Detecting code injections through cryptographic methods
AssigneeInfosys Limited
InventorsPrashant Venkatesh Kanakapura, Arjun Govindaraju, Abishek C
Life of this patent
Estimating the term…
Abstract
Code injection is detected based on code digests associated with hashes of selected portions of content supplied to clients by a server. A client receives the content and generates a corresponding code digest, and based upon a comparison with the code digest received from the server, determines if the received content has been corrupted. The code digest can be signed or supplied with a digital certification for verification that the code digest originated from the server providing the content.
Claims10
A method, comprising:
- receiving a code digest associated with content received from a content server, wherein the code digest corresponds to at least a portion of the content associated with provision of user input and the code digest provides enumeration of at least one user field associated with the user input;
- determining if the received content corresponds to the code digest by comparing a number of user fields within the received content with the enumeration provided by the code digest;
- and
- processing the received content based on the determination, wherein the received code digest is further associated with static content portions and the method further comprises:
- parsing the received content to identify static content portions;
- obtaining a static content digest associated with the identified static content portions;
- determining if the received content corresponds to the received code digest based on a comparison of the static content digest and the received content digest;
- and
- determining that the content digest is associated with the content provider based on a digital signature.
At least one non-transitory computer-readable storage medium containing computer-executable instructions for a method, the method comprising:
- transmitting a content request to a content provider via a wide area network;
- receiving content and a content identifier in response to the request, wherein the received content identifier corresponds to at least a portion of the content associated with provision of user input and the received content identifier provides enumeration of at least one user field associated with the user input;
- based on the received content, obtaining a local content identifier associated with a number of user fields within the received content;
- comparing the local content identifier to the received content identifier;
- and
- based on the comparison, processing the received content, wherein the received content identifier includes a hash of at least a portion of web page content to be provided and a digital signature associated with the content provider, and further comprising determining that the digital signature corresponds to the content provider, and wherein the received content identifier is a digitally signed hash of at least a portion of a web page to be provided.
Dependencies are inferred from the claim text.