Secure delivery of flash content over networks
View Patent ↗A method for securing delivery of flash content over a network includes rewriting flash content action code capable of making a network request for flash content to redirect network communication associated with the flash content to a network device.
1. A method comprising:
receiving, by a network device and via a network, executable content associated with a network request;
disassembling, by the network device, the executable content into action code;
locating, by the network device, portions of the action code capable of making the network request,
the locating the portions of the action code including:
performing a flow analysis on the action code to produce a first result,
inspecting a stack of the action code to produce a second result,
locating, using the first result and the second result, at least one code parameter related to making the network request, and
locating the portions of the action code based on the at least one code parameter,
the portions of the action code including the at least one code parameter;
rewriting, by the network device, the portions of the action code to form rewritten action code,
the rewritten action code redirecting a network communication, associated with the executable content, to a particular network device, and
the rewriting the portions of the action code including:
rewriting, in the portions of the action code, the at least one code parameter; and
providing, by the network device and via the network, the rewritten portion of the action code to a client device associated with the network request.
2. The method of claim 1 , the rewriting the portions of the action code further including:
providing, for installation on the client device, an application that rewrites the portions of the action code.
3. The method of claim 1 , the rewriting the portions of the action code further including:
identifying an object requested through the network communication;
determining that the object is associated with a particular class; and
rewriting, based on determining that the object is associated with the particular class, arguments, included in the action code, that are associated with the particular class.
4. The method of claim 1 , the rewriting the portions of the action code further including:
identifying an action associated with the network communication;
identifying statements in the action code associated with the action; and
replacing the identified statements with replacement statements that cause the action to be implemented via the particular network device.
5. The method of claim 4 , the identifying the action further comprising:
examining one or more stack constants of the action code and one or more trace constants of the action code; and
identifying the action based on examining the one or more stack constants and the one or more trace constants.
6. The method of claim 5 , the replacing the identified statements with the replacement statement further comprising:
identifying, based on examining the one or more stack constants and one or more trace constants, arguments in the action code associated with the action; and
rewriting the identified arguments to include a network identifier associated with the particular network device,
the rewritten arguments causing the network request to be directed, based on the network identifier, to the particular network device.
7. The method of claim 1 , the action code being associated with one or more of:
flash content,
JavaScript, or
ActiveX code.
8. A device comprising:
one or more processors to:
receive, via a network, executable content associated with a network request from a client device to a computer device external to the network;
disassemble the executable content into action code;
locate portions of the action code capable of making the network request,
the one or more processors, when locating of the portions of the action code, being further to:
perform a flow analysis on the action code to produce a first result,
inspect a stack associated with the action code to produce a second result,
locate, using the first result and the second result, a code parameter related to making the network request associated with the executable content, and
locate the portions of the action code based on the code parameter;
rewrite the portions of the action code to redirect a network communication, associated with the executable content, to a particular network device associated with the particular network,
the one or more processors, when rewriting the portions of the action code, being further to:
rewrite the code parameter to redirect the network communication, associated with the executable content, to the particular network device; and
provide, via the network, modified action code, that includes the rewritten portions of the action code, to the client device associated with the network request.
9. The device of claim 8 , the one or more processors, when rewriting the portions of the action code, being further to:
provide, to the client device, an application to be installed on the client device, the application rewriting the portions of the action code.
10. The device of claim 8 , the one or more processors, when rewriting the portions of the action code, being further to:
identify an object requested through the network communication;
determine that the object is associated with a particular class; and
rewrite, based on determining that the object is associated with the particular class, arguments, included in the action code, that are associated with the particular class.
11. The device of claim 8 , the one or more processors, when rewriting the portions of the action code, being further to:
identify an action associated with the network communication;
identify, statements in the action code associated with the action; and
replace the identified statements with replacement code that causes the action to be implemented via the particular network device.
12. The device of claim 11 , the one or more processors, when identifying the action, being further to:
examine one or more stack constants of the action code and one or more trace constants of the action code; and
identify the action based on examining the one or more stack constants and the one or more trace constants.
13. The device of claim 11 , the one or more processors, when replacing the identified statements with the replacement code, being further to:
identify, based on one or more stack constants and one or more trace constants, arguments, in the action code, associated with the action; and
rewrite the identified arguments to include a network identifier associated with the particular network device,
the rewritten arguments causing the network request to be directed, based on the network identifier, to the particular network device.
14. The device of claim 8 , the action code being associated with one or more of:
flash content,
JavaScript, or
ActiveX code.
15. A non-transitory computer-readable medium to store instructions, the instructions comprising:
one or more instructions which, when executed by a processor, cause the processor to receive executable content associated with a network request;
one or more instructions which, when executed by the processor, cause the processor to disassemble the executable content into action code;
one or more instructions which, when executed by the processor, cause the processor to locate portions of the action code capable of making the network request,
the one or more instructions to locate the portions of the action code further including:
one or more instructions which, when executed by the processor, cause the processor to perform a flow analysis of the action code and to inspect a stack of the action code,
one or more instructions which, when executed by the processor, cause the processor to locate, based on performing the flow analysis of the action code and inspecting the stack of the action code, a code parameter related to making the network request associated with the executable content, and
one or more instructions which, when executed by the processor, cause the processor to locate the portions of the action code based on the code parameter;
one or more instructions which, when executed by the processor, cause the processor to rewrite the portions of the action code, capable of making the network request, to redirect a network communication, associated with the executable content, to a particular network device,
the one or instructions to rewrite the portions of the action code further including:
one or more instructions which, when executed by the processor, cause the processor to rewrite the code parameter to redirect the network communication, associated with the executable content, to the particular network device; and
one or more instructions which, when executed by the processor, cause the processor to provide the rewritten portions of the action code to a client device.
16. The non-transitory computer-readable medium of claim 15 , the one or more instructions to rewrite the portions of the action code further including:
one or more instructions to provide, to the client device, an application,
the application, when installed on the client device, rewriting the portions of the action code.
17. The non-transitory computer-readable medium of claim 15 , the one or more instructions to rewrite the portions of the action code further including:
one or more instructions to identify an object requested through the network communication;
one or more instructions to determine that the object is associated with a particular class; and
one or more instructions to rewrite, in the portions of the action code and based on determining that the object is associated with the particular class, arguments associated with the particular class.
18. The non-transitory computer-readable medium of claim 15 , the one or more instructions to rewrite the portions of the action code further including:
one or more instructions to identify an action associated with the network communication;
one or more instructions to identify statements in the action code associated with the action; and
one or more instructions to replace the identified statements with replacement code that causes the action to be implemented via the particular network device.
19. The non-transitory computer-readable medium of claim 18 , the one or more instructions to identify the action further including:
one or more instructions to examine one or more stack constants of the action code and one or more trace constants of the action code; and
one or more instructions to identify the action based on examining the one or more stack constants and the one or more trace constants.
20. The non-transitory computer-readable medium of claim 19 , the one or more instructions to replace the identified statements with the replacement code further including:
one or more instructions to identify, based on the one or more stack constants and the one or more trace constants, arguments, in the action code, associated with the action; and
one or more instructions to rewrite the identified arguments to include a network identifier associated with the particular network device,
the rewritten arguments causing the network request to be directed, based on the network identifier, to the particular network device.