Patent Application
20090183227
Contents available on the Internet have gone through an explosive transformation in recent years. The static texts or still picture images in the web pages that impressed early online users have been replaced by dynamic animations, rich multimedia video clips, and dynamic web page layouts. In addition, contents in web pages have become interactive at runtime; the users can use input devices (e.g., mouse or stylus) or user's fingers to move or rearrange objects within web pages for rich customization.
One of the driving forces in this interactive development is the use of script-content in the form of computer-executable instructions that can be executed by the applications or software (e.g., a web browser) at or near runtime. One example of such developments is a mashup or mash-up, which is a web application that combines code and behaviors from various sources for integration within an experience or for creating new experiences. However, due to the nature of the browser, as mash-ups are executed when it is rendered or before it is rendered, most mash-ups are creating implied trust relationships between the host site and third-party code within the web pages. This trust-relationship puts web-sites and the underlying web business models at risk. In addition, because of the interactive nature of mash-up codes or scripts, the trust-relationship may also put the user's personal or private content presented on the web pages and/or local device at risk.
Embodiments of the invention solve the above shortfalls by defining policies for behaviors of policy-driven script content of a web page such that embodiments of the invention may monitor, enforce, modify, or supplement the behaviors of the script content as it is rendered to a user or before it is rendered to the user. In another embodiment, the defined policies are provided to a local device such that a browser executed at the local device may conveniently compare the script content security boundaries at the local level. Alternative embodiments provide a platform for a policy-driven and policy-enforceable script execution and policy scenarios around content transclusion, component development, and API extensibility especially within the context of web-based mash-ups. Alternative embodiments further provide the ability to automatically support multiple-instancing and provide scope protection. In addition, further aspects of the invention monitor and record user interactions with the script content such that quality of service (QOS) metrics or data may be recorded and reported to the issuers, composers or providers of the script content.
This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.
Other features will be in part apparent and in part pointed out hereinafter.
Appendix A illustrates an exemplary implementation of a secure and extensible policy-driven application platform.
Corresponding reference characters indicate corresponding parts throughout the drawings.
Embodiments of the invention provide security for in-page script content or functions and provide proper protection to user's content that is displayed or rendered within a web page. Referring now to
The client 108 includes any client device associated with the user 114, such as a personal computer (PC) (e.g., a desktop or a laptop), a portable digital device, a personal digital assistant (PDA), a cellular phone, a portable media player, or the like. The communication network includes any wired or wireless communication network that facilitates connections between two or more computers.
In one example, the server 106 is configured to provide the content holder 104 to the user 114 to be rendered or displayed at the client 108. For example, the content holder 104 may be rendered by a web browser application (WBA) 118 installed on the client 108. In one embodiment, the content holder 104 may be a web page, an ASCII text page, a web page with embedded markup language content, a web page with embedded media content or the like. In one embodiment, the WBA 118 is a stand alone application or software. In another embodiment, the WBA 118 may be a part or a component of a program or software that is capable of rendering content written in a markup language, such as hypertext markup language (HTML), extensible markup language (XML), or the like. It is also understood that the WBA 118 may be an application or a component that renders other content in an online environment, such as graphics files (.jpg, .tiff, .pdf, etc.), media files (.wma, .mp3, .mp4, etc.), or the like.
The content holder 104 includes one or more components with content. In one example, a component may include script content 102 and/or non-script content 116. In one example, the script content 102 includes computer-executable instructions, codes, functions, executable expressions, or other executable programming language. The script content 102 may cause an execution invocation via a function call or an application programming interface (API) request or call. The execution invocation may request resources from the server 106, the client 108, or the WBA 118. The non-script content 116, on the other hand, includes content that is not executable or does not give rise to executed results. For example, a text statement (e.g., “Today's news . . . ”) may be non-script content 116 but a text statement (e.g., echo(“Today's news . . . ”); document.write(“Today's news . . . ”);) may be script content 102 because upon executing the statement, the text statement brings about a functional result that is more than the mere display of the text statement itself.
The system 100 also includes a policy engine 120 including one or more policies for defining execution boundaries for the script content 102. In one example, the policy engine 120 includes a storage medium for storing one or more policies. Referring now to
For example, suppose the policy 202-1 defines the execution boundary for the script content “addFolder( ).” The execution boundary in the policy 202-1 may define that the script content “addFolder( )” may be executed during runtime within an instance of the WBA 118 after sending a request to the server 106. Also, the boundary may further limit that the result of the script content “addFolder( ),” which is creating a folder or a directory, is only limited to accessing a storage space associated with the user 114 when information of the user 114 is rendered by the WBA 118 from the server 106 on the client 108. The “addFolder( )” function has no access (e.g., rights to read) to other information from the storage space.
For example, in
In this example where the WBA 118 displays to the user 114 the personal web-based e-mail inbox, the content display area 306 also includes a side pane 314 and a main message pane 316 listing one or more e-mail messages in the inbox of the user 114. As an illustration, the side pane 314 displays a number of controls, buttons or links that link the user 114 to one or more directories or folders within the inbox of the e-mail account user@user-mail.com. For example, the folders include an “inbox” folder, a “drafts” folder, a “sent items” folder, a “junk” folder, and a “deleted” folder. The side pane 314 also includes a section showing one or more personalized folders or directories under the “FOLDERS” heading. In this illustration, there is no personalized folder or directory of the user 114. The display window 302 also displays the list of e-mail messages in the main message pane 316. As illustrated, the display window 302 displays or renders the layout and also content of the user's inbox provided from the server 106. In other words, as long as the content or layout of the user's inbox content is properly recognized by the WBA 118, the display window 302 will present the layout and the content to the user 114 accordingly in the content display area 306. It is also understood that the side pane 314 and the main message pane 316 may be modified depending on the layout of the content holder 104.
Also in the illustrated example, the user 114 receives an e-mail message 320 that is from “SHOPPING” with a subject line of “20% OFF ONLINE SALE.” Referring now to
Current technologies would execute the script content without interference. In other words, if the script content's functions specify opening of display windows, the display windows will be opened. The user 114 would not have control over how the script content is executed. In fact, the server 106 also has no control over the content because the rendering or displaying of content in a web or online environment is typically delegated to the WBA 118. As such, the privacy or content of the user's inbox or other content is subjected to whim of the script content of any displayed page.
Embodiments of the invention define policies to monitor and/or intercept script content such that the script content can only be executed within a defined boundary specified by the defined policies. Aspects of the invention also provide a dynamic resolution in response to evaluating the intercepted script content calls or functions. The dynamic resolution may include at least one of the following: granting the request if the requested resource can be executed within the execution boundary, denying the request if the requested resource cannot be executed within the execution boundary, augmenting the request before granting the request, replacing the request with another request before providing a substitute resolution in response to the another request, and requesting a user input from the user for granting or denying the request.
The user 114 in one embodiment may also be involved in further restricting the performance of the script content. Referring now to
Based on the example above, once the message 320 is “opened,” the script content of the message 320 attempts to add a folder to the e-mail account of the user 114 called “shopping” folder using a function such as “addFolder( )”. Instead of performing and executing the script content as prior technologies would do, aspects of the invention pass the script content and/or the function call through the policy engine 120. The policy engine 120, as illustrated in
In this example, the substituted alertWindow( ) function wishes open a window to alert the user 114 by displaying the message: “Add a “shopping” folder including coupons from your favorite stores?” The user 114 may either choose to add the folder by clicking on “YES” button 340 or decline the request by clicking on “NO” button 342. If the user 114 selects the “YES” button 340, a new personalized “shopping” folder 334 will be added to the user's personalized folder section, as seen in
In another embodiment, the script content of the message 320 may invoke an application programming interface (API) call to resources of the server 106, the processor 110, the client 108 or the WBA 118. In this circumstance, embodiments of the invention may also intercept such API invocations and pass them through the policy engine 120. In one embodiment, the policy engine 120 may choose to allow, deny, augment, or replace the behavior of any call with or without any notifications to the user 114. The calls can originate from an existing API or be defined only via the policy (e.g., they do not have to be pre-existing APIs).
For example,
In the alternative, aspects of the invention may also be configured to automatically grant the request or function call and the user 114 again is given an opportunity in
In another embodiment, the policy engine 120 may be configured to modify the intercepted function calls. Referring now to
In one embodiment, as the WBA 118 is executed, one or more instances of the WBA 118 can be achieved and aspects of the invention properly differentiate each instance during runtime or execution time. For example, the user 114 may have one or more WBA 118 windows running at the same time. As such, as aspects of the invention are instantiated, the instantiation of this invention within current WBA 118 windows requires all code to be first normalized via a simple transformation. This transformation redirects all API calls through the policy engine 118. This step attempts to force the policy engine to be called first and to also inject the appropriate QOS (quality of service) tests (to be discussed later). As a further advantage, each of the instantiated instances of the script content has an independent and separate execution boundary.
In one embodiment, whenever an API is invoked from the script content of the message 320, it is directed against the policy engine 120. The policy engine 120 examines at least one of the following: the type of object making the request, the type of API being called (property, method, factory, or delete) and passes the decision process to at least one of the policy scripts or rules. The policy scripts can choose to deny access (the default), allow, augment (or dynamically choose to deny or allow depending on context), or replace and/or define the behavior.
In one example, policies may be stacked: any single API invocation can be mapped to 0 through n policies or rules. The policies may be executed in defined order. For example, a first-order policy may enable access to a property (e.g., title property), and a subsequent policy may further constrain the rules by enabling access to the property only if on an element within the context of 102-1.
Another example may allow a method (e.g., alert) to be enabled with a subsequent policy overriding the default behavior of alert to display on the status bar rather than via a prompt.
As such, aspects of the invention provide a layer of protection to the user 114 when the content or the content holder the user 114 views online via the WBA 118 may include script functions, executable code and API requests. In one existing example, it is common for a user of a web-based e-mail inbox to have many convenient features, such as automatically adding an e-mail address to the user's contact folder by clicking on a link such as “add to contact.” Some e-mail service providers achieve this convenient feature by prompting a user to a separate page to grant the permission. Some providers would automatically perform the requested action as soon as the user clicks on the “add to contact” link. However, some providers would automatically perform the requested action without the user clicking on the “add to contact” link; the providers assume that the user wishes to add the contact and proceed to add the contact without asking the user. As such, the user has no control over the private information in the user's contact folder. Embodiments of the invention attempt to alleviate such problem and shortfall of the current systems by intercepting the function calls or execution request from script content of the content holder 104 and evaluate the function calls before getting the user involved.
In another embodiment, a copy of the police engine 120 is instantiated on or copied to the client 108 such that the interception of the function calls may be done locally on the client 108. In other words, embodiments of the invention enable the WBA 118 to monitor the script content of the content holder 104 and intercept the function calls or API calls as the content holder 104 is rendered or displayed at runtime. The intercepted function calls or requests are evaluated by the policy engine 120 accessible locally by the client 108 and the WBA 118. The WBA 118 may next render any subsequent UI to the user 114 according to the defined policies. In another embodiment, the WBA 118 or the client 108 further pass arguments or result of executing the script content of the content holder 104 to the server 106. Using
In an alternative embodiment, there may not be feedback from the user or decision making like those illustrated in
Referring now to
As such, the script content 410 may attempt to read the content of the module 404 to see if the city to which the user wants to know the weather. This attempt will trigger the advertisement 402 to display an advertisement for ski resorts closest to the city of interest to the user. Embodiments of the invention may permit this attempt/action or block or inhibit this attempt/action or operation. If the permission is granted, the advertisement 402 is permitted to see a targeted advertisement. On the other hand, the advertisement 402 may be inhibited from displaying a targeted advertisement and may display a generic advertisement, such as “TOP SKI RESORTS IN THE US” as shown in
Aspects of the invention can measure the effectiveness of such script content to afford effective feedback to the content providers. Referring now to
In a further embodiment, the policy engine 120 may have an intermediary intercept all properties, method invocations, and object factories where the call is validated before being executed. Validation may be dynamic (it is not merely on or off) and the decision process can take into account all details. In addition, the policy engine 120 automatically encapsulate the untrustworthy code in its own sandbox that can be instantiated multiple times, each potentially with its own unique overriding policy.
Alternative embodiments include policies that provide more than just security protection. The differences in policies may be normalized between execution systems (e.g., browsers), and the policies may also extend the default capabilities with new APIs, or make bugs or other issues transparent to the developer.
For web-based scriptable content, before applying policies, the resources (e.g., HTML, CSS, and Scripts) currently may need to be transformed server-side. This transformation is not a validation step but rather merely enables the client-side policies to be applied at execution time. It can be envisioned that alternative embodiments may enable the transformation step to be part of a larger process of “publishing” or “rendering” content, along with code validation, versioning, author profiles, etc.
While often viewed in the context of the browser or the WBA 118, all the aforementioned challenges around mash-ups is applicable to any environment where untrustworthy content (whether it be script, DLL's, etc) is executed within a greater application. Therefore, the WBA 118 should nearly be viewed as one possible instantiation.
Compared to traditional web gadgets (which are components isolated on the page), embodiments of the invention allow the code or the script content to execute natively within the page and, depending on policy, have access to surrounding APIs or context. This approach also serves as a host-driven model for website extensibility.
Referring now to
Referring now to
At 716, the application 710 may further identify parameters included in the intercepted execution invocation. The identified parameters may, among other operations, request resources from the application or the client device for interacting with the other portions of the online content. In another embodiment, the identified parameters may request resources from the application or the client device for interacting with a user, such as the user 114. At 718, the application 710 evaluates the identified parameters against the execution boundary of each of the policies stored in the local memory 704. For example, the application 710 analyzes the identified parameters against the execution boundary and determines whether the web script content may be executed within the execution environment of the application 710 or the client device 702. The application 710 provides to the application a dynamic resolution in response to the evaluated parameters at 720. As previously described, the resolution may involve modifying, replacing, removing, or augmenting the issued execution invocation. At 722, the display 706 may display the provided resolution 722 to the user.
For purposes of illustration, programs and other executable program components, such as the operating system, are illustrated herein as discrete blocks. It is recognized, however, that such programs and components reside at various times in different storage components of the computer, and are executed by the data processor(s) of the computer.
Although described in connection with an exemplary computing system environment, including client device 702, embodiments of the invention are operational with numerous other general purpose or special purpose computing system environments or configurations. The computing system environment is not intended to suggest any limitation as to the scope of use or functionality of any aspect of the invention. Moreover, the computing system environment should not be interpreted as having any dependency or requirement relating to any one or combination of components illustrated in the exemplary operating environment. Examples of well known computing systems, environments, and/or configurations that may be suitable for use with aspects of the invention include, but are not limited to, personal computers, server computers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, mobile telephones, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.
Embodiments of the invention may be described in the general context of computer-executable instructions, such as program modules, executed by one or more computers or other devices. Generally, program modules include, but are not limited to, routines, programs, objects, components, and data structures that perform particular tasks or implement particular abstract data types. Aspects of the invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
An interface in the context of a software architecture includes a software module, component, code portion, or other sequence of computer-executable instructions. The interface includes, for example, a first module accessing a second module to perform computing tasks on behalf of the first module. The first and second modules include, in one example, application programming interfaces (APIs) such as provided by operating systems, component object model (COM) interfaces (e.g., for peer-to-peer application communication), and extensible markup language metadata interchange format (XMI) interfaces (e.g., for communication between web services).
The interface may be a tightly coupled, synchronous implementation such as in Java 2 Platform Enterprise Edition (J2EE), COM, or distributed COM (DCOM) examples. Alternatively or in addition, the interface may be a loosely coupled, asynchronous implementation such as in a web service (e.g., using the simple object access protocol). In general, the interface includes any combination of the following characteristics: tightly coupled, loosely coupled, synchronous, and asynchronous. Further, the interface may conform to a standard protocol, a proprietary protocol, or any combination of standard and proprietary protocols.
The interfaces described herein may all be part of a single interface or may be implemented as separate interfaces or any combination therein. The interfaces may execute locally or remotely to provide functionality. Further, the interfaces may include additional or less functionality than illustrated or described herein.
Embodiments of the invention may be implemented with computer-executable instructions. The computer-executable instructions may be organized into one or more computer-executable components or modules. Aspects of the invention may be implemented with any number and organization of such components or modules. For example, aspects of the invention are not limited to the specific computer-executable instructions or the specific components or modules illustrated in the figures and described herein. Other embodiments of the invention may include different computer-executable instructions or components having more or less functionality than illustrated and described herein.
The order of execution or performance of the operations in embodiments of the invention illustrated and described herein is not essential, unless otherwise specified. That is, the operations may be performed in any order, unless otherwise specified, and embodiments of the invention may include additional or fewer operations than those disclosed herein. For example, it is contemplated that executing or performing a particular operation before, contemporaneously with, or after another operation is within the scope of aspects of the invention.
When introducing elements of aspects of the invention or the embodiments thereof, the articles “a,” “an,” “the,” and “said” are intended to mean that there are one or more of the elements. The terms “comprising,” “including,” and “having” are intended to be inclusive and mean that there may be additional elements other than the listed elements.
Having described aspects of the invention in detail, it will be apparent that modifications and variations are possible without departing from the scope of aspects of the invention as defined in the appended claims. As various changes could be made in the above constructions, products, and methods without departing from the scope of aspects of the invention, it is intended that all matter contained in the above description and shown in the accompanying drawings shall be interpreted as illustrative and not in a limiting sense.
A Sample Implementation
The following example illustrates the transformation from source code to safe code, and the execution of the safe code, which are illustrated in
As you can see the above source contains CSS, HTML and JavaScript. The CSS applies styles to the <body> tag, and the script attaches an event to the “body”. The HTML contains a <span> with an “id”. We shall see that during the transformation and execution of the above source code the Runtime will: 1. Ensure that the “body” referenced by the code is the sandboxed container for the code in the result page (in this embodiment the sandbox is a <div>), as illustrated in
When the above code is transformed, the following is produced:
The current embodiment transforms the original HTML into: a method call: registerCode. As can be seen, this method call can be safely injected into a container page. They are simply calls into the Runtime. The transformation step converted the CSS into a “JSON” format. This JSON object is used as input to the Runtime.
One embodiment has simply transformed the HTML from the source into a property value for the “innerHTML” of the “documentElement”. The Runtime will ensure that the HTML is safe and conforms to the prevailing policies. Note: Future embodiments may transform the source HTML into other formats such as JSON. In this embodiment, instead of calling “addSheet” as illustrated above, a setting is passed to registerCode.
The JavaScript code was transformed into calls into Runtime methods “b”, “c”, “d” etc. These are the Runtime methods that ensure that property set/get, method invocation and object creation conform to the policies.
When the transformed code is “run” in the resultant page, the Runtime produces the following code fragments:
The source CSS used the “tag selector” syntax to apply the style to the “<body>” tag. This has been transformed into a “class selector” that applies to an element with a class of “ms_id1”. This is the <div> section that is now the “sandbox” for the transformed HTML:
As can be seen, the Runtime has prefixed the <span> id with “ms_id1” to ensure that it is unique. The sandboxed code, of course, is unaware that this has happened. On each timer tick it sets the innerText of “currentTime”.
The CSS background color of “lightblue” has only been applied to the sandboxed area allocated to the source. When one clicks inside this area, the code shows an alert box containing the “body.”
| Number | Date | Country | |
|---|---|---|---|
| 61020597 | Jan 2008 | US |
