Method for secure web browsing

Patent metadata

Field	Value
Publication number	US-9813429-B2
Application number	US-201213713483-A
Country	US
Kind code	B2
Filing date	Dec 13, 2012
Priority date	Jan 3, 2012
Publication date	Nov 7, 2017
Grant date	Nov 7, 2017

Abstract

The invention relates to a computer-implemented method for secure web browsing. The method includes:
receiving a request submitted from a browser, the browser running in a default runtime environment; evaluating by the proxy module, the received request and/or evaluating the requested content; in case the request is determined to request insecure content and/or in case the requested content is determined to comprise insecure content, sending, by the proxy module, a copy of the received request to a receiver module running in a secure runtime environment; in case the request is determined to request secure content, sending a copy of the request to the remote server.

First claim

The invention claimed is:

1. A computer-implemented method for secure web browsing, the method comprising:
receiving, by a proxy module, a request submitted from a browser, the browser running in a default runtime environment, the request requesting content provided by a remote server;
determining, by the proxy module, whether at least one of the following is true: the received request requests insecure content, or the requested content comprises insecure content;
in case the request is determined to request insecure content and/or in case the requested content is determined to comprise insecure content, sending, by the proxy module, a copy of the received request to a receiver module, the receiver module running in a secure runtime environment separate from the default runtime environment, the secure runtime environment preventing any malicious code executed in said runtime environment to affect the default runtime environment of the browser;
responsive to sending, by the proxy module, a copy of the received request to the receiver module, receiving, from the receiver module, at least one of: a secure displayable version of a rendered form of the requested content, or a description enabling access to the secure displayable version of the rendered form of the requested content, the rendered form of the requested content comprising a form produced in the secure runtime environment by a process of interpreting the requested content in a way that a graphical representation of the requested content can be displayed via a graphical user interface to a user, the secure displayable version of the rendered form of the requested content comprising a secure displayable graphical representation of at least some insecure requested content; and
forwarding, by the proxy module, at least one of the secure displayable version of the rendered form of the requested content or the description enabling access to the secure displayable version of the rendered form of the requested content received from the receiver module, to the browser.

2. The computer-implemented method according to claim 1 , the method further comprising:
in case the requested content is determined not to comprise insecure content, forwarding the requested content to the browser.

3. The computer-implemented method according to claim 1 , further comprising:
listening, in the receiver module, for the receipt of the copy of the request from the proxy module.

4. The computer-implemented method according to claim 1 ,
wherein the proxy module is running on a proxy processing device and the browser is running on a user computer, or
wherein the proxy module and the browser are running on the user computer.

5. The computer-implemented method according to claim 1 ,
wherein the secure runtime environment is a runtime environment provided by a secure computer; or
wherein the secure runtime environment is a virtual machine running on the proxy processing device, wherein the browser is running on the user computer, the virtual machine preventing any malicious code executed in said virtual machine to affect a runtime environment of the proxy module; or
wherein the secure runtime environment is a virtual machine running on the user computer, wherein the browser is also running on the user computer and wherein any malicious code executed in said virtual machine is prohibited from affecting the default runtime environment of the browser by running the virtual machine with less privileges than the default runtime environment.

6. The computer-implemented method according to claim 1 further comprising:
providing the proxy module as an integral part of a protocol stack of the user computer, the protocol stack being responsible for establishing a network connection between the proxy module and the browser of the user computer and/or for establishing a network connection between the proxy module and the remote server.

7. The computer-implemented method according to claim 1 , wherein evaluating the received request comprises one or more steps being selected, in any combination, from a group comprising:
extracting a URL from the request and evaluating the URL; and
evaluating the type of the requested content and/or the type of resource providing the content.

8. The computer-implemented method according to claim 1 , further comprising:
receiving at least a header of the response from the remote server, the response being a response to the copy of request sent to the remote server;
evaluating the header for determining if the response comprises insecure content;
in case the response is determined to comprise insecure content, sending the copy of the request to the receiver module for enabling the receiver module to send the request to the remote server;
in case the response is determined to comprise secure content, continuing receiving the response until the complete response is received; and
sending the complete response or the data contained therein to the proxy module.

9. A computer-implemented method for secure web browsing, the method being executed in a secure runtime environment, the method comprising:
receiving, by a receiver module running in the secure runtime environment, a request from a proxy module, the request originating in a browser running outside the secure runtime environment, the request requesting content provided by a remote server;
sending a copy of the received request to the remote server;
receiving a response in response to the sending of the copy of the request, the response containing at least one insecure object;
rendering content of the received response within the secure runtime environment to generate a secure displayable version of the rendered content which does not contain the at least one insecure object, the rendered content of the received response comprising a form produced in the secure runtime environment by a process of interpreting the content of the received response in a way that a graphical representation of the content of the received response can be displayed via a graphical user interface to a user, the secure displayable version of the rendered content comprising a secure displayable graphical representation of at least some insecure content of the received response;
returning, by the receiver module, the secure displayable version of the rendered content and/or a description thereof enabling access to the secure displayable version of the rendered content to the proxy module.

10. The computer-implemented method of claim 9 , wherein the step of sending the copy of the received request to the remote server further comprises:
extracting, by the receiver module, an URL from the received request, the URL pointing to a resource of the remote server, the resource providing the requested content;
starting or using, by the receiver module, a secure browser for sending the copy of the received request by the secure browser, the secure browser running in the secure runtime environment, the copy of the received request being submitted by the secure browser to the extracted URL, the secure browser being a standard browser or a custom browser.

11. The computer-implemented method of claim 9 , wherein the steps of rendering content of the received response within the secure runtime environment to generate a secure displayable version of the rendered content which does not contain the at least one insecure object and the step of returning the secure displayable version of the rendered content and/or the description thereof enabling access to the secure displayable version of the rendered content to the proxy module are executed according to an implementation variant being selected from a group of implementati

Assignees

• IBM

Inventors

• Kass Eric

Classifications

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/14 Primary

  for detecting or protecting against malicious traffic · CPC title