# US 10,320,832 B2 · Attack protection for WebRTC providers

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,320,832 B2
- Document ID: US10320832B2
- Status: Granted
- Kind: B2
- Application number: 15/373,883
- Filed: 2016-12-09
- Published: 2018-06-14
- Granted: 2019-06-11
- Earliest claimed: 2016-12-09
- Assignees: Sap SE
- Applicants: Sap SE
- Inventors: Martin Johns; Christoph Haefner
- Web page: https://patentgrep.com/patent/US10320832B2

## CPC

- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 65/65: Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

WebRTC is vulnerable to malicious JavaScript, injected by cross-site scripting attacks or compromised or malicious script providers. Through these attacks, attackers can access a WebRTC connection and leak or monitor the audio and video data transmitted. By preventing modification of key WebRTC functions and preventing outgoing streams from being used more than once, these attacks can be thwarted.

## Claims

### Claim 1

A system comprising:
a memory that stores instructions;
one or more processors in communication with a network, configured by the instructions to perform operations comprising:
accessing first code from a first server for execution by a web browser;
accessing second code for execution by the web browser in conjunction with the first code;
executing a first portion of the first code by the web browser, the first portion of the first code causing a first function to become unmodifiable;
executing the second code by the web browser after the execution of the first code, the second code attempting to modify the first function and failing due to the execution of the first portion of the first code; and
executing a second portion of the first code by the web browser after the execution of the second code, the second portion of the first code using the first function to communicate via web real-time communication (WebRTC) over the network.

### Claim 2 (depends on 1)

The system of claim 1, wherein the second code is received from a second server distinct from the first server.

### Claim 3 (depends on 1)

The system of claim 1, wherein:
the one or more processors are in communication with a camera; and
the communicating via WebRTC comprises transmitting image data captured by the camera.

### Claim 4 (depends on 1)

The system of claim 1, wherein:
the one or more processors are in communication with a microphone; and
the communicating via WebRTC comprises transmitting audio data captured by the microphone.

### Claim 5 (depends on 1)

The system of claim 1, wherein:
the execution of the first portion of the first code further modifies a second function to prevent WebRTC streams from being used more than once; and
the execution of the second code comprises the second code attempting to use a WebRTC stream that is already in use and failing due to the execution of the first portion of the first code.

### Claim 6 (depends on 5)

The system of claim 5, wherein:
the preventing of WebRTC streams from being used more than once prevents WebRTC streams generated at the system and streams received by the system from being used more than once.

### Claim 7 (depends on 1)

The system of claim 1, wherein:
the execution of the first portion of the first code causes WebRTC connections to be allowed only between end-users with valid identity assertions.

### Claim 8 (depends on 1)

The system of claim 1, wherein:
the execution of the first portion of the first code causes attempts to create more than one stream for a device to fail.

### Claim 9 (depends on 1)

The system of claim 1, wherein:
the execution of the first portion of the first code causes attempts to create WebRTC connections to be authenticated by the first server.

### Claim 10

A method comprising:
accessing, by a client device, first code from a first server, for execution by a web browser run on one or more processors;
accessing second code, by the client device, for execution by the web browser in conjunction with the first code;
executing, by the one or more processors, a first portion of the first code by the web browser, the first portion of the first code causing a first function to become unmodifiable;
executing, by the one or more processors, the second code by the web browser after the execution of the first code, the second code attempting to modify the first function and failing due to the execution of the first portion of the first code; and
executing, by the one or more processors, a second portion of the first code by the web browser after the execution of the second code, the second portion of the first code using the first function to communicate via web real-time communication (WebRTC) over a network.

### Claim 11 (depends on 10)

The method of claim 10, wherein the second code is received from a second server distinct from the first server.

### Claim 12 (depends on 10)

The method of claim 10, wherein:
the one or more processors are in communication with a camera; and
the communicating via WebRTC comprises transmitting image data captured by the camera.

### Claim 13 (depends on 10)

The method of claim 10, wherein:
the one or more processors are in communication with a microphone; and
the communicating via WebRTC comprises transmitting audio data captured by the microphone.

### Claim 14 (depends on 10)

The method of claim 10, wherein:
the execution of the first portion of the first code further modifies a second function to prevent WebRTC streams from being used more than once; and
the execution of the second code comprises the second code attempting to use a WebRTC stream that is already in use and failing due to the execution of the first portion of the first code.

### Claim 15 (depends on 14)

The method of claim 14, wherein:
the preventing of WebRTC streams from being used more than once prevents WebRTC streams generated at the client device and streams received by the client device from being used more than once.

### Claim 16 (depends on 10)

The method of claim 10, wherein:
the execution of the first portion of the first code causes WebRTC connections to be allowed only between end-users with valid identity assertions.

### Claim 17 (depends on 10)

The method of claim 10, wherein:
the execution of the first portion of the first code causes attempts to create more than one stream for a device to fail.

### Claim 18 (depends on 10)

The method of claim 10, wherein:
the execution of the first portion of the first code causes attempts to create WebRTC connections to be authenticated by the first server.

### Claim 19

A non-transitory machine-readable storage medium comprising instructions that, when executed by one or more processors of a machine, cause the machine to perform operations comprising:
accessing first code from a first server for execution by a web browser;
accessing second code for execution by the web browser in conjunction with the first code;
executing a first portion of the first code by the web browser, the first portion of the first code causing a first function to become unmodifiable;
executing the second code by the web browser after the execution of the first code, the second code attempting to modify the first function and failing due to the execution of the first portion of the first code; and
executing a second portion of the first code by the web browser after the execution of the second code, the second portion of the first code using the first function to communicate via web real-time communication (WebRTC) over a network.

### Claim 20 (depends on 19)

The non-transitory machine-readable storage medium of claim 19, wherein the second code is received from a second server distinct from the first server.