Script verification using a digital signature

1. A system, comprising at least one processor executing instructions within a memory coupled to a first server computer coupled to a network, the instructions causing the first server computer to:

query a data store, coupled to the network and comprising a list of hosted scripts, associated valid digital signature files, and public keys, to identify:

a web page, hosted on the first server computer and including:

a first script tag comprising a uniform resource locator (URL) source attribute, within the first script tag, referencing a first URL defining a first location for requesting a script file, separate from the web page and hosted on a second server computer coupled to the network and operated by a hosting entity other than a first hosting entity operating the first server computer; and

a second script tag comprising a signature file source attribute, within the script tag, referencing a second URL defining a second location for requesting a signature file having the same file name as the script file with a different file extension;

execute, at a regular time interval, a hypertext transfer protocol (HTTP) request running on the first server computer and configured to access:

the script file using the first URL; and

the signature file using the second URL, the signature file being generated:

by a private key in a public/private key pair by the second server computer without applying cryptography to the contents of the script file; and

in association with the script file and stored on the second server computer;

responsive to a determination that the signature file contains a signature that cannot be authenticated as a valid signature using a public key in the public/private key pair:

disable, by the first server computer, execution of the script tag in the web page; and

generate a notification that the signature file cannot be authenticated using the public key.

2. The system of claim 1 , wherein the signature file is authenticated by the first server computer or a web browser using a digital certificate authenticating a script vendor, wherein the first server computer or the web browser only trusts signatures and public keys issued to a third party script vendor operating the second server computer.

3. The system of claim 1 , wherein the signature file is generated by a private key hosted in a hardware security module on the second server computer operated by a third party script vendor, and saved by the second server computer to a publicly accessible server.

4. The system of claim 1 , wherein the signature file is authenticated using a public key known to belong to a third party script vendor operating the second server computer, in order to verify that the third party script vendor issued and signed a source code of the script file.

5. The system of claim 1 , wherein the instructions further cause the server computer, responsive to a determination that the signature file contains a signature that can be authenticated, to download and execute the script file.

6. The system of claim 1 , wherein the script file is a JavaScript file.

7. The system of claim 1 , wherein the HTTP request:

executes a request of the web page analogous to a web browser; and

is run on a plurality of servers at a plurality of IP address locations within the network.

8. The system of claim 1 , further comprising a web browser running on a client computer coupled to the network, the web browser configured to:

request the web page;

download the script file;

download the signature file from the second server computer;

authenticate the signature file; and

execute the script file.

9. The system of claim 1 , wherein:

the web page is hosted on the first server computer; and

the script file and the signature file are hosted on the second server computer, which is operated by a third party script vendor.

10. The system of claim 1 , further comprising a script or tag management software, running on the first server computer:

comprising a plurality of rules for managing a plurality of script tags;

receiving input from at least one user defining a rule to disable execution of the script file; and

configured, responsive to the determination that the signature file cannot be authenticated using the public key, to automatically disable the execution of the script file.

11. A method, comprising:

querying, by a first server computer coupled to a network and comprising at least one processor executing instructions within a memory, a data store coupled to the network and comprising a list of hosted scripts, associated with valid digital signature files, and public keys, to identify:

a web page, hosted on the first server computer and including:

a first script tag comprising a URL, within the first script tag, referencing a first uniform resource locator (URL) defining a first location for requesting a script file, separate from the web page and hosted on a second server computer coupled to the network and operated by a hosting entity other than the first hosting entity operating the first server computer; and

a second script tag comprising a signature file source attribute, within the script tag, referencing a second URL defining a second location for requesting a signature file having the same file name as the script file with a different file extension;

executing, by the first server computer, at a regular time interval, a hypertext transfer protocol (HTTP) request running on the first server computer and configured to access:

the script file using the first URL; and

a signature file using the second URL, the signature file being generated:

by a private key in a public/private key pair by the second server computer without applying cryptography to the contents of the script file; and

in association with the script file and stored on the second server computer;

responsive to a determination that the signature file contains a signature that cannot be authenticated as a valid signature using a public key in the public/private key pair:

disabling, by the first server computer, execution of the script tag in the web page; and

generating, by the first server computer, a notification that the signature file cannot be authenticated using the public key.

12. The method of claim 11 , wherein the signature file is authenticated by the first server computer or a web browser using a digital certificate authenticating a script vendor, wherein the first server computer or the web browser only trusts signatures and public keys issued to a third party script vendor operating the second server computer.

13. The method of claim 11 , wherein the signature file is generated by a private key hosted in a hardware security module on the second server computer operated by a third party script vendor, and saved by the second server computer to a publicly accessible server.

14. The method of claim 11 , wherein the signature file is authenticated using a public key known to belong to a third party script vendor operating the second server computer, in order to verify that the third party script vendor issued and signed a source code of the script file.

15. The method of claim 11 , wherein the instructions further cause the server computer, responsive to a determination that the signature file contains a signature that can be authenticated, to download and execute the script file.

16. The method of claim 11 , wherein the script file is a JavaScript file.

17. The method of claim 11 , wherein the HTTP request:

executes a request of the web page analogous to a web browser; and

is run on a plurality of servers at a plurality of IP address locations within the network.

18. The method of claim 11 , further comprising a web browser running on a client computer coupled to the network, the web browser configured to:

request the web page;

download the script file;

download the signature file from the second server computer;

authenticate the signature file; and

execute the script file.

19. The method of claim 11 , wherein:

the web page is hosted on the first server computer; and

the script file and the signature file are hosted on the second server computer, which is operated by a third party script vendor.

20. The method of claim 11 , further comprising a script or tag management software, running on the first server computer:

comprising a plurality of rules for managing a plurality of script tags;

receiving input from at least one user defining a rule to disable execution of the script file; and

configured, responsive to the determination that the signature file cannot be authenticated using the public key, to automatically disable the execution of the script file.