Establishing and enforcing security and privacy policies in web-based applications
View Patent ↗Method, system, and computer code for implementing privacy protection in a web application, wherein the web application is executed in a web application language execution environment within a web server, the method containing the steps of: establishing at least one inbound tagging rule for tagging objects entering the web application language execution environment, referred to as inbound objects, according to a respective source of each of the inbound objects; assigning a tag to at least one of the inbound objects being operated on by the web application language execution environment based on the at least one inbound tagging rule; establishing at least one privacy rule for performing privacy actions on at least one object that is outbound from the web application language execution environment, referred to as outbound objects, according to a respective tag of each of the outbound objects; and performing a privacy action on the at least one outbound object being operated on by the web application language execution environment based on the at least one privacy rule.
1. A method, executing on hardware, for implementing privacy protection in a web application, wherein the web application is executed in a web application language execution environment within a web server, the method comprising:
establishing at least one inbound tagging rule for tagging objects entering the web application language execution environment, referred to as inbound objects, according to a respective source of each of the inbound objects;
assigning a tag to at least one of the inbound objects being operated on by the web application language execution environment based on the at least one inbound tagging rule;
establishing at least one privacy rule for performing privacy actions on at least one object that is outbound from the web application language execution environment, referred to as outbound objects, according to a respective tag of each of the outbound objects; and
performing a privacy action on the at least one outbound object being operated on by the web application language execution environment based on the at least one privacy rule;
detecting at least one attack which violates the at least one privacy rule, wherein the detection of the attack comprises a lexical analysis of the data of the object being operated on by the web application language execution environment checking the tags assigned to the outbound object.
2. The method of claim 1 , wherein the source of each of the inbound objects is represented by a data structure comprising a method of executing an inbound operation and a target of the method of executing an inbound operation.
3. The method of claim 2 , wherein the method of executing an inbound operation comprises at least one of: http-post, http-get, and database access.
4. The method of claim 2 , wherein the target of the method of executing an inbound operation comprises at least one of: a user, a field in a web form, a field in a database, a file, or a directory.
5. The method of claim 1 , wherein the at least one privacy rule for performing privacy actions on outbound objects is established according to a respective destination of each of the outbound objects.
6. The method of claim 5 , wherein destination of each of the outbound objects is represented by a data structure comprising a method of executing an outbound operation and a target of the method of executing the outbound operation.
7. The method of claim 6 , wherein the method of executing an outbound operation comprises at least one of http-post, http-get, and database access.
8. The method of claim 6 , wherein the target of the method of executing an outbound operation comprises at least one of: a user, a web page address, and a back-end application.
9. The method of claim 5 , wherein the at least one privacy rule specifies a type of privacy violation, detection of which initiates the privacy action.
10. The method of claim 1 , wherein the privacy action comprises at least one of: blocking output of the object, allowing output of the object, removing sensitive information and allowing output of the object, and logging output of the object.
11. The method of claim 1 , wherein the privacy action comprises assigning a tag to the object as it flows from the web application language execution environment to a database back end or vice versa.
12. The method of claim 1 , wherein the privacy action comprises assigning a tag to the object as it flows from the web application language execution environment to a user's web browser or vice versa.
13. The method of claim 1 , wherein the assigned tag comprises at least one of: private, public, aggregated data, do not store, for this user's eyes only, and user-provided.
14. The method of claim 1 , further comprising performing an internal operation on the object being operated on by the web application language execution environment to generate at least one new object, wherein data of the at least one new object is tagged in a manner consistent with the object from which the at least one new object is generated.
15. The method of claim 1 , further comprising presenting to a user indicators on input fields of a web form indicating the tag associated with each of the input fields in accordance with the at least one inbound tagging rule.
16. The method of claim 15 , wherein the indicators are presented via a plug-in in the user's web browser.
17. The method of claim 15 , further comprising providing an explanation of the significance of the indicators to the user.