Detecting code injections through cryptographic methods
Code injection is detected based on code digests associated with hashes of selected portions of content supplied to clients by a server. A client receives the content and generates a corresponding code digest, and based upon a comparison with the code digest received from the server, determines if the received content has been corrupted. The code digest can be signed or supplied with a digital certification for verification that the code digest originated from the server providing the content.
1. A method, comprising:
receiving a code digest associated with content received from a content server, wherein the code digest corresponds to at least a portion of the content associated with provision of user input and the code digest provides enumeration of at least one user field associated with the user input;
determining if the received content corresponds to the code digest by comparing a number of user fields within the received content with the enumeration provided by the code digest; and
processing the received content based on the determination, wherein the received code digest is further associated with static content portions and the method further comprises:
parsing the received content to identify static content portions;
obtaining a static content digest associated with the identified static content portions;
determining if the received content corresponds to the received code digest based on a comparison of the static content digest and the received content digest; and
determining that the content digest is associated with the content provider based on a digital signature.
2. The method of claim 1 , wherein the content received from the content server includes at least one web page.
3. The method of claim 1 , wherein determining if the received content corresponds to the code digest is based on applying a hash function to the received content.
4. The method of claim 3 , wherein the determining is based on a comparison of the received code digest with a digest obtained by applying the hash function to the received content.
5. The method of claim 1 , wherein the static content digest is obtained by applying a hash function to the identified static content portions.
6. The method of claim 5 , wherein the hash function is a secure hash algorithm (SHA) function.
7. The method of claim 1 , wherein the digital signature is extracted from the content digest.
8. At least one non-transitory computer-readable storage medium containing computer-executable instructions for a method, the method comprising:
transmitting a content request to a content provider via a wide area network;
receiving content and a content identifier in response to the request, wherein the received content identifier corresponds to at least a portion of the content associated with provision of user input and the received content identifier provides enumeration of at least one user field associated with the user input;
based on the received content, obtaining a local content identifier associated with a number of user fields within the received content;
comparing the local content identifier to the received content identifier; and
based on the comparison, processing the received content, wherein the received content identifier includes a hash of at least a portion of web page content to be provided and a digital signature associated with the content provider, and further comprising determining that the digital signature corresponds to the content provider, and wherein the received content identifier is a digitally signed hash of at least a portion of a web page to be provided.
9. The at least one non-transitory computer-readable storage medium of claim 8 , wherein the method further comprises communicating a notification to the content provider, if the received content provider and the local content identifier indicate an injection in the received content.
10. The at least one non-transitory computer-readable storage medium of claim 8 , wherein the method further comprises displaying a warning if the received content identifier and the local content identifier indicate an injection in the received content.