Techniques for resource validation

• US 9,026,667 B1
• Filed: 03/26/2012
• Issued: 05/05/2015
• Est. Priority Date: 03/26/2012
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Joyce, Scott E., Lazar, Gregory W., Labaj, Donald
• Primary Examiner(s): Joo, Joshua
• Assistant Examiner(s): Naji, Younes
• Application Number:
  US13/429,919
• Time in Patent Office: 1,135 Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Described are techniques for validating a resource. A hierarchy of objects is received. The hierarchy includes first and second objects at, respectively, first and second levels of the hierarchy. The second object is a child of the first object. The first object is a parent of the second object and represents a first resource embedding a second resource represented by the second object. Each of the objects in the hierarchy identifies a resource that is automatically retrieved in connection with rendering a webpage. A first server location providing the first resource is determined using the first object. A second server location providing the second resource is determined using the second object. In accordance with trusted location criteria, it is determined whether the first resource is allowed to embed the second resource.

Claims

1. A method of validating a resource comprising:

retrieving a first resource that is a first document for a webpage being rendered, said first document embedding a second resource that is a second document automatically retrieved in connection with rendering the webpage, said second document identifying one or more other resources and identifying first instructions that perform validation processing to determine whether the first resource is allowed to embed the second resource and said validation processing allows downloading other content of the one or more other resources subsequent to determining that the first resource is allowed to embed the second resource;

performing said validation processing by executing said first instructions identified by the second document, said validation processing including;

determining a first server location providing said first resource, said first server location identifying a first server providing the first resource;

determining a second server location providing said second resource, said second server location identifying a second server that is a trusted server providing the second resource;

determining, in accordance with trusted location criteria, whether the first server is trusted by the second server using said first server location and said second server location, wherein said trusted location criteria includes determining the first server is trusted by the second server if the first server matches the trusted server identified by the second server location; and

if said determining in accordance with trusted location criteria determines that the first server is trusted by the second server, determining that the first resource is allowed to embed the second resource and allowing downloading of other content of the one or more other resources identified by the second resource embedded in the first resource.

2. The method of claim 1, wherein said first server location includes a first fully qualified host name that is either a fully qualified domain name or a first numeric internet address for said first server location, and wherein said second server location includes a second fully qualified host name that is either a second fully qualified domain name or a second numeric internet address for said second server location.

3. The method of claim 1, further comprising receiving a hierarchy of objects including a first object at a first level and a second object at a second level, said first object being a parent of said second object and said second object being a child of the first object, said first object representing the first resource embedding the second resource represented by said second object, each of said objects in the hierarchy identifying a resource automatically retrieved in connection with rendering the webpage, wherein each of the objects included in said hierarchy is a document object including a location object, said location object including a plurality of properties, a first of said properties including a host name, said host name identifying a domain host and a domain name identifying an internet domain providing a resource represented by said each object, said first object including a first instance of said first property identifying a first host name as said first server location and said second object including a second instance of said first property identifying a second host name as said second server location.

4. The method of claim 3, wherein said first server location includes a fully qualified domain name that includes a first domain name and first domain host identified in said first object and said second server location includes a fully qualified domain name that includes a second domain name and second domain host identified in said second object.

5. The method of claim 1, wherein said determining whether said first server is trusted by the second server, wherein the first resource is allowed to embed said second resource, includes comparing at least a portion of said first server location to at least a corresponding portion of said second server location.

6. The method of claim 1, wherein said first server location includes a first fully qualified domain name and said second server location includes a second fully qualified domain name and said determining whether said first server is trusted by the second server, wherein said first resource is allowed to embed said second resource, includes:

comparing said first fully qualified domain name to said second fully qualified domain name; and

determining, based on said comparing, whether at least a portion of said first fully qualified domain name matches at least a corresponding portion of said second fully qualified domain name.

7. The method of claim 6, wherein said trusted location criteria specifies that said first server is trusted by the second server, wherein said first resource is allowed to embed said second resource, if said comparing determines that at least a portion of said first fully qualified domain name matches at least a corresponding portion of said second fully qualified domain name.

8. The method of claim 6, wherein said trusted location criteria specifies that said first server is trusted by the second server, wherein said first resource is allowed to embed said second resource, if said comparing determines that said first fully qualified domain name exactly matches said second fully qualified domain name.

9. The method of claim 8, further comprising receiving a first object that includes a property identifying a first port from which the first resource represented by said first object is provided, and receiving a second object that includes a property identifying a second port from which the second resource represented by said second object is provided.

10. The method of claim 9, wherein said trusted location criteria specifies that said first server is trusted by the second server, wherein said first resource is allowed to embed said second resource, if said first port is the same as the second port.

11. The method of claim 10, wherein said first object includes a property identifying a first protocol used in connection with providing the first resource.

12. The method of claim 11, wherein said trusted location criteria specifies that said first server is trusted by the second server, wherein said first resource is allowed to embed said second resource, if said first protocol is a predetermined secure protocol that performs verification processing including processing to verify an identity of the first server location.

13. The method of claim 1, wherein the second document further embeds any of an application, an image, a document including instructions which are executed, a document including a script, an object including executable code, a multimedia document, a document including at least one of audio data, image data, video data, graphics data and text from the second server location.

14. The method of claim 1, further comprising receiving a hierarchy of objects including a first object at a first level and a second object at a second level, said first object being a parent of said second object and said second object being a child of the first object, said first object representing the first resource embedding the second resource represented by said second object, each of said objects in the hierarchy identifying a resource automatically retrieved in connection with rendering the webpage, and wherein if said validation processing performed by executing said first instructions determines that the first resource is not allowed to embed the second resource, the first instructions include instructions which are executed that alert a user of a web browser and assigning the second object as a root of the hierarchy.

15. The method of claim 1, further comprising receiving a hierarchy of objects including a first object at a first level and a second object at a second level, said first object being a parent of said second object and said second object being a child of the first object, said first object representing the first resource embedding the second resource represented by said second object, each of said objects in the hierarchy identifying a resource automatically retrieved in connection with rendering the webpage, wherein the first object is not a root of the hierarchy and is included in a path from the root of the hierarchy to a second node, and the method includes examining one or more objects which are included in the path and which are ancestors of the first object, and determining whether each of one or more server locations identified by said one or more objects is a trusted location in accordance with said trusted location criteria.

16. The method of claim 1, wherein said first instructions are included inline in said second document or are included in another resource that is any of automatically retrieved, loaded and processed in connection with processing said second document when rendering said webpage in a window.

17. A non-transitory computer readable medium comprising code stored thereon for validating a resource, wherein said code, when executed, performs processing comprising:

retrieving a first resource that is a first document for a webpage being rendered, said first document embedding a second resource that is a second document automatically retrieved in connection with rendering the webpage, said second document identifying one or more other resources and identifying first instructions that perform validation processing to determine whether the first resource is allowed to embed the second resource and said validation processing allows downloading other content of the one or more other resources subsequent to determining that the first resource is allowed to embed the second resource;

performing said validation processing by executing said first instructions identified by the second document, said validation processing including;

determining a first server location providing said first resource, said first server location identifying a first server providing the first resource;

determining a second server location providing said second resource, said second server location identifying a second server that is a trusted server providing the second resource;

determining, in accordance with trusted location criteria, whether the first server is trusted by the second server using said first server location and said second server location, wherein said trusted location criteria includes determining the first server is trusted by the second server if the first server matches the trusted server identified by the second server location; and

if said determining in accordance with trusted location criteria determines that the first server is trusted by the second server, determining that the first resource is allowed to embed the second resource and allowing downloading of other content of the one or more other resources identified by the second resource embedded in the first resource.

18. The non-transitory computer readable medium of claim 17, wherein said first server location includes a first fully qualified host name, that is either a fully qualified domain name or a first numeric internet address for said first server location, and wherein said second server location includes a second fully qualified host name that is either a second fully qualified domain name or a second numeric internet address for said second server location.

19. A system comprising:

a processor that executes code performing first processing for validating a resource; and

a memory comprising code stored therein which, when executed, performs said first processing including;

retrieving a first resource that is a first document for a webpage being rendered, said first document embedding a second resource that is a second document automatically retrieved in connection with rendering the webpage, said second document identifying one or more other resources and identifying first instructions that perform validation processing to determine whether the first resource is allowed to embed the second resource and said validation processing allows downloading other content of the one or more other resources subsequent to determining that the first resource is allowed to embed the second resource;

performing said validation processing by executing said first instructions identified by the second document, said validation processing including;

determining a first server location providing said first resource, said first server location identifying a first server providing the first resource;

determining a second server location providing said second resource, said second server location identifying a second server that is a trusted server providing the second resource;

determining, in accordance with trusted location criteria, whether the first server is trusted by the second server using said first server location and said second server location, wherein said trusted location criteria includes determining the first server is trusted by the second server if the first server matches the trusted server identified by the second server location; and

if said determining in accordance with trusted location criteria determines that the first server is trusted by the second server, determining that the first resource is allowed to embed the second resource and allowing downloading of other content of the one or more other resources identified by the second resource embedded in the first resource.