# US 2019/0245833 A1 · Intercepting and injecting calls into operations and objects > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0245833 A1 - Document ID: US20190245833A1 - Status: Published application - Kind: A1 - Application number: 16/236,522 - Filed: 2018-12-30 - Published: 2019-08-08 - Earliest claimed: 2016-03-14 - Assignees: Shape Security, Inc. - Applicants: Shape Security, Inc. - Inventors: JARROD OVERSON; SIYING YANG - Web page: https://patentgrep.com/patent/US20190245833A1 ## CPC - H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding} - G06F 8/51: Source to source - G06F 9/45516: {Runtime code conversion or optimisation} - G06F 9/45529: {Embedded in an application, e.g. JavaScript in a Web browser} - G06F 21/14: against software analysis or reverse engineering, e.g. by obfuscation - H04L 63/0281: {Proxies} - H04L 63/0407: {wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00)} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/1066: {Hiding content} - H04L 63/168: {above the transport layer} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer implemented method for improving security of a server computer that is configured to deliver computer program instructions to a remote client computer, and comprising, using an intermediary computer that is topologically interposed between the server computer and the remote client computer is provided. The intermediary computer is configured to intercept a first set of source code instructions from the server computer. The intermediary computer identifies first party operations that include operations on objects and the objects themselves. The intermediary computer identifies a first set of operations within the first party operations that are configured to define values for one or more objects based on one or more constants. The intermediary computer then generates a second set of operations, where the second set of operations are configured to define same values for the one or more objects, when executed by a web browser on the client computer. The intermediary computer transforms the first party operations into transformed first party operations by substituting the first set of operations with the second set of operations. The intermediary computer generates a second set of source code instructions that are based on the first set of source code instructions and the transformed first party operations. The intermediary computer then sends the second set of source code instructions to the client computer. ## Claims ### Claim 1 A computer implemented method for improving security of a server computer that is configured to deliver computer program instructions to a client computer, and comprising: using an intermediary computer that is topologically interposed between the server computer and the client computer: intercepting a first set of source code instructions from the server computer that are configured to achieve an expected result when executed by a web browser on a client computer; within the first set of source code instructions, identifying first party operations that include at least operations on objects and the objects referenced by the first set of source code instructions; identifying a first set of operations within the first party operations, that are configured to define values for one or more objects based on one or more constants; generating a second set of operations, where the second set of operations are configured to define same values for the one or more objects, when executed by a web browser on the client computer; transforming the first party operations into transformed first party operations by substituting the first set of operations with the second set of operations; generating a second set of source code instructions that are based on the first set of source code instructions and the transformed first party operations; sending the second set of source code instructions to the client computer. ### Claim 2 (depends on 1) The computer implemented method of claim 1, wherein generating a second set of operations comprises implementing one or more obfuscation transformations to the first set of operations to generate the second set of operations. ### Claim 3 (depends on 2) The computer implemented method of claim 2, wherein generating a second set of operations further comprises inserting additional functions that are executed as an IIFE. ### Claim 4 A computer implemented method for improving security of a server computer that is configured to deliver computer program instructions to a client computer, and comprising: using an intermediary computer that is topologically interposed between the server computer and the client computer: intercepting a first set of instructions from the server computer that define one or more objects and a set of original operations that operate on the one or more objects; identifying a subset of original operations from the set of original operations within the first set of instructions to be extracted from the set of original operations; generating a set of additional operations, where the set of additional operations is based at least in part on the subset of original operations and the one or more objects; transforming the set of original operations to produce a set of transformed operations that are based at least in part on the set of additional operations; generating a second set of instructions that define the set of additional operations and the set of transformed operations; sending the second set of instructions to the client computer. ### Claim 5 (depends on 4) The method of claim 4, further comprising generating the second set of instructions which define the set of original operations. ### Claim 6 (depends on 4) The method of claim 4, wherein the set of additional operations includes one or more supervisor operations, which when executed, cause interception of a call to an operation on the client computer. ### Claim 7 (depends on 6) The method of claim 6, wherein the call to the operation is a base operation that is defined by a runtime environment, and wherein the one or more supervisor operations, which when executed in the runtime environment on the client computer, cause: sending, to the intermediary computer, a set of telemetry data indicating that the call to the base operation was made; performing the base operation; receiving, from the client computer, the set of telemetry data; storing, in a database, the set of telemetry data which indicates that the call to the base operation was made. ### Claim 8 (depends on 7) The method of claim 7, wherein generating the set of additional operations further comprises: applying one or more obfuscation transformations to the subset of original operations, to produce a set of obfuscated transformed operations; wherein the subset of original operations is configured to achieve an expected result when executed by the client computer; wherein the set of obfuscated transformed operations is configured to achieve the expected result as the subset of original operations when executed by the client computer; wherein generating the set of additional operations includes the set of obfuscated transformed operations. ### Claim 9 (depends on 8) The method of claim 8, wherein the subset of original operations comprise a literal text string; wherein the set of obfuscated transformed operations comprise a statement defining a closure having a body that is configured to return the literal text string when executed by the client computer and invocation of the closure, and which is configured to achieve the expected result when executed by the client computer. ### Claim 10 (depends on 9) The method of claim 9, wherein the statement comprises a JavaScript immediately-invoked function expression. ### Claim 11 (depends on 7) The method of claim 7, wherein the set of original operations comprise a first assignment expression that is configured to assign a first value to a variable; wherein the set of transformed operations include the first assignment expression that is configured to assign the first value to the variable and a first modification expression configured to modify the first value of the variable to a second value; wherein the set of additional operations include a second modification expression configured to modify the second value of the variable to the first value. ### Claim 12 (depends on 11) The method of claim 11, wherein the a first modification expression is configured to apply encryption to the first value of the variable; and wherein the a second modification expression is configured to apply decryption to the second value of the variable. ### Claim 13 (depends on 7) The method of claim 7, wherein the set of original operations comprise a first assignment expression configured to assign a first value to a first variable; wherein the first value is a combined value of a second value from a second variable and a third value from a third variable, where the second variable and third variable are defined in the set of original operations; wherein the set of transformed operations comprise the first assignment expression configured to assign the first value to the first variable; wherein the first value is the combined value of the second value from the second variable and the third value from the third variable; wherein the set of additional operations comprise defining the second variable and third variable. ### Claim 14 (depends on 7) The method of claim 7, wherein the set of original operations comprise a first assignment expression configured to assign a first value to a first variable; wherein the set of additional operations comprise the first assignment expression configured to assign a first function to the first variable; wherein the first function is a specific library function, where the specific library function is part of a library that is supported by the set of original operations. ### Claim 15 (depends on 7) The method of claim 7 further comprising: intercepting from the client computer, a request that includes one or more modified object identifiers; transforming the request, based on the one or more modified object identifiers to produce a modified request, wherein the modified request is the request that would have been received by the client computer had the client computer received the first set of instructions; sending the modified request to the server computer.