# US 10,320,808 B2 · Clickjacking prevention > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,808 B2 - Document ID: US10320808B2 - Status: Granted - Kind: B2 - Application number: 15/333,369 - Filed: 2016-10-25 - Published: 2018-04-26 - Granted: 2019-06-11 - Earliest claimed: 2016-10-25 - Assignees: Cerner Innovation, Inc. - Applicants: Cerner Innovation, Inc. - Inventors: Matthew Allen Randall; Craig Douglas Hooten; Michael Joseph Hemesath - Web page: https://patentgrep.com/patent/US10320808B2 ## CPC - H04L 63/123: {received data contents, e.g. message integrity} - G06F 21/31: User authentication - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - G06F 21/563: {by source code analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods provide for clickjacking prevention code provided in an embedded webpage to prevent clickjacking when the embedded webpage is called by an embedding webpage determined to be illegitimate. When the embedded webpage is loaded on a user device, the clickjacking prevention code is executed and initially prevents content of the embedded webpage from being rendered. Additionally, the clickjacking prevention code sends a message containing a secret to a known domain that provides legitimate embedding webpages. When the embedding webpage sends a message to the embedded webpage, the message is checked to see if it contains the secret. If the message contains the secret, the embedding webpage is legitimate since it originated from the known domain, and the content of the embedded webpage is rendered. Alternatively, if the message does not contain the secret, the content of the webpage is not rendered. ## Claims ### Claim 1 One or more non-transitory computer storage media storing computer-useable instructions that, when executed by a computing device, cause the computing device to perform operations, the operations comprising: preventing content of an embedded webpage from being rendered on a user device, the embedded webpage having been called by an embedding webpage; sending a message containing a secret from the embedding webpage on the user device to a server of a known domain; after sending the message containing the secret to the server, receiving a message from the embedding webpage that called the embedded webpage; determining, on the user device, whether the message from the embedding webpage includes the secret, the message from the embedding webpage including the secret when the embedding webpage is legitimate and receives the secret from the server after the secret is sent to the server from the user device; when the message from the embedding webpage includes the secret, allowing the content of the embedded webpage to be rendered; and when the message from the embedding webpage does not include the secret, continuing to prevent the content of the embedded webpage from being rendered. ### Claim 2 (depends on 1) The one or more computer storage media of claim 1, wherein the content of the embedded webpage is prevented from being rendered using a framekiller technique. ### Claim 3 (depends on 1) The one or more computer storage media of claim 1, wherein the message to the known domain is a PostMessage. ### Claim 4 (depends on 1) The one or more computer storage media of claim 1, wherein the message from the embedding webpage is a PostMessage. ### Claim 5 (depends on 1) The one or more computer storage media of claim 1, wherein the embedding webpage calls the embedded webpage to be displayed within an iframe. ### Claim 6 (depends on 1) The one or more computer storage media of claim 1, wherein the operations are performed by a web browser on the user device. ### Claim 7 (depends on 1) The one or more computer storage media of claim 1, wherein the operations further comprise sending a message containing the secret to at least one other known domain. ### Claim 8 A computer-implemented method for preventing clickjacking on a user device, the method comprising: receiving an embedded webpage called by an embedding webpage rendered on the user device, the embedded webpage containing clickjacking prevention code; and executing the clickjacking prevention code on the user device to perform operations that include: preventing content of the embedded webpage from being rendered; sending a message containing a secret to a server of a known domain; after sending the message containing the secret to the server, receiving a message from the embedding webpage that called the embedded webpage; determining whether the message from the embedding webpage includes the secret, the message from the embedding webpage including the secret when the embedding webpage is legitimate and receives the secret from the server after the secret is sent to the server from the user device; when the message from the embedding webpage includes the secret, allowing the content of the embedded webpage to be rendered; and when the message from the embedding webpage does not include the secret, continuing to prevent the content of the embedded webpage from being rendered. ### Claim 9 (depends on 8) The method of claim 8, wherein the content of the embedded webpage is prevented from being rendered using a framekiller technique. ### Claim 10 (depends on 8) The method of claim 8, wherein the message to the known domain is a PostMessage. ### Claim 11 (depends on 8) The method of claim 8, wherein the message from the embedding webpage is a PostMessage. ### Claim 12 (depends on 8) The method of claim 8, wherein the embedding webpage calls the embedded webpage to be displayed within an iframe. ### Claim 13 (depends on 8) The method of claim 8, wherein the method is performed by a web browser on the user device. ### Claim 14 (depends on 8) The method of claim 8, wherein the method further comprises sending a message containing the secret to at least one other known domain. ### Claim 15 A computer system comprising: one or more hardware processors; and one or more computer storage media storing computer-useable instructions that, when used by the one or more processors, cause the one or more processors to: receive a request for an embedded webpage from a user device, the request having been generated in response to an embedding webpage calling the embedded webpage; and providing the embedded webpage in response to the request, the embedded webpage including clickjacking prevention code that when executed on the client device causes the client device to perform operations that include: preventing content of the embedded webpage from being rendered; sending a message containing a secret to a server of a known domain; after sending the message containing the secret to the server, receiving a message from the embedding webpage that called the embedded webpage; determining whether the message from the embedding webpage includes the secret, the message from the embedding webpage including the secret when the embedding webpage is legitimate and receives the secret from the server after the secret is sent to the server from the user device; when the message from the embedding webpage includes the secret, allowing the content of the embedded webpage to be rendered; and when the message from the embedding webpage does not include the secret, continuing to prevent the content of the embedded webpage from being rendered. ### Claim 16 (depends on 15) The system of claim 15, wherein the content of the embedded webpage is prevented from being rendered using a framekiller technique. ### Claim 17 (depends on 15) The system of claim 15, wherein the message to the known domain is a PostMessage. ### Claim 18 (depends on 15) The system of claim 15, wherein the message from the embedding webpage is a PostMessage. ### Claim 19 (depends on 15) The system of claim 15, wherein the embedding webpage calls the embedded webpage to be displayed within an iframe. ### Claim 20 (depends on 15) The system of claim 15, wherein the operations further comprise sending a message containing the secret to at least one other known domain.