CLIENT/SERVER SECURITY BY AN INTERMEDIARY EXECUTING INSTRUCTIONS RECEIVED FROM A SERVER AND RENDERING CLIENT APPLICATION INSTRUCTIONS

• US 20150271188A1
• Filed: 03/18/2014
• Published: 09/24/2015
• Est. Priority Date: 03/18/2014
• Status: Active Grant

• Current Assignee: Shape Security Inc. (F5 Incorporated)
• Original Assignee: Shape Security Inc. (F5 Incorporated)
• Inventors: Call, Justin
• Granted Patent: US 9,544,329 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

In an embodiment, a method comprises intercepting, from a server computer, a first set of instructions that define a user interface; executing, using a headless browser, the first set of instructions without presenting the user interface; rendering a second set of instructions, which when executed by a client application on a client computer, cause the client computer to present the user interface, wherein the second set of instructions are different than the first set of instructions; sending the second set of instructions to the client computer.

Claims

1. A method comprising:

intercepting, from a server computer, a first set of instructions that define a user interface;

executing, using a headless browser, the first set of instructions without presenting the user interface;

rendering a second set of instructions, which when executed by a client application on a client computer, cause the client computer to present the user interface, wherein the second set of instructions are different than the first set of instructions;

sending the second set of instructions to the client computer;

wherein the method is performed by one or more computing devices.

2. The method of claim 1 further comprising:

executing, using the headless browser, the first set of instructions to produce one or more data structures in memory;

rendering the second set of instructions, which when executed by the client application cause the client computer to generate the one or more data structures in memory on the client computer.

3. The method of claim 1 further comprising:

executing, using the headless browser, the first set of instructions to produce one or more data structures in memory;

updating the one or more data structures based, at least in part, on a configuration to produce one or more updated data structures;

rendering the second set of instructions, which when executed by the client application cause the client computer to generate the one or more updated data structures in memory on the client computer.

4. The method of claim 1 further comprising:

rendering the second set of instructions, which when executed by the client application causes the client application to validate the client application and send a dynamic client credential;

receiving the dynamic client credential from the client application;

verifying the dynamic client credential is correct.

5. The method of claim 1 further comprising:

receiving, at an intermediary computer, a first request for a first intermediary credential to verify that the intermediary computer is a valid intermediary computer;

sending the first intermediary credential to the client application;

receiving, at the intermediary computer, a second request for a second intermediary credential, wherein the first request is different than the second request;

sending the second intermediary credential to the client application, wherein the first intermediary credential is different than the second intermediary credential.

6. The method of claim 1 further comprising:

rendering the second set of instructions, which when executed by the client application causes the client application to auto-generate data interspersed into keyboard data.

7. The method of claim 1 further comprising:

intercepting, from the server computer, the first set of instructions that included one or more headers;

stripping out the one or more headers;

rendering the second set of instructions, wherein the second set of instructions do not include the one or more headers.

8. The method of claim 1 further comprising:

receiving, from a second web server, a set of supplementary instructions, which the first set of instructions reference and which define a portion of the user interface;

executing, by the headless browser, the set of supplementary instructions without presenting the portion of the user interface;

rendering the second set of instructions, which when executed by the client application on the client computer, cause the client computer to present the portion of the user interface to a user, wherein the second set of instructions are different than the set of supplementary instructions.

9. The method of claim 1 further comprising:

intercepting, from the client application, a set of user data;

caching the set of user data;

receiving, from the client application, a request to be sent to the server computer;

generating a modified request based on the request and the set of user data;

sending the modified request to the server computer.

10. The method of claim 1 further comprising:

sending the second set of instructions to the client application through a persistent secure socket connection;

receiving, from the client application, a request, which is not based on a URL, to perform a process and return a result, though the persistent secure socket connection;

performing the process;

sending the result to the client application, through the persistent secure socket connection.

11. A computer comprising:

a processor;

a memory;

a browser backend module configured to;

intercept, from a server computer, a first set of instructions that define a user interface;

execute the first set of instructions without presenting the user interface;

a forward transformer module configured to;

render a second set of instructions, which when executed by a client application on a client computer, cause the client computer to present the user interface, wherein the second set of instructions are different than the first set of instructions;

send the second set of instructions to the client computer.

12. The computer of claim 11, wherein:

the browser backend module is further configured to execute the first set of instructions to produce one or more data structures in memory;

the forward transformer module is further configured to render the second set of instructions, which when executed by the client application cause the client computer to generate the one or more data structures in memory on the client computer.

13. The computer of claim 11, wherein:

the browser backend module is further configured to execute the first set of instructions to produce one or more data structures in memory;

the forward transformer module is further configured to;

update the one or more data structures based, at least in part, on a configuration to produce one or more updated data structures;

render the second set of instructions, which when executed by the client application cause the client computer to generate the one or more updated data structures in memory on the client computer.

14. The computer of claim 11, wherein:

the forward transformer module is further configured to render the second set of instructions, which when executed by the client application causes the client application to validate the client application and send a dynamic client credential;

the computer further comprises a transaction module configured to;

receive the dynamic client credential from the client application;

verify the dynamic client credential is correct.

15. The computer of claim 11, wherein:

the computer comprises a transaction module configured to;

receive a first request for a first intermediary credential to verify that the computer is a valid intermediary computer;

receive a second request for a second intermediary credential, wherein the first request is different than the second request;

the forward transformer module is further configured to;

send the first intermediary credential to the client application;

send the second intermediary credential to the client application, wherein the first intermediary credential is different than the second intermediary credential.

16. The computer of claim 11, wherein the forward transformer module is further configured to render the second set of instructions, which when executed by the client application causes the client application to auto-generate data interspersed into keyboard data.

17. The computer of claim 11, wherein:

the browser backend module is further configured to;

intercept, from the server computer, the first set of instructions that included one or more headers;

strip out the one or more headers;

the forward transformer module is further configured to render the second set of instructions, wherein the second set of instructions do not include the one or more headers.

18. The computer of claim 11, wherein:

the browser backend module is further configured to;

receive, from a second web server, a set of supplementary instructions, which the first set of instructions reference and which define a portion of the user interface;

execute the set of supplementary instructions without presenting the portion of the user interface;

the forward transformer module is further configured to render the second set of instructions, which when executed by the client application on the client computer, cause the client computer to present the portion of the user interface to a user, wherein the second set of instructions are different than the set of supplementary instructions.

19. The computer of claim 11 comprising:

a transaction module configured to;

intercept, from the client application, a set of user data;

cache the set of user data;

receive, from the client application, a request to be sent to the server computer;

a reverse transformer module configured to;

generate a modified request based on the request and the set of user data;

send the modified request to the server computer.

20. The computer of claim 11, wherein:

the forward transformer module is further configured to send the second set of instructions to the client application through a persistent secure socket connection;

the computer comprises a transaction module configured to;

receive, from the client application, a request, which is not based on a URL, to perform a process and return a result, though the persistent secure socket connection;

perform the process;

send the result to the client application, through the persistent secure socket connection.