Security content injection

A computing device may receive content from a content source. The content may include software code that is executable by a web browser, and may be directed to another computing device. The computing device may inject security content into the content. The security content may include software instructions to enable the web browser to detect malicious software content within the content. The computing device may communicate the content to the other computing device.

BACKGROUND

Malicious software is frequently delivered to computing devices via web browsers. For example, a computer virus can be embedded within web pages so that, when the web page accessed by a computer via a web browser, the computer virus becomes active within the computer. Unfortunately, currently available solutions for protecting computing devices against malicious software are inadequate. For example, some security solutions require computing devices to execute processor and memory intensive logic, in addition to requiring frequent updates in order to remain effective.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

The following detailed description refers to the accompanying drawings. The same labels and/or reference numbers in different drawings may identify the same or similar elements.

In one or more implementations, described herein, devices may be used to protect computing devices from malicious software content.

FIG. 1is a diagram of an example overview of an implementation described herein. As depicted inFIG. 1, a computing device may request content from a content source. The content source may respond to the content request by providing content to the computing device. The communications between the computing device and the content source may be relayed by the security injection system. As depicted inFIG. 1, the content requested by the computing device may include a web page, and the content source may include a web server. In addition, the web page may include malicious content, such as a software virus, spyware, or another type of malware.

As depicted inFIG. 1, the web page sent by the content source to the computing device may include malicious content, such as a virus, spyware, or another type of malware. The security injection system may receive the web page from the content source and inject security content into the web page. The security injection system may forward the web page to the computing device, and the computing device may proceed to view the web page in a web browser. The web browser may execute the injected security content in the web page, which may include a process capable of detecting the malicious content without exposing the computing device to the malicious content. Upon detecting the malicious content, the injected security content may, for example, notify the computing device of the malicious so that the malicious content may be removed, quarantined, or otherwise prevented from operating within the computing device. As such, one or more of the implementations described herein provide solutions for protecting computing devices against viruses, spyware, and other type of malicious content.

User device210may include any time or combination of computing and/or communication device. For example, user device210may include a laptop computer, a desktop computer, a tablet computer, a smart phone, a server, or another type of computing and/or communication device. As depicted, computing device210may be capable of communicating with network220.

Network220may include any type of network or combination of networks. For example, network220may include a local area network (LAN) (e.g., an Ethernet network), a wireless LAN (WLAN) (e.g., an IEEE 802.11x network), a wide area network (WAN) (e.g., the Internet), and/or a wireless WAN (WWAN) (e.g., a Long-Term Evolution (LTE) network, a High-Speed Packet Access (HSPA) network, an Evolved High Rate Packet Data (eHRPD) network, etc.). Network220may also, or alternatively, include an IMS network, a fiber optic (e.g., a fiber optic service (FiOS)) network, a voice over Internet Protocol (VoIP) network, a metropolitan area network (MAN), an ad hoc network, a virtual network (e.g., a virtual private network (VPN)), and/or a telephone network (e.g., a Public Switched Telephone Network (PSTN)).

Content source230may include any type or combination of computing and/or communication device. For example, content source may include a desktop computer, a server, a cluster of servers, or another type of computing or communication device. In addition, content source230may be capable of communicating with network220. For example, content source230may include a web server capable of providing web pages to computing device210via network220.

Similarly, security injection system240may include any type or combination of computing and/or communication device. For example, security injection system240may include a router, a gateway, a desktop computer, a server, a proxy server, a cluster of servers, or another type of computing or communication device. In some implementations, security injection system240may be part of a system or network that enables computing device210to communicate with network220and/or content source230. For example, security injection system240may be a gateway device within an access network, a particular server within service provider network, a proxy server corresponding to user device210, a router within a MAN, etc. As such, communications between computing device210and content source230may be routed through, or may otherwise involve, security injection system240.

WhileFIG. 2shows a particular number and arrangement of networks and devices, in alternative implementations, environment200may include additional networks or devices, fewer networks or devices, different networks or devices, or differently arranged networks or devices than those depicted inFIG. 2.

FIG. 3is a diagram of an example device ofFIG. 2according to one or more implementations described herein. For example, device300may correspond to computing device210, content source230, and/or security injection system240. Each of computing device210, content source230, and/or security injection system240may include one or more devices300and/or one or more of the components of device300.

As depicted, device300may include bus310, processor320, memory330, input device340, output device350, and communication interface360. However, the precise components of device300may vary between implementations. For example, depending on the implementation, device300may include fewer components, additional components, different components, or differently arranged components than those illustrated inFIG. 3.

Bus310may permit communication among the components of device300. For example, bus310may include an arrangement of wires, circuitry, and/or another type of hardware that functionally connect the components of device300. Processor320may include one or more processors, microprocessors, data processors, co-processors, network processors, application-specific integrated circuits (ASICs), controllers, programmable logic devices (PLDs), chipsets, field-programmable gate arrays (FPGAs), or other components that may interpret or execute instructions or data. Processor320may control the overall operation, or a portion thereof, of device300, based on, for example, an operating system (not illustrated) and/or various applications. Processor320may access instructions from memory330, from other components of device300, or from a source external to device300(e.g., a network or another device).

Memory330may include memory and/or secondary storage. For example, memory330may include random access memory (RAM), dynamic RAM (DRAM), read-only memory (ROM), programmable ROM (PROM), flash memory, or some other type of memory. Memory330may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optic disk, a solid state disk, etc.) or some other type of computer-readable medium, along with a corresponding drive. A computer-readable medium may be defined as a non-transitory memory device. A memory device may include space within a single physical memory device or spread across multiple physical memory devices.

Input device340may include one or more components that permit a user to input information into device300. For example, input device340may include a keypad, a button, a switch, a knob, fingerprint recognition logic, retinal scan logic, a web cam, voice recognition logic, a touchpad, an input port, a microphone, a display, or some other type of input component. Output device350may include one or more components that permit device300to output information to a user. For example, output device350may include a display, light-emitting diodes (LEDs), an output port, a speaker, or some other type of output component.

Communication interface360may include one or more components that permit device300to communicate with other devices or networks. For example, communication interface360may include some type of wireless or wired interface. Communication interface330may also include an antenna (or a set of antennas) that permit wireless communication, such as the transmission and reception of radio frequency (RF) signals.

As described herein, device300may perform certain operations in response to processor320executing software instructions contained in a computer-readable medium, such as memory330. The software instructions may be read into memory330from another computer-readable medium or from another device via communication interface360. The software instructions contained in memory330may cause processor320to perform one or more processes described herein. Alternatively, hardwired circuitry may be used in place of, or in combination with, software instructions to implement processes described herein. Thus, implementations described herein are not limited to any specific combination of hardware circuitry and software.

FIG. 4is a diagram of an example network device400ofFIG. 2according to one or more implementations described herein. For example, since security injection system240may include a network device, such as a router, a gateway, etc., network device400may correspond to security injection system240. In addition, security injection system240may include one or more network devices400and/or one or more of the components of network device400.

As depicted, network device400may include input components410-1, . . . ,410-Q (where P≧1) (collectively referred to as “input components410,” and individually as “input component410”), switching mechanism420, output components430-1, . . . ,430-R (where R≧1) (collectively referred to as “output components430,” and individually as “output component430”), and control unit440(which may include bus450, processor460, memory470, and communication interface480). However, the precise components of network device400may vary between implementations. For example, depending on the implementation, network device400may include fewer components, additional components, different components, or differently arranged components than those illustrated inFIG. 4.

Input components410may be points of attachment for physical links and may be the points of entry for incoming traffic. Input components410may perform datalink layer encapsulation and/or decapsulation. Input components410may look up a destination address of incoming traffic (e.g., any type or form of data, such as packet data or non-packet data) in a forwarding table (e.g., a media access control (MAC) table) to determine a destination component or a destination port of the data (e.g., a route lookup). In order to provide quality of service (QoS) guarantees, input ports410may classify traffic into predefined service classes. Input ports410may run datalink-level protocols and/or network-level protocols.

Switching mechanism420may include a switching fabric that provides links between input components410and output components430. For example, switching mechanism420may include a group of switching devices that route traffic from input components410to output components430.

Output components430may store traffic and may schedule traffic on one or more output physical links. Output components430may include scheduling algorithms that support priorities and guarantees. Output components430may support datalink layer encapsulation and decapsulation, and/or a variety of higher-level protocols.

Control unit440may interconnect with input components410, switching mechanism420, and output components430. Control unit440may perform control plane processing, including computing and updating forwarding tables, manipulating QoS tables, maintaining control protocols, etc. Control unit440may process any traffic whose destination address may not be found in the forwarding table.

In one embodiment, control unit440may include a bus450that may include one or more paths that permits communication among processor460, memory470, and communication interface480. Processor460may include a microprocessor or processing logic (e.g., an application specific integrated circuit (ASIC), field programmable gate array (FPGA), etc.) that may interpret and execute instructions, programs, or data structures. Processor460may control operation of network device120and/or one or more of the components of network device400.

Memory470may include a random access memory (RAM) or another type of dynamic storage device that may store information and/or instructions for execution by processor460, a read only memory (ROM) or another type of static storage device that may store static information and/or instructions for use by processor460, a flash memory (e.g., an electrically erasable programmable read only memory (EEPROM)) device for storing information and/or instructions, and/or some other type of magnetic or optical recording medium and its corresponding drive. Memory470may also store temporary variables or other intermediate information during execution of instructions by processor460.

Communication interface480may include any transceiver-like mechanism that enables control unit440to communicate with other devices and/or systems. For example, communication interface480may include a modem or an Ethernet interface to a LAN. Additionally or alternatively, communication interface480may include mechanisms for communicating via a wireless network (e.g., a WLAN and/or a WWAN). Communication interface480may also include a console port that may allow a user to interact with control unit440via, for example, a command line interface. A user may configure network device120via a console port (not shown inFIG. 4).

Network device400may perform certain operations, as described in detail herein. Network device400may perform these operations in response to, for example, processor460executing software instructions (e.g., computer program(s)) contained in a computer-readable medium, such as memory470, a secondary storage device (e.g., hard disk, CD-ROM, etc.), or other forms of RAM or ROM. A computer-readable medium may be defined as a non-transitory memory device. A memory device may include memory space within a single physical memory device or spread across multiple physical memory devices.

The software instructions may be read into memory470from another computer-readable medium, such as a data storage device, or from another device via communication interface480. The software instructions contained in memory470may cause processor460to perform processes that will be described later. Alternatively, hardwired circuitry may be used in place of, or in combination with, software instructions to implement processes described herein. Thus, implementations described herein are not limited to any specific combination of hardware circuitry and software.

FIG. 5is a diagram of example functional components of a security injection system240according to one or more implementations described herein. As depicted, security injection system240may include code analysis module510and content injection module520. Depending on the implementation, one or more of modules510-520may be implemented as a combination of hardware and software based on the components illustrated and described with respect toFIGS. 3and/or4. Alternatively, modules510-520may each be implemented as hardware based on the components illustrated and described with respect toFIGS. 3and/or4.

Code analysis module510may provide functionality regarding analyzing software code. For example, code analysis module510may enable security injection system240to analyze software code corresponding to a web page or another type of data structure being sent to computing device210. In one example, code analysis module510may enable security injection system to receive software code corresponding to a web page, analyze the software code to determine what type of security content would be appropriate for the web page, and/or determine a location for injecting the security content into the web page.

Content injection module520may provide functionality with respect to injecting security content. For example, content injection module520may enable security injection system240to inject security content into a web page or another type of data structure. In one example, content injection module520may cooperate with code analysis module510to determine a location within the web page for injecting the security content and injecting the security content into the web page. Injecting the proper security content at the proper location within the web page may help ensure that the security content is executed by the browser at an appropriate time (e.g., before any potentially malicious content is executed).

In addition to the functionality described above, the functional components of content injection module520may also, or alternatively, provide functionality as described elsewhere in this description. Further, whileFIG. 5shows a particular number and arrangement of modules, in alternative implementations, content injection module520may include additional modules, fewer modules, different modules, or differently arranged modules than those depicted.

FIG. 6is a diagram of an example process for injecting security content according to one or more implementations described herein. In one or more implementations, process600may be performed by one or more components of security injection system240. In other implementations, some or all of process600may be performed by one or more other components/devices, or a group of components/devices, including or excluding security injection system240.

As depicted inFIG. 6, process600may include receiving content (block610). For example, security injection system240may receive content. As mentioned above, the content may include a web page, and injection security system240may receive the web page from a web server. In one implementation security injection system240may receive a web page from a web server. However, the content may also, or alternatively, include any type of software code that may be executed within a web browser, and the content source may include any device or group of devices capable of providing the content to security injection system240and/or computing device210.

Process600may also include identifying appropriate security content based on the content (block620). For example, security injection system240may identify appropriate security content based on the content. In one example, the security injection system240may identify the appropriate security by matching a type of software code corresponding to the content with a type of software code corresponding to the security content. For instance, security injection system240may analyze the web page and determine that the web page includes software code corresponding to Hypertext Markup Language (HTML) and/or JavaScript. In such a scenario, security injection system240may, therefore, identify security content written in JavaScript for injecting security content into the web page.

As depicted inFIG. 6, process600may also include identifying a location within the content for injecting the security content. For example, security injection system240may identify a location within the content for injecting the security content. In one example, security injection system240may identify the location within the content that will be executed by the browser first (e.g., at or near the top of the web page). In one example, the security injection system240may determine an execution chronology corresponding to the content (e.g., which portion of the content will be executed by the web browser first, which portion of the content will be executed by the web browser second, etc.), identify portions of the content that may be more likely to include malicious content, and identify the location for injecting the content based on the execution chronology and/or the likelihood of malicious content corresponding to each portion of the content.

Process600may also, or alternatively, include injecting the security content into the content (block640). For example, security injection system240may inject the security content into the content. In one example, the security injection system240may inject the security content into the content by modifying the content with the security content. In one implementations, security content may be written in a software language that is the same as, or is functionally complementary to, the software language used to write the content. Injecting the security content in a manner that is complementary to the existing content may help ensure that the web browser is capable of seamlessly executing the web page (e.g., the security content and the content).

As depicted inFIG. 6, process600may include providing the modified web page (block650). For example, security injection system240may provide the modified web to computing device210via network220. As such, process600provides a solution to protecting a computing device from malicious content by injecting, inserting, or otherwise modifying the content to include security content capable of being executed by a web browser to detect and prevent the malicious content from attacking or infecting the computing device.

WhileFIG. 6shows a flowchart diagram of an example process600for injecting security content, in other implementations, a process for injecting security content may include fewer operations, different operations, differently arranged operations, or additional operations than depicted inFIG. 6.

FIG. 7is a diagram of an example security content injection operation700according to one or more implementations described herein. In one or more implementations, operation700may be performed by one or more components of security injection system240. In other implementations, some or all of operation700may be performed by one or more other components/devices, or a group of components/devices, including or excluding security injection system240.

Web page710A may represent a web page as received by security injection system240from content source230, and web page7108may represent the web page as sent from security injection system240to computing device210. As depicted inFIG. 7, security content injection operation700may include injecting or inserting security content into the software code of the web page.

As mentioned above, the security content may be capable of detecting the malicious content in the web page, notifying computing device210of the malicious content, and/or protecting computing device210form the malicious content. As depicted inFIG. 7, the security content may be inserted at or near the top of web page7108. In some implementations, inserting the security content at or near the top of web page7108may ensure that the security content is executed prior to the malicious content, thereby providing the security content to establish a safe execution environment for detecting the malicious code without permitting the malicious content to harm computing device210.

FIG. 8is a diagram of example security content800according to one or more implementations described herein. As depicted, security content800may include malicious software identifiers810, a scan function820, an alert function830, and test functions840-1,840-2, . . .840-Q (where Q>1) (hereinafter referred to collectively as “standard functions840,” and individually as “standard function”). The features of security content800are provided for exemplary purposes only. In practice security content may include additional features, alternative features, or a different arrangement of features then depicted inFIG. 8.

Malicious software identifiers810may include one or more signatures, segments of software code, or other data structures for identifying malicious content. Scan function820may include one or more instructions for scanning a portion of software code and/or an output of test function840, for malicious software (e.g., malicious software identifies by malicious software identifiers810). Alert function may include software instructions and/or another type of logical instructions for notifying computing device210, or a user of computing device210, regarding the detection of malicious software.

Test function840may include one or more functions that are known, currently exist, or are otherwise compatible with a particular type of software code or software language (e.g., HTML, JavaScript, etc.). For instance, examples of test function840may include JavaScript functions, such as an UNESCAPE function, an EVAL function, or a WRITE function. In one example, the foregoing functions, or other types of functions, may be capable of executing, processing, or otherwise interacting with one or more portions of software code (e.g., malicious software code) and, in cooperation with scan function820, detect the presence of malicious content that may be embedded within web page710.

Accordingly, system and/or devices, described herein, may be used to protect computing devices from malicious software content. A network device, such as security injection system240, may receive a web page, or another type of content, from a web server or another type of content source230. The network device may inject security content into the content receive from content source230, and the security content may be executed by a browser of the device requesting the content (e.g., computing device210). The security content may include malicious software identifiers, scanning functions, and/or alert functions for identifying malicious software that may be embedded in the content. Additionally, or alternatively, the security content may include standard function that are rewritten and/or augmented versions of software code that is compatible with the content. Such functions may be capable of executing software code and/or scanning the results of executed software code in order to identify malicious content that may be hidden within the content requested by computing device210.

Further, certain implementations may involve a component that performs one or more functions. These components may include hardware, such as an ASIC or a FPGA, or a combination of hardware and software.