b) encrypting the data to produce encrypted data;

c) creating a mapping between the encrypted data and the tokenized data;

the security feature processes incoming data by;

ii) in respect of incoming data;

d) extracting tokenized data;

e) demapping the tokenized data to obtain corresponding encrypted data;

f) decrypting the encrypted data to produce cleartext data;

g) returning cleartext data.

20. The method of claim 19 wherein encrypting and decrypting are performed using one or more user'"'"'s public/private key pairs.

21. The method of claim 19 further comprising storing the mapping locally.

22. The method of claim 19 further comprising storing the mapping using a remote mapping service.

23. The method of claim 19 further comprising:

intercepting one or more search terms in a search field before the search field is submitted to a web app server;

for each search term, constructing a list of tokens that have been used to represent the search term;

generating a modified search field by for each search term, replacing the search term in the search field with an OR expression composed of the list of tokens used to represent the search term;

submitting the modified search field containing the OR expression(s) to the web app server.

25. A system comprising:

a processor;

memory;

at least one user interface;

an application runtime with user data interception and processing for execution by the processor configured to receive web application resources executable on the application runtime, and modify the web application resources by adding methods at least some of which pertain to processing of user data.

26. The system of claim 25 wherein for at least one of the added methods:

the added method overloads a runtime API method such that calls to the runtime API method are intercepted during execution.

27. The system of claim 25 further comprising:

an interceptor that modifies the web application resources to produce modified resources by replacing calls to at least one first method that pertains to processing of user data with calls to at least one of the added methods such that calls to the first methods are intercepted prior to execution.

28. The system of claim 25 wherein for at least one of the added methods:

the added method overloads a runtime API call such that calls to the runtime API method are intercepted during execution;

the system further comprising;

an interceptor that initiates modification of the web application resources to produce modified resources by replacing calls to at least one first method that pertains to processing of user data with calls to at least one of the added methods such that calls to the first methods are intercepted prior to execution, wherein the at least one first method is a method for which a method has not been added that overloads a call to the first method.