Securing resources from untrusted scripts behind firewalls

• US 20050091536A1
• Filed: 06/14/2004
• Published: 04/28/2005
• Est. Priority Date: 10/28/2003
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: AOL LLC (Apollo Global Management, Inc.)
• Inventors: Whitmer, Ray, Dhurvasula, Harish
• Granted Patent: US 7,444,678 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine

Abstract

The invention provides a new mechanism which is used to protect all internal resources against requests from sandboxed scripts. In the preferred embodiment, the mechanism is implemented for SOAP calls by untrusted scripts. When an attempt is made to access a resource at a previously-unknown URI, the sandbox reads a file at that domain with declarations to determine whether access is permitted to the script. If the file is not found, the access is denied.

Claims

1. A method for protecting internal resources against an untrusted script originated from an external server, said script being executed in a security sandbox behind a network firewall, said method- comprising the steps of:

said untrusted script requesting to access an internal resource at an internal server;

said security sandbox loading a plurality of script control definitions, said plurality of script control definitions comprising allowable request types and script originations;

said security sand box validating said plurality of script control definitions;

said security sandbox verifying the type of request is allowed in said plurality of script control definitions;

said security sandbox verifying the origination of said untrusted script is allowed in said plurality of script control definitions; and

said security sandbox allowing said untrusted script to access said internal resource.

2. The method of claim 1, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said plurality of script control definitions are not found.

3. The method of claim 1, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said security box cannot validate said plurality of script control definitions.

4. The method of claim 1, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said type of request is not allowed in said plurality of script control definitions.

5. The method of claim 1, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said origination of request is not allowed in said plurality of script control definitions.

6. A method for protecting internal resources against an untrusted script originated from an external server, said script being executed in a security sandbox behind a network firewall, said method comprising the steps of:

said untrusted script requesting to access an internal resource at a request URI;

said security sandbox loading a script control definition from a declaration file at the root directory of said request URI, said script control definition comprising allowable request types and script originations; and

said security sand box validating said script control definition at said root directory;

wherein, when said request URI is not a subdirectory, said method further comprising the steps;

said security sandbox verifying that the type of request is allowed in said script control definition at said root directory;

said security sandbox verifying that the origination of said untrusted script is allowed in said script control definition at said root directory; and

said security sandbox allowing said untrusted script to access said internal resource.

7. The method of claim 6, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said declaration file is not found at said root directory.

8. The method of claim 6, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said security box cannot validate said script control definition at said root directory.

9. The method of claim 6, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said type of request is not allowed in said script control definition at said root directory.

10. The method of claim 6, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said origination of request is not allowed in said script control definition at said root directory.

11. The method of claim 6, when said request URI is a subdirectory, further comprising the steps of:

said security sandbox verifying that delegation is allowed in said script control definition at root directory;

said security sandbox loading a script control definition from a declaration file at said subdirectory of said request URI, said script control definition at said subdirectory comprising allowable request types and script originations; and

said security sand box validating said script control definition at said subdirectory;

said security sandbox verifying that the type of request is allowed in said script control definition at said subdirectory;

said security sandbox verifying that the origination of said untrusted script is allowed in said script control definition at said subdirectory; and

said security sandbox allowing said untrusted script to access said internal resource.

12. The method of claim 11, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said declaration file is not found at said subdirectory.

13. The method of claim 11, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said security box cannot validate said script control definition at said subdirectory.

14. The method of claim 11, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said type of request is not allowed in said script control definition at said subdirectory.

15. The method of claim 11, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said origination of request is not allowed in said script control definition at said subdirectory.

16. The method of claim 6, wherein any type of request is allowed when “

any”

is specified as the type to be allowed in a declaration file.

17. The method of claim 6, wherein scripts from all origination are allowed when allowed originations are not specified in a declaration file.

18. The method of claim 6, wherein wildcard characters are used to specify originations from which scripts are allowed.

19. The method of claim 6, wherein said script control definitions are cached by said sandbox so that said script control definitions are only loaded once.

20. The method of claim 6, wherein said request URI specifies a SOAP request.

21. The method of claim 6, wherein said declaration files are of XML.

37. The system of claim 6, wherein said request URI specifies a SOAP request.

22. A system for protecting internal resources against untrusted scripts, comprising:

an untrusted script originated from an external server;

a security sandbox wherein said untrusted script are executed behind a network firewall; and

an internal server serving internal resources, said internal server further comprising a plurality of script control definitions defined in a plurality of declaration files;

wherein said untrusted script requests to access an internal resource at said internal server via a request URI;

wherein said security sandbox loads a script control definition from a declaration file at the root directory of said request URI, said script control definition comprising allowable request types and script originations; and

wherein said security sand box validates said script control definition at said root directory.

23. The system of claim 22, wherein said request URI is not a subdirectory;

wherein said security sandbox verifies the type of request is allowed in said script control definition at said root directory;

wherein said security sandbox verifies the origination of said untrusted script is allowed in said script control definition at said root directory; and

wherein said security sandbox allows said untrusted script to access said internal resource.

24. The system of claim 22, wherein said security sandbox denies said untrusted script to accept said internal resource when said declaration file is not found at said root directory.

25. The system of claim 22, wherein said security sandbox denies said untrusted script to accept said internal resource when said security box cannot validate said script control definition at said root directory.

26. The system of claim 23, wherein said security sandbox denies said untrusted script to accept said internal resource when said type of request is not allowed in said script control definition at said root directory.

27. The system of claim 23, wherein said security sandbox denies said untrusted script to accept said internal resource when said origination of request is not allowed in said script control definition at said root directory.

28. The system of claim 22, wherein said request is a subdirectory;

wherein said security sandbox verifies delegation is allowed in said script control definition at root directory;

wherein said security sandbox loads a script control definition from a declaration file at said subdirectory of said request URI, said script control definition at said subdirectory comprising allowable request types and script originations; and

wherein said security sand box validates said script control definition at said subdirectory;

wherein said security sandbox verifies the type of request is allowed in said script control definition at said subdirectory;

wherein said security sandbox verifies the origination of said untrusted script is allowed in said script control definition at said subdirectory; and

wherein said security sandbox allows said untrusted script to access said internal resource.

29. The system of claim 28, wherein said security sandbox denying said untrusted script to accept said internal resource when said declaration file is not found at said subdirectory.

30. The system of claim 28, wherein said security sandbox denies said untrusted script to accept said internal resource when said security box cannot validate said script control definition at said subdirectory.

31. The system of claim 28, wherein said security sandbox denies said untrusted script to accept said internal resource when said type of request is not allowed in said script control definition at said subdirectory.

32. The system of claim 28, wherein said security sandbox denies said untrusted script to accept said internal resource when said origination of request is not allowed in said script control definition at said subdirectory.

33. The system of claim 22, wherein any type of request is allowed when “

any”

is specified as the type to be allowed in a declaration file.

34. The system of claim 22, wherein scripts from all origination are allowed when allowed originations are not specified in a declaration file.

35. The system of claim 22, wherein wildcard characters are used to specify originations from which scripts are allowed.

36. The system of claim 22, wherein script control definitions are cached by said sandbox so that said script control definitions are only loaded once.

38. The system of claim 22, wherein said declaration files are of XML.