Call stack integrity check on client/server systems

• US 9,529,994 B2
• Filed: 11/24/2014
• Issued: 12/27/2016
• Est. Priority Date: 11/24/2014
• Status: Expired

• Current Assignee: Shape Security Inc. (F5 Incorporated)
• Original Assignee: Shape Security Inc. (F5 Incorporated)
• Inventors: Wang, Xinran, Zhao, Yao
• Primary Examiner(s): Goodchild, William
• Application Number:
  US14/552,331
• Publication Number:
  US 20160147992A1
• Time in Patent Office: 764 Days
• Field of Search: 726/22
• US Class Current: 1/1
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/01 Protocols

Abstract

Computer systems and methods in various embodiments are configured for improving the security and efficiency of client computers interacting with server computers through supervising instructions defined in a web page and/or web browser. In an embodiment, a computer system comprising one or more processors, coupled to a remote client computer, and configured to send, to the remote client computer, one or more instructions, which when executed by the remote client computer, cause a run-time environment on the remote client computer to: intercept, within the run-time environment, a first call to execute a particular function defined in the run-time environment by a first caller function in the run-time environment; determine a first caller identifier, which corresponds to the first caller function identified in a run-time stack maintained by the run-time environment; determine whether the first caller function is authorized to call the particular function based on the first caller identifier.

Claims

1. A specialized computing system comprising one or more processors, coupled to a remote client computer, and configured to send, to the remote client computer, one or more instructions, which when executed by the remote client computer, cause a run-time environment on the remote client computer to:

intercept, within the run-time environment, a first call to execute a particular function defined in the run-time environment by a first caller function in the run-time environment;

determine a first caller identifier, which corresponds to the first caller function identified in a run-time stack maintained by the run-time environment;

wherein the one or more instructions include a first dynamic identifier and the one or more instructions are further configured to cause the run-time environment to, as part of determining the first caller identifier;

determine a first caller name that corresponds to the first caller function from the run-time stack; and

perform a hashing function on the first caller name to produce the first caller identifier;

determine whether the first caller function is authorized to call the particular function based on whether the first caller identifier matches the first dynamic identifier.

2. The specialized computing system of claim 1, wherein the one or more instructions, which when executed by the remote client computer, are further configured to cause the run-time environment to terminate the first call without performing the particular function in response to determining that the first caller function is not authorized to call the particular function.

3. The specialized computing system of claim 1, wherein the one or more instructions, which when executed by the remote client computer, are further configured to cause the run-time environment to execute the particular function based, at least in part, on determining that the first caller function is authorized to call the particular function.

4. The specialized computing system of claim 1 wherein the one or more processors are further configured to:

determine the first caller name for the first caller function;

perform the hashing function on the first caller name to produce the first dynamic identifier;

insert the first dynamic identifier in the one or more instructions.

5. The specialized computing system of claim 1, wherein in response to determining that the first caller function is authorized to call the particular function, the one or more instructions, which when executed by the remote client computer, further causes the run-time environment to:

determine a second caller identifier, which corresponds to a second caller function identified in the run-time stack maintained by the run-time environment;

determine that the second caller function is not authorized to be in a stack of caller functions that call the particular function based on the second caller identifier, and in response, terminating the first call without performing the particular function.

6. The specialized computing system of claim 1, wherein the particular function is defined by the one or more instructions.

7. The specialized computing system of claim 1, wherein the particular function is defined by a run-time environment running on the remote client computer.

8. The specialized computing system of claim 1, wherein:

the first caller function is a function defined by the run-time environment;

determining whether the first caller function is authorized to call the particular function comprises determining whether the first caller identifier is assigned a generic identifier by the run-time environment.

9. The specialized computing system of claim 1, wherein the one or more instructions are one or more JavaScript instructions, and the run-time environment is a JavaScript run-time environment that is part of an HTTP-based browser configured to executing one or more HTML and JavaScript instructions.

10. A data processing system comprising:

a memory;

one or more processors coupled to the memory;

a protocol logic stored in the memory, executed by the one or more processors, and configured to cause the one or more processors to receive, from a web server computer, a first set of instructions that define one or more original operations;

an injection logic stored in the memory, executed by the one or more processors, and configured to cause the one or more processors to add one or more supervisor instructions to the first set of instructions to produce a modified set of instructions prior to providing the modified set of instructions to a client computer;

a server logic stored in the memory, executed by the one or more processors, and causing the one or more processors to send the modified set of instructions to a remote client computer;

wherein the one or more supervisor instructions are configured to cause a run-time environment executed on the client computer to intercept a first call to execute a particular function from a first caller function, determine whether the first caller function is authorized to call the particular function;

wherein the injection logic is further configured to cause the one or more processors to generate a first dynamic identifier based on a first original name assigned to a first original function and add the first dynamic identifier to the modified set of instructions;

wherein the one or more supervisor instructions are further configured to cause the run-time environment to generate a first caller identifier based on a first caller name associated with the first caller function, and determine whether the first caller function is authorized to call the particular function based on whether the first caller identifier matches the first dynamic identifier.

11. The data processing system of claim 10, wherein, upon determining the first caller function is not authorized to call the particular function, the one or more supervisor instructions are further configured to cause the run-time environment to terminate the first call without performing the particular function.

12. The data processing system of claim 10, wherein, based, at least in part, on determining the first caller function is authorized to call the particular function, the one or more supervisor instructions are further configured to cause the run-time environment to perform the particular function.

13. A data processing system comprising:

a memory;

one or more processors coupled to the memory;

a protocol logic stored in the memory, executed by the one or more processors, and configured to cause the one or more processors to receive, from a web server computer, a first set of instructions that define one or more original operations;

an injection logic stored in the memory, executed by the one or more processors, and configured to cause the one or more processors to add one or more supervisor instructions to the first set of instructions to produce a modified set of instructions prior to providing the modified set of instructions to a client computer;

a server logic stored in the memory, executed by the one or more processors, and causing the one or more processors to send the modified set of instructions to a remote client computer;

wherein the one or more supervisor instructions are configured to cause a run-time environment executed on the client computer to intercept a first call to execute a particular function from a first caller function, determine whether the first caller function is authorized to call the particular function;

wherein the injection logic is further configured to cause the one or more processors to generate a second dynamic identifier based on a second original name assigned to a second original function and add the second dynamic identifier to the modified set of instructions;

in response to the run-time environment determining that the first caller function is authorized to call the particular function, the one or more supervisor instructions are further configured to cause the run-time environment to;

determine a call stack that led the first caller function to be called;

determine a second caller function from the call stack;

determine a second caller identifier based on a name associated with the second caller function;

determine whether the second caller function is authorized to be in the call stack based on the second dynamic identifier and the second caller identifier;

terminate the first call without performing the particular function based on determining the second caller function is not authorized to be in the call stack.

14. A method comprising:

intercepting, within a run-time environment, a first call to execute a particular function defined in the run-time environment by a first caller function in the run-time environment;

determining a first caller identifier, which corresponds to the first caller function identified in a run-time stack maintained by the run-time environment;

determining whether the first caller function is authorized to call the particular function based on the first caller identifier;

receiving one or more instructions from a server computer, which includes a first dynamic identifier;

wherein the determining the first caller identifier comprises determining a first caller name that corresponds to the first caller function from the run-time stack, and performing a hashing function on the first caller name to produce the first caller identifier;

wherein the determining whether the first caller function is authorized to call the particular function is based on whether the first caller identifier matches the first dynamic identifier;

wherein the method is performed by one or more computing devices.

15. The method of claim 14 further comprising:

terminating the first call without performing the particular function in response to determining that the first caller function is not authorized to call the particular function.

16. The method of claim 14 further comprising executing the particular function based, at least in part, on determining that the first caller function is authorized to call the particular function.

17. The method of claim 14 further comprising, in response to determining that the first caller function is authorized to call the particular function:

determining a second caller identifier, which corresponds to a second caller function identified in the run-time stack maintained by the run-time environment;

determining that the second caller function is not authorized to be in a stack of caller functions that call the particular function based on the second caller identifier, and in response, terminating the first call without performing the particular function.

18. The method of claim 14, wherein the particular function is defined by one or more instructions received from a server computer.

19. The method of claim 14, wherein the particular function is defined by default by the run-time environment and not by one or more instructions received from a server computer.

20. The method of claim 19, wherein the particular function is referenced by the one or more instructions received from the server computer.

21. The method of claim 14, wherein:

the first caller function is a function defined by the run-time environment;

determining whether the first caller function is authorized to call the particular function comprises determining whether the first caller identifier is assigned a generic identifier by the run-time environment.

22. The method of claim 14 further comprising:

receiving one or more JavaScript instructions from a server computer;

executing the one or more JavaScript instructions;

wherein the run-time environment is configured, based at least in part on the one or more JavaScript instructions, to intercept the first call to execute the particular function, determine the first caller identifier, and determine whether the first caller function is authorized.