Embedded script security using script signature validation
View Patent ↗A technique allows a client computer with a web browser to receive a web page having active content in response to transmitting a request for content. The active content includes a signature and a set of attributes associated with a web domain. The web browser can interpret the signature and the set of attributes as formatted in the active content. Validation of the signature and the set of attributes can be in a secure mode through a secure enclave module.
1. One or more non-transitory machine readable media, on which are stored instructions, comprising instructions that when executed by a processor cause a machine to:
receive, by a browser on a computing system, a web page with active content; and
in response to the browser detecting the active content, determine that the computing system comprises a secure memory location;
in response to determining that the computing system comprises a secure memory location, validate, utilizing the secure memory location of the computing system, the active content for a presence of unauthorized content by validating a signature of at least a portion of the active content while leaving the active content in cleartext, wherein the signature is formatted for execution of the active content regardless of the determination that the computing system comprises the secure memory location; and
execute the active content in response to determining that the validation of the active content indicates that the active content originated from an authorized origin.
2. The one or more non-transitory machine readable media of claim 1 , wherein the active content further includes a set of attributes.
3. The one or more non-transitory machine readable media of claim 2 , wherein the signature and the set of attributes are formatted to be ignored by a browser incapable of interpreting the signature and the set of attributes.
4. The one or more non-transitory machine readable media of claim 2 , wherein the instructions to validate the active content comprise instructions that when executed cause the browser to check the set of attributes following a positive determination that the signature is valid; and
wherein the set of attributes includes information for one or more of an origin of the active content, an author of the active content, and a permitted use of the active content.
5. The one or more non-transitory machine readable media of claim 4 , wherein the instructions to validate the active content comprise instructions that when executed cause the browser to refuse to execute the active content if the check of the set of attributes indicates that the active content originated at a location other than an authorized origin.
6. The one or more non-transitory machine readable media of claim 1 , wherein the instructions to receive the active content comprise instructions that when executed cause the browser to receive authentication information related to authenticating a web server.
7. The one or more non-transitory machine readable media of claim 1 , wherein the instructions to validate the active content comprise instructions that when executed cause the browser to receive instructions related to obtaining a validation certificate from a certificate server.
8. A computer system for script security, comprising:
one or more processors; and
a memory coupled to the one or more processors, on which are stored instructions, comprising instructions that when executed cause at least some of the one or more processors to:
receive a web page with active content at a browser;
locate the active content with a parser;
in response to the browser locating the active content, determine that the computing system comprises a secure memory location;
in response to determining that the computing system comprises a secure memory location, validate, utilizing the secure memory location of the computing system, the active content for a presence of unauthorized content by validating a signature of at least a portion of the active content while leaving the active content in cleartext, wherein the signature is formatted for execution of the active content regardless of the determination that the computing system comprises the secure memory location; and
execute the active content in response to determining that the validation of the active content indicates that the active content originated from an authorized origin.
9. The computer system of claim 8 , wherein the active content further includes a set of attributes and wherein signature and the set of attributes are formatted to be ignored by a browser incapable of interpreting the signature and the set of attributes.
10. The computer system of claim 8 , wherein the active content further includes a set of attributes and wherein instructions further comprise instructions that when executed cause at least some of the one or more processors to:
check via the browser the set of attributes following a positive determination that the signature is valid;
wherein the set of attributes includes information for one or more of an origin of the active content, an author of the active content, and a permitted use of the active content.
11. The computer system of claim 8 , wherein the instructions further comprise instructions that when executed cause at least some of the one or more processors to receive, via the browser, authentication information related to authenticating a web server.
12. The computer system of claim 8 , wherein the instructions further comprise instructions that when executed cause at least some of the one or more processors to receive via the browser instructions related to obtaining a validation certificate from a certificate server.
13. A method for script security, comprising:
receiving at a browser on a computer system, a web page with active content;
locating by the browser the active content;
in response to the browser locating the active content, determining that the computing system comprises a secure memory location;
in response to determining that the computing system comprises a secure memory location, validate, utilizing the secure memory location of the computing system, the active content for a presence of unauthorized content by validating a signature of at least a portion of the active content while leaving the active content in cleartext, wherein the signature is formatted for execution of the active content regardless of the determination that the computing system comprises the secure memory location; and
executing the active content in response to determining that the validation of the active content indicates that the active content originated from an authorized origin.
14. The method of claim 13 , wherein the active content includes a set of attributes, and wherein the method further comprising checking the set of attributes following a positive determination that the signature is valid;
wherein checking the set of attributes comprises checking information related to at least one of origin of the active content, author of the active content, and a permitted use of the active content.