Source: https://patents.google.com/patent/US8904474B2/en
Timestamp: 2018-12-10 15:42:16
Document Index: 295948733

Matched Legal Cases: ['§120', 'Application No. 08848369', 'Application No. 200880115316', 'Application No. 200880115316', 'Application No. 200880115316', 'Application No. 200880115316', 'Application No. 200880115316', 'Application No. 2010', 'Application No. 2010', 'Application No. 200880115316', 'art-2']

US8904474B2 - Security model for a layout engine and scripting engine - Google Patents
Security model for a layout engine and scripting engine Download PDF
US8904474B2
US8904474B2 US13656156 US201213656156A US8904474B2 US 8904474 B2 US8904474 B2 US 8904474B2 US 13656156 US13656156 US 13656156 US 201213656156 A US201213656156 A US 201213656156A US 8904474 B2 US8904474 B2 US 8904474B2
US13656156
US20130047258A1 (en )
Nathan J. E. Furtwangler
This application is a continuation of and claims priority under 35 U.S.C. §120 to U.S. patent application Ser. No. 13/149,582, filed on May 31, 2011, which is a continuation of U.S. patent application Ser. No. 13/114,924 filed on May 24, 2011, the disclosure of which is incorporated by reference herein in its entirety.
Various embodiments enable a read-only property to be replaceable. Replace-ability pertains to a situation in which a read-only property is changed. Specifically, when a read-only property is assigned a value, the original read-only property is removed and the newly assigned property takes its place. In one or more embodiments, this semantic is supported by assigning a put_accessor value to the read only property. When it is then invoked, an associated interface is used to create a new property on the calling instance object that then “shadows” the read-only API. Using this technique, future requests for the read-only properly will correctly obtain the shadowed property instead. Furthermore, if the shadowed property is ever deleted, the original replaceable read-only is once again accessible.
In one or more embodiments, access to library functions of a scripting language can be altered or restricted to adhere to security policies. For example, access to an API of the scripting language can be conditionally blocked and/or restricted to prevent the API from working in cross-domain conditions. The API can be any form of library function such as, by way of example and not limitation, defineProperty( ) getOwnPropertyDescriptor( ) HasAccessor( ), getPrototypeOf( ) and the like. A type operation of the API can be modified and/or replaced to enforce security policies. For example, when the API is called, the modified type operation can determine whether access is to be granted or not based upon the security policies. In some embodiments, when it is determined to not grant access, access can be disabled and/or an exception can be thrown.
one or more computer-readable hardware storage memories comprising computer readable instructions which, when executed by the one or more processors, implement:
a security module configured to enable secure information transfer between a web content scripting engine and layout engine, the security module comprising:
a module configured to enable restricted access to at least one Application Programming Interface (API) associated with a scripting language of the scripting engine;
a module configured to enable at least one object to be returned cross-domain to a calling system, via the scripting engine and the layout engine, without divulging type system information associated with the at least one object; and
a module configured to enable at least one sub-window proxy object to assert security policies associated with a primary window object associated with the layout engine.
2. The system of claim 1, the security module further comprising:
a module configured to enable the scripting engine configurable access to at least one property descriptor.
3. The system of claim 1, the security module further comprising:
a module configured to enable marking at least one function as safe for access.
4. The system of claim 3, wherein access to the at least one function comprises cross-domain access.
5. The system of claim 1, the security module further comprising:
a module configured to enable bypassing security checks based, at least in part, on a determination of the information transfer occurring in a same domain.
6. The system of claim 1, wherein the module configured to enable restricted access to the at least one API is further configured to conditionally restrict access in cross-domain conditions.
7. The system of claim 1, wherein the module configured to enable the at least one object to be returned across the one or more domains is configured to return a proxy object associated with the at least one object, the proxy object created in a type system associated with the calling system.
8. The system of claim 7, the at least one object associated with the proxy object comprising a function.
9. The system of claim 7, the type system associated with the calling system being a different type system than a type system of the at least one object's origin.
10. The system of claim 1, wherein the at least one sub-window proxy object is configured to defer security requests to the primary window object.
11. The system of claim 1, wherein the scripting engine comprises a JavaScript engine.
12. The system of claim 1, the computer readable instructions further configured to implement:
a binding module configured to enable unified programming access between the web browser's scripting engine and layout engine, the binding module comprising a module configured to enable one or more properties associated with the layout engine to be virtually replaced by the scripting engine.
13. The system of claim 12, at least one property of the one or more properties associated with the layout engine comprising a read-only value.
14. The system of claim 12, at least one property of the one or more properties associated with the layout engine comprising a method.
15. The computing device of claim 1, wherein the web content scripting engine comprises a web browser scripting engine.
enabling, via a security module, secure information transfer between a web content scripting engine and layout engine, said enabling comprising:
enabling restricted access to at least one Application Programming Interface (API) associated with a scripting language of the scripting engine;
enabling at least one object to be returned cross-domain to a calling system, via the scripting engine and the layout engine, without divulging type system information associated with the at least one object; and
enabling at least one sub-window proxy object to assert security policies associated with a primary window object associated with the layout engine.
17. The method of claim 16, further comprising enabling, via the security module, the scripting engine to have configurable access to at least one property descriptor.
18. The method of claim 16, further comprising enabling marking at least one function as safe for access.
19. The method of claim 18, wherein access to the at least one function comprises cross-domain access.
20. The method of claim 16, further comprising enabling bypassing security checks based, at least in part, on a determination of the information transfer occurring in a same domain.
21. The method of claim 16, wherein enabling restricted access to the at least one API is performed by conditionally restricting access in cross-domain conditions.
22. The method of claim 16, wherein enabling the at least one object to be returned across the one or more domains is performed by returning a proxy object associated with the at least one object, the proxy object created in a type system associated with the calling system.
23. The method of claim 22, the at least one object associated with the proxy object comprising a function.
24. The method of claim 22, the type system associated with the calling system being a different type system than a type system of the at least one object's origin.
25. The method of claim 16, wherein the at least one sub-window proxy object is configured to defer security requests to the primary window object.
26. The method of claim 16, wherein the scripting engine comprises a JavaScript engine.
enabling unified programming access between the web content scripting engine and layout engine and enabling one or more properties associated with the layout engine to be virtually replaced by the scripting engine.
28. The method of claim 27, at least one property of the one or more properties associated with the layout engine comprising a read-only value.
29. The method of claim 27, at least one property of the one or more properties associated with the layout engine comprising a method.
30. The method of claim 16, wherein the web content scripting engine comprises a web browser scripting engine.
US13656156 2011-05-24 2012-10-19 Security model for a layout engine and scripting engine Active US8904474B2 (en)
US13114924 US8881101B2 (en) 2011-05-24 2011-05-24 Binding between a layout engine and a scripting engine
US13149582 US8646029B2 (en) 2011-05-24 2011-05-31 Security model for a layout engine and scripting engine
US13656156 US8904474B2 (en) 2011-05-24 2012-10-19 Security model for a layout engine and scripting engine
US14531974 US9582479B2 (en) 2011-05-24 2014-11-03 Security model for a layout engine and scripting engine
US13149582 Continuation US8646029B2 (en) 2011-05-24 2011-05-31 Security model for a layout engine and scripting engine
US14531974 Continuation US9582479B2 (en) 2011-05-24 2014-11-03 Security model for a layout engine and scripting engine
US20130047258A1 true US20130047258A1 (en) 2013-02-21
US8904474B2 true US8904474B2 (en) 2014-12-02
US13114924 Active 2032-04-11 US8881101B2 (en) 2011-05-24 2011-05-24 Binding between a layout engine and a scripting engine
US13149645 Active 2033-02-24 US9830305B2 (en) 2011-05-24 2011-05-31 Interface definition language extensions
US13149582 Active US8646029B2 (en) 2011-05-24 2011-05-31 Security model for a layout engine and scripting engine
US13150877 Active 2031-10-22 US8918759B2 (en) 2011-05-24 2011-06-01 Memory model for a layout engine and scripting engine
US13656245 Active US8689182B2 (en) 2011-05-24 2012-10-19 Memory model for a layout engine and scripting engine
US13656156 Active US8904474B2 (en) 2011-05-24 2012-10-19 Security model for a layout engine and scripting engine
US13658668 Active US9830306B2 (en) 2011-05-24 2012-10-23 Interface definition language extensions
US14507568 Active US9244896B2 (en) 2011-05-24 2014-10-06 Binding between a layout engine and a scripting engine
US14531974 Active US9582479B2 (en) 2011-05-24 2014-11-03 Security model for a layout engine and scripting engine
US14532826 Active US9116867B2 (en) 2011-05-24 2014-11-04 Memory model for a layout engine and scripting engine
JPH11316677A (en) 1998-01-29 1999-11-16 Lucent Technol Inc Method for securing computer network
US20020007317A1 (en) 1998-03-30 2002-01-17 Patrick Joseph Callaghan Method, system and program products for sharing state information across domains
US20030177285A1 (en) 1999-06-16 2003-09-18 Hunt Galen C. Operating system application programming interfaces and methods of using operating systems
JP2004054330A (en) 2002-07-16 2004-02-19 Nec Nexsolutions Ltd Illicit command/data detecting system, illicit command/data detecting method and illicit command/data detecting program
JP2004164617A (en) 2002-11-12 2004-06-10 Microsoft Corp Automated detection of cross site scripting vulnerability
US20040139314A1 (en) 2000-06-15 2004-07-15 Cook David P. Automatic delivery selection for electronic content
US20050028140A1 (en) 2003-07-28 2005-02-03 International Business Machines Corporation Method and system for resolving memory leaks and releasing obsolete resources from user session data
US6904453B2 (en) 1998-10-30 2005-06-07 Ideaflood, Inc. Method, apparatus and system for directing access to content on a computer network
WO2005062707A3 (en) 2003-12-30 2005-08-11 Leeor Aharon Universal worm catcher
JP2006099460A (en) 2004-09-29 2006-04-13 Toshiba Corp Unauthorized access detection device, method, and program
US20060087983A1 (en) 2004-10-22 2006-04-27 Alcatel Device for locally controlling one or more parameters of a connection to be set up, for an element of an ethernet communications network with a GMPLS control plan
US20070006148A1 (en) 2005-06-10 2007-01-04 Microsoft Corporation Ascertaining domain contexts
JP2007159013A (en) 2005-12-08 2007-06-21 Fujitsu Ltd Firewall device
US20070192494A1 (en) 2004-03-19 2007-08-16 Satoshi Yamakawa Intermediate device which can be introduced and removed in seamless way
JP2007241809A (en) 2006-03-10 2007-09-20 Ntt Comware Corp Personal information protection program and terminal
US20070234060A1 (en) 2006-04-03 2007-10-04 Seiko Epson Corporation Data processing device
US20080059634A1 (en) 2006-08-31 2008-03-06 Richard Commons System and method for restricting internet access of a computer
US20080298342A1 (en) 2007-05-28 2008-12-04 Benjamin Charles Appleton Inter-Domain Communication
US20090048915A1 (en) 2007-08-13 2009-02-19 Yahoo! Inc. Method and system for wirelessly accessing a network
US20090161132A1 (en) 2007-12-20 2009-06-25 Canon Kabushiki Kaisha Image processing apparatus, and control method, and computer-readable storage medium thereof
US20090217311A1 (en) 2008-02-13 2009-08-27 Robert Kocyan Apparatus, system, and method for facilitating data flow between a first application programming interface and a second application programming
US20100017461A1 (en) 2008-07-16 2010-01-21 Google Inc. Method and system for executing applications using native code modules
US20100023884A1 (en) 2006-10-23 2010-01-28 Adobe Systems Incorporated Rendering hypertext markup language content
US20100100823A1 (en) 2008-10-21 2010-04-22 Synactive, Inc. Method and apparatus for generating a web-based user interface
US20100125895A1 (en) 2008-11-20 2010-05-20 Mark Kevin Shull Domain based authentication scheme
US20100281537A1 (en) 2009-04-30 2010-11-04 Microsoft Corporation Secure multi-principal web browser
US20120304203A1 (en) 2011-05-24 2012-11-29 Microsoft Corporation Memory model for a layout engine and scripting engine
US7340604B2 (en) 2000-09-30 2008-03-04 Microsoft Corporation Using dynamic web components to remotely control the security state of web pages
US20120304316A1 (en) 2004-06-14 2012-11-29 Microsoft Corporation Validating Access to a Group of Related Elements
US20120304303A1 (en) 2011-05-24 2012-11-29 Microsoft Corporation Security model for a layout engine and scripting engine
US20130042255A1 (en) 2011-05-24 2013-02-14 Microsoft Corporation Memory Model for a Layout Engine and Scripting Engine
US20130047064A1 (en) 2011-05-24 2013-02-21 Microsoft Corporation Interface Definition Language Extensions
"Advanced Server-Side Authentication for Data Connections in InfoPath 2007 Web Based Forms", http://msdn2.microsoft.com/en-us/library/bb787184.aspx#ip2007AdvancedServerSideAuthentication-OverviewofServerSideAuthenticationScenarios, (Sep. 2007), 10 pages.
"Advanced Server-Side Authentication for Data Connections in InfoPath 2007 Web Based Forms", http://msdn2.microsoft.com/en-us/library/bb787184.aspx#ip2007AdvancedServerSideAuthentication—OverviewofServerSideAuthenticationScenarios, (Sep. 2007), 10 pages.
"Coding Basics-JavaScript Native Interface (JSNI)", Retrieved from: <http://code.google.com/webtoolkit/doc/1.6/DevGuideCodingBasics.html#DevGuideJavaScriptNativelnterface> on Jan. 28, 2011, 26 pages.
"Coding Basics—JavaScript Native Interface (JSNI)", Retrieved from: <http://code.google.com/webtoolkit/doc/1.6/DevGuideCodingBasics.html#DevGuideJavaScriptNativelnterface> on Jan. 28, 2011, 26 pages.
"Examiner's Answer to Appeal Brief", U.S. Appl. No. 13/149,645, Jul. 28, 2014, 48 pages.
"Examiner's Answer to Appeal Brief", U.S. Appl. No. 13/658,668, Aug. 1, 2014, 49 pages.
"Extended European Search Report", EP Application No. 08848369.8, (Oct. 14, 2013), 6 pages.
"Final Office Action", U.S. Appl. No. 10/867,338, (May 13, 2008), 6 pages.
"Final Office Action", U.S. Appl. No. 11/935,323, (Jul. 18, 2011), 15 pages.
"Final Office Action", U.S. Appl. No. 11/942,734, (Apr. 5, 2011), 45 pages.
"Final Office Action", U.S. Appl. No. 11/942,734, (Jan. 21, 2010), 36 pages.
"Final Office Action", U.S. Appl. No. 11/942,734, (Sep. 13, 2010), 38 pages.
"Final Office Action", U.S. Appl. No. 13/149,645, (Jun. 20, 2013), 25 pages.
"Final Office Action", U.S. Appl. No. 13/658,668, (Jun. 18, 2013), 26 pages.
"Flash Cross Domain XML", http://www.w3.org/TR/2007/WD-access-control-20071001, (Nov. 3, 2007), 1-1.
"Foreign Office Action", CN Application No. 200880115316.8, (Jun. 27, 2012), 12 pages.
"Foreign Office Action", CN Application No. 200880115316.8, (Jun. 8, 2013), 12 pages.
"Foreign Office Action", CN Application No. 200880115316.8, (Mar. 20, 2012), 13 pages.
"Foreign Office Action", CN Application No. 200880115316.8, (Oct. 25, 2011), 11 pages.
"Foreign Office Action", CN Application No. 200880115316.8, (Sep. 27, 2012), 6 pages.
"Foreign Office Action", JP Application No. 2010-533140, (Apr. 26, 2013), 11 pages.
"Foreign Office Action", JP Application No. 2010-533140, (Sep. 24, 2013), 4 pages.
"International Search Report and Written Opinion", Application No. PCT/US2008/079989, (Apr. 15, 2009), 10 pages.
"Microsoft Security Program: Microsoft Security Bulletin—MS98-020—Patch Available for Frame Spoof Vulnerability", Retrieved from: <http://www.microsoft.com/technet/security/bulletin/ms98-020.mspx> on Jul. 10, 2010, (Dec. 23, 1998), 2 pages.
"Microsoft Security Program: Microsoft Security Bulletin-MS98-020-Patch Available for Frame Spoof Vulnerability", Retrieved from: on Jul. 10, 2010, (Dec. 23, 1998), 2 pages.
"Microsoft Windows Internet Explorer and Other Trident Based Browsers", Retrieved from: <http://www.legendscrolls.co.uk/webstandards.ie> on May 25, 2011, (May 20, 2011), 8 pages.
"Microsoft Windows Internet Explorer and Other Trident Based Browsers", Retrieved from: on May 25, 2011, (May 20, 2011), 8 pages.
"Microsoft Windows Script Interfaces", Retrieved from: <http://msdn.microsoft.com/en-us/library/t9d4xf28(v=vs.85).aspx> on Jan. 28, 2011, (Aug. 2009), 3 pages.
"Microsoft Windows Script Interfaces", Retrieved from: on Jan. 28, 2011, (Aug. 2009), 3 pages.
"Netscape Security News Archive", Available at ,(1997), 14 pages.
"Netscape Security News Archive", Available at <http://netscape.1command.com/relnotes/>,(1997), 14 pages.
"Non Final Office Action", U.S. Appl. No. 11/935,323, (Nov. 5, 2010), 11 pages.
"Non-Final Office Action", U.S. Appl. No. 10/867,338, (Apr. 21, 2010), 15 pages.
"Non-Final Office Action", U.S. Appl. No. 10/867,338, (Jul. 14, 2010), 15 pages.
"Non-Final Office Action", U.S. Appl. No. 10/867,338, (Nov. 15, 2007), 5 pages.
"Non-Final Office Action", U.S. Appl. No. 11/150,869, (Sep. 3, 2009), 9 pages.
"Non-Final Office Action", U.S. Appl. No. 11/942,734, (Aug. 7, 2009), 31 pages.
"Non-Final Office Action", U.S. Appl. No. 11/942,734, (May 3, 2010), 32 pages.
"Non-Final Office Action", U.S. Appl. No. 11/942,734, (Nov. 18, 2010), 43 pages.
"Non-Final Office Action", U.S. Appl. No. 13/114,924, (Aug. 16, 2013),19 pages.
"Non-Final Office Action", U.S. Appl. No. 13/149,582, (Jan. 7, 2013), 12 pages.
"Non-Final Office Action", U.S. Appl. No. 13/149,645, (Nov. 23, 2012), 19 pages.
"Non-Final Office Action", U.S. Appl. No. 13/150,877, (Apr. 30, 2013), 29 pages.
"Non-Final Office Action", U.S. Appl. No. 13/570,044, (Apr. 19, 2013), 5 pages.
"Non-Final Office Action", U.S. Appl. No. 13/656,245, (Aug. 2, 2013),16 pages.
"Non-Final Office Action", U.S. Appl. No. 13/656,245, (Feb. 1, 2013), 26 pages.
"Non-Final Office Action", U.S. Appl. No. 13/658,668, (Jan. 3, 2013),18 pages.
"NoScript", 2004-2007, Inform Action, retrieved from <http://noscript.net/features> on Aug. 23, 2007, 5 pages.
"NoScript", 2004-2007, Inform Action, retrieved from on Aug. 23, 2007, 5 pages.
"Notice of Allowance", U.S. Appl. No. 10/303,113, (Dec. 10, 2007), 11 pages.
"Notice of Allowance", U.S. Appl. No. 10/867,338, (Apr. 12, 2012), 8 pages.
"Notice of Allowance", U.S. Appl. No. 11/150,869, (Feb. 9, 2010), 8 pages.
"Notice of Allowance", U.S. Appl. No. 13/114,924, Jun. 25, 2014, 12 pages.
"Notice of Allowance", U.S. Appl. No. 13/149,582, (Sep. 18, 2013), 15 pages.
"Notice of Allowance", U.S. Appl. No. 13/150,877, Jul. 22, 2014, 12 pages.
"Notice of Allowance", U.S. Appl. No. 13/570,044, (Jul. 22, 2013), 5 pages.
"Notice of Allowance", U.S. Appl. No. 13/656,245, (Oct. 28, 2013), 14 pages.
"Notice of Preliminary Examination", CN Application No. 200880115316.8, (Oct. 12, 2010), 2 pages.
"Protecting Commercial Secure Web Servers from Key-Finding Threats", nCipher, Inc., Available at ,(1999), 12 pages.
"Protecting Commercial Secure Web Servers from Key-Finding Threats", nCipher, Inc., Available at <www.ncipher.com/uploads/resources/pcws.pdf>,(1999), 12 pages.
"Randomization of HTML Tags and Embedded Scripts in Web Pages", Microsoft Research, 2139156v2, retrieved on Nov. 5, 2007, 14 pages.
"Requirement for Information", U.S. Appl. No. 10/867,338, (Oct. 26, 2010), 7 pages.
"Restriction Requirement", U.S. Appl. No. 11/150,869, (May 20, 2009), 6 pages.
"Restriction Requirement", U.S. Appl. No. 13/114,924, (May 7, 2013), 6 pages.
"Restriction Requirement", U.S. Appl. No. 13/149,582, (Aug. 6, 2012), 5 pages.
"Restriction Requirement", U.S. Appl. No. 13/150,877, (Feb. 25, 2013), 6 pages.
"Supplemental Notice of Allowance", U.S. Appl. No. 13/114,924, Oct. 2, 2014, 5 pages.
"Tagneto", http://tagneto.blogspot.com/2006/10/ie-7-and-iframe-apis-part-2.html, (Nov. 3, 2007), 1-5.
"Update Available for "Frame Spoof" Security Issue", Retrieved from: <http://support.microsoft.com/default.aspx?scid=kd;en-us;167614&sd=tech> on Apr. 21, 2011,(Aug. 23, 2007), 3 pages.
"Update Available for "Frame Spoof" Security Issue", Retrieved from: on Apr. 21, 2011,(Aug. 23, 2007), 3 pages.
"What's New in Internet Explorer 8", Retrieved from: <http://msdn.microsoft.com/en-us/library/cc288472(v=vs.85).aspx> on Jan. 28, 2011, (2009), 15 pages.
"What's New in Internet Explorer 8", Retrieved from: on Jan. 28, 2011, (2009), 15 pages.
"Why XHR Should Become Opt-In Cross-Domain", http://www.webkitchen.co.uk/2006/07/why-xhr-should-become-opt-in-cross.html.
Amato, Gianni "Protect Your Browser Mozilla Firefox from XSS Attacks", XSS Warning: Security extension for Mozilla Firefox, retrieved from <http://www.gianniamato.it/project/extension/xsswarning/> on Nov. 5, 2007, (2007), 1 page.
Amato, Gianni "Protect Your Browser Mozilla Firefox from XSS Attacks", XSS Warning: Security extension for Mozilla Firefox, retrieved from on Nov. 5, 2007, (2007), 1 page.
Anupam, et al., "Secure Web Scripting", 1998 IEEE, (1998), pp. 46-55.
Barth, Adam "Securing Frame Communication in Browsers", Communications of the ACM, vol. 52, No. 6, (Jun. 2009), pp. 83-91.
Chang, Bernice et al., "A Client-Side Browser-Integrated Solution for Detecting and Preventing Cross Site Scripting (XSS) Attacks", available at ,(Sep. 25, 2006), 3 pages.
Chang, Bernice et al., "A Client-Side Browser-Integrated Solution for Detecting and Preventing Cross Site Scripting (XSS) Attacks", available at <http://www.eecg.toronto.edu/˜lie/Courses/ECE1776-2006/Updates/XSS—update.pdf>,(Sep. 25, 2006), 3 pages.
Couvreur, Juien "Curiosity is Bliss: Web API Authentication for Mashups", Available at http://blog.monstuff.com/ archives/000296.html, (Jun. 25, 2006), 5 pages.
Crockford, Douglas "JSONRequest", Retrieved from: <http://json.org.JSONRequest.html> on Nov. 3, 2007, (Apr. 17, 2006), 8 pages.
Crockford, Douglas "JSONRequest", Retrieved from: on Nov. 3, 2007, (Apr. 17, 2006), 8 pages.
De Keukelaera, Frederik et al., "SMash: Secure Component Model for Cross-Domain Mashups on Unmodified Browsers", Proceeding of the 17th International Conference on World Wide Web, Apr. 21-25, 2008, ACM Press, New York, NT, USA, (Apr. 21, 2008), 13 pages.
Ernesto, Damiani et al., "A Fine-Grained Control System for XML Documents", ACM, (May 2002), pp. 169-202.
Festa, Paul "Communicator subject to frame-spoofing", Retrieved from: <http://news.cnet.com/2100-1023-21975.html&tag=mncol%3btxt> on Oct. 11, 2010, (Jan. 5, 1999), 1 page.
Festa, Paul "Communicator subject to frame-spoofing", Retrieved from: on Oct. 11, 2010, (Jan. 5, 1999), 1 page.
Fu, Kevin et al., "Dos and Don'ts of Client Authentication on the Web", IEEE, 2002, (2002), 17 pages.
Grosskurth, Alan et al., "Architecture and Evolution of the Modern Web Browser", David R. Cheriton School of Computer Science, University of Waterloo, Available at , (Jun. 2006), pp. 1-24.
Grosskurth, Alan et al., "Architecture and Evolution of the Modern Web Browser", David R. Cheriton School of Computer Science, University of Waterloo, Available at <http://grosskurth.ca/papers/browser-archevol-20060619.pdf>, (Jun. 2006), pp. 1-24.
Herzberg, Amir et al., "Protecting (even) Naive Web Users, or: Preventing Spoofing and Establishing Credentials of Web Sites", Bar Ilan University, Available at , (Jul. 18, 2004), 26 pages.
Herzberg, Amir et al., "Protecting (even) Naive Web Users, or: Preventing Spoofing and Establishing Credentials of Web Sites", Bar Ilan University, Available at <www.cs.bu.ac.il/˜herzea/papers/ecommerce/trusted credentials areas.pdf>, (Jul. 18, 2004), 26 pages.
Horak, Ales et al., "DEBVisDic-First Version of New Client-Server Wordnet Browsing and Editing Tool", In Proceedings of GWC 2006, Available at , (Jan. 2006), 5 pages.
Horak, Ales et al., "DEBVisDic—First Version of New Client-Server Wordnet Browsing and Editing Tool", In Proceedings of GWC 2006, Available at <https://www.cs.cas.cz/semweb/download.php?file=06- 11-pala-etal&type=pdf>, (Jan. 2006), 5 pages.
Hunt, Galen et al., "Detours: Binary Interception of Win32 Functions", Proceedings of the 3rd US EN IX Windows NT Symposium, (Jul. 1999), pp. 1-9.
Jackson, Collin et al., "Subspace: Secure CrossDomain Communication for Web Mashups", In Proceedings of the International World Wide Web Conference Committee (IW3C2), May 8-12, 2007, available at , (May 8, 2007), 10 pages.
Jackson, Collin et al., "Subspace: Secure CrossDomain Communication for Web Mashups", In Proceedings of the International World Wide Web Conference Committee (IW3C2), May 8-12, 2007, available at <http://citeseerx.ist.psu.edu/viewdoc?doi=10.1.1.123.1586&rep=rep1%type=pdf>, (May 8, 2007), 10 pages.
Jim, Trevor et al., "Defeating Script Injection Attacks with Browser-Enforced Embedded Policies", In Proceedings of WWW 2007, May 8-12, 2007, available at , (May 8, 2007), pp. 601-610.
Jim, Trevor et al., "Defeating Script Injection Attacks with Browser-Enforced Embedded Policies", In Proceedings of WWW 2007, May 8-12, 2007, available at <http://www2007.org/papers/paper595.pdf>, (May 8, 2007), pp. 601-610.
Joshi, James B., et al., "Security Models for Web-Based Applications", Communications of the ACM, (Feb. 2001), 10 pages.
Kaminsky, Dan "Black Ops 2007: Design Reviewing The Web", IOActive Comprehensive Computer Security Services, Available at , (2007), 67 pages.
Kaminsky, Dan "Black Ops 2007: Design Reviewing The Web", IOActive Comprehensive Computer Security Services, Available at <http://www.doxpara.com/DMK—BO2K7—Web.ppt>, (2007), 67 pages.
Karlof, Chris et al., "Dynamic Pharming Attacks and Locked Same-origin Policies for Web Browsers", In Proceedings of CCS 2007,(Nov. 2007), pp. 58-71.
Kirda, Engin et al., "Noxes: A Client-Side Solution for Mitigating Cross-Site Scripting Attacks", Proceedings of SAC '06, Apr. 23-27, 2006, available at , (Apr. 23, 2006), 8 pages.
Kirda, Engin et al., "Noxes: A Client-Side Solution for Mitigating Cross-Site Scripting Attacks", Proceedings of SAC '06, Apr. 23-27, 2006, available at <http://www.seclab.tuwien.ac.at/papers/noxes.pdf>, (Apr. 23, 2006), 8 pages.
Komathy, K et al., "Security for XML messaging services-a component-based approach", Journal of Network and Computer Applications, (2003), 15 pages.
Komathy, K et al., "Security for XML messaging services—a component-based approach", Journal of Network and Computer Applications, (2003), 15 pages.
Levin, Lori et al., "The Janus-III Translation System: Speech-to-Speech Translation in Multiple Domains", Machine Translation, vol. 15,(2000), pp. 3-25.
Ley, Jim "Using the XML HTTP Request object", Retrieved from: <http://www.jibbering.com/2002/4/httprequest.2005.8.html> on Nov. 4, 2010, (Apr. 2002), 6 pages.
Ley, Jim "Using the XML HTTP Request object", Retrieved from: on Nov. 4, 2010, (Apr. 2002), 6 pages.
Matthies, Christian "DNS Pinning Explained", Retrieved from: <http://christ1an.blogspot.com/2007/07/dns-pinning-explained.html> on Nov. 3, 2007, (Jul. 1, 2007), 12 pages.
Matthies, Christian "DNS Pinning Explained", Retrieved from: on Nov. 3, 2007, (Jul. 1, 2007), 12 pages.
Melez, Myk et al., "Mozilla Application Framework in Detail", Retrieved from: <https://developer.mozilla.org/en/mozilla—application—Detail> on Jan. 28, 2011, (Feb. 15, 2006), 6 pages.
Melez, Myk et al., "Mozilla Application Framework in Detail", Retrieved from: on Jan. 28, 2011, (Feb. 15, 2006), 6 pages.
Miyamoto, Daisuke et al., "SPS: A Simple Filtering Algorithm to Thwart Phishing Attacks", AINTEC 2005, (2005), 15 pages.
Nielson, Jordan et al., "Benchmarking Modern Web Browsers", Department of Computer Science, University of Calgary, Available at , (Oct. 2008), pp. 1-6.
Nielson, Jordan et al., "Benchmarking Modern Web Browsers", Department of Computer Science, University of Calgary, Available at <http://www.aqualab.cs.northwestern.edu/HotWeb08/papers/Nielson-BMW.pdf>, (Oct. 2008), pp. 1-6.
Novak, Mark "Extending SDL: Documenting and Evaluating the Security Guarantees of Your Apps", MSDN Magazine, available at , (Nov. 2006), 6 pages.
Novak, Mark "Extending SDL: Documenting and Evaluating the Security Guarantees of Your Apps", MSDN Magazine, available at <http://msdn.microsoft.com/en-us/magazine/cc163522.aspx>, (Nov. 2006), 6 pages.
Radosevic, Danijel et al., "Development of a Higher-Level Multimedia Scripting Language", 23rd Int. Conf. Information Technology Interfaces ITI 2001, (Jun. 19, 2001), pp. 201-208.
Samarati, Pierangela et al., "An Authorization Model for a Distributed Hypertext System", IEEE Transactions on Knowledge and Data Engineering, vol. 8, No. 4, (Aug. 1996), pp. 555-562.
Spanias, Andreas et al., "Development of New Functions and Scripting Capabilities in Javaa-DSP for Easy Creation and Seamless Integration of Animated DSP Simulations in Web Courses", 2001 IEEE, (2001), pp. 2717-2720.
Tam, et al., "A Fast and Flexible Framework of Scripting for Web Application Development: A Preliminary Experience Report", 2000 IEEE, (2000), pp. 450-455.
Van Kesteren, Anne "Cross Domain HXR Enabling Read Access for Web Resourced", http://www.w3.org/TR/2007/WD-access-control-20071001/, (Nov. 3, 2007),1-12.
Verisign Inc., "Licensing VeriSign Certificate: Securing Multiple Web Server and Domain Configurations", White Paper, Available at , (Nov. 2, 2001), 15 pages.
Verisign Inc., "Licensing VeriSign Certificate: Securing Multiple Web Server and Domain Configurations", White Paper, Available at <www.msctrustgate.com/pdf/licensing.pdf>, (Nov. 2, 2001), 15 pages.
Zoline, Kenneth O., "An Approach for Interconnections SNA and XNS Networks", In Proceedings of SIGCOMM 1985,(1985), pp. 184-198.
US8918759B2 (en) 2014-12-23 grant
US20130042255A1 (en) 2013-02-14 application
US9830306B2 (en) 2017-11-28 grant
US20120304044A1 (en) 2012-11-29 application
US9116867B2 (en) 2015-08-25 grant
US20150058714A1 (en) 2015-02-26 application
US20120304203A1 (en) 2012-11-29 application
US20150026661A1 (en) 2015-01-22 application
US20120304303A1 (en) 2012-11-29 application
US9582479B2 (en) 2017-02-28 grant
US20130047064A1 (en) 2013-02-21 application
US8646029B2 (en) 2014-02-04 grant
US9830305B2 (en) 2017-11-28 grant
US20120304150A1 (en) 2012-11-29 application
US9244896B2 (en) 2016-01-26 grant
US20130047258A1 (en) 2013-02-21 application
US20150058924A1 (en) 2015-02-26 application
US8689182B2 (en) 2014-04-01 grant
US8881101B2 (en) 2014-11-04 grant
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:LEITHEAD, TRAVIS;ROGERS, JUSTIN;PAVLICIC, MILADIN;AND OTHERS;SIGNING DATES FROM 20110425 TO 20110519;REEL/FRAME:034062/0957