Web malware blocking through parallel resource rendering

Abstract

Apparatus and method for transforming Web resources into safe versions such that malicious code on the resources cannot attack the client viewing the resources. The invention separates the processing of insecure code from the processing of benign code. For Web pages, the benign code is displayed immediately to the client while insecure code is processed on a separate machine. Once insecure code is processed, benign outputs of that code are passed to the client for display. The invention safeguards the client against known and zero day exploits without requiring a catalog of malware/virus signatures, heavyweight code checkers, complete page re-writing or highly restrictive access policies. The invention provides the client with complete malware blocking while retaining most of the original functionality of the Web resource.

What is claimed is: 
     
         1 . An apparatus, having a connection to an internet resource provider, for transforming internet resources from said internet resource provider into safely rendered versions of the same, said apparatus comprising:
 at least one a rendering computer processor;
 at least one proxy computer processor; 
 at least one client computer processor; and 
 a computer software program containing computer executable instructions stored on a non-transitory medium, said computer executable instructions further comprising a rendering browser and a client browser, which, when read by said rendering computer processor and said proxy computer processor, will render the contents of said internet resources by
 causing said proxy computer processor to retrieve from said internet resource provider processor an internet resource upon request from either said client computer processor or said rendering computer processor; 
 causing said proxy computer processor to provide said rendering computer processor and said client computer processor said internet resource; 
 when said internet resource is a webpage, causing said rendering browser to render said webpage in its entirety with original codeset in parallel with causing said client browser to render said webpage with only benign code; and 
 when said internet resource is not a web page, causing said rendering computer processor to provide a remotely viewed version of said internet resource to said client computer processor. 
 
   
     
     
         2 . The apparatus of  claim 1 , wherein
 said rendering browser resides in said rendering computer processor; and   said client browser resides in said client computer processor.   
     
     
         3 . The apparatus of  claim 2 , wherein when said internet resource is a web page, said computer executable instructions send web page information and communications information to said rendering browser and said client browser. 
     
     
         4 . The apparatus of  claim 3 , wherein when said internet resource is a web page, said rendering browser
 opens a communications channel to said client browser;   sends Document Object Model updates to said client browser;   sends page requests to said proxy computer processor;   sends any changes in rendering browser's version of said webpage to said client browser;   continually listens for client actions from said client browser; and   implements client browser actions.   
     
     
         5 . The apparatus of  claim 4 , wherein credentials are passed when said communications channel is opened. 
     
     
         6 . The apparatus of  claim 3 , wherein when said internet resource is a web page, said client browser
 opens a communications channel to said rendering browser only after rendering said webpage with only benign code;   continually listens for Document Object Model updates from said rendering browser;   makes webpage changes according to any new Document Object Model structure;   sends client actions to said rendering browser; and   sends new webpage requests to said proxy computer processor.   
     
     
         7 . The apparatus of  claim 2 , wherein when said internet resource is other than a web page, said computer executable instructions
 determine whether the internet resource can be converted to a secure format and   whether a new format is acceptable to a client, and if so;
 convert said internet resource to a secure format; and 
 send said converted internet resource to said client otherwise, 
 send said internet resource to said rendering browser; 
 send a framework for remotely viewing said internet resource to said client browser; 
 enable a secure communications channel between said rendering browser and said client browser; 
 enable said rendering browser to provide a remote view of said internet resource to said client browser; 
 enable said client browser to pass actions back to said rendering browser; 
 enable said rendering browser to make changes to the view of said internet resource according to said client browser actions; and 
 enable said rendering browser to provide said changed view of said internet resource to said client browser. 
   
     
     
         8 . The apparatus of  claim 1 , wherein any of said
 at least one a rendering computer processor;   at least one proxy computer processor; and   at least one client computer processor:   are implemented as either virtual or physical devices.   
     
     
         9 . For application in conjunction with a system having a connection to an internet resource provider and having at least one a rendering computer processor, at least one proxy computer processor, and at least one client computer processor, an article of manufacture comprising a non-transitory storage medium having a plurality of computer programming instructions stored therein, said programing instructions when executed by said processors, transform said internet resources into safely rendered versions of the same, by
 causing said proxy computer processor to retrieve from said internet resource provider processor an internet resource upon request from either said client computer processor or said rendering computer processor;   causing said proxy computer processor to provide said rendering computer processor and said client computer processor said internet resource;   when said internet resource is a webpage, causing said rendering computer processor to render said webpage in its entirety with original codeset in parallel with causing said client computer processor to render said webpage with only benign code; and   when said internet resource is not a web page, causing said rendering computer processor to provide a remotely viewed version of said internet resource to said client computer processor.   
     
     
         10 . The article of manufacture of  claim 9  further causing the sending of web page information and communications information to said rendering computer processor and said client computer processor when said internet resource is a web page. 
     
     
         11 . The article of manufacture of  claim 10 , wherein when said internet resource is a web page, further causes said rendering computer processor to
 open a communications channel to said client computer processor;   send Document Object Model updates to said client computer processor;   send page requests to said proxy computer processor;   send any changes in rendering computer processor's version of said webpage to said client computer processor;   continually listen for client actions from said client computer processor; and   implement client computer processor actions.   
     
     
         12 . The article of manufacture of  claim 11 , further causing the passing credentials when said communications channel is opened. 
     
     
         13 . The article of manufacture of  claim 10 , wherein when said internet resource is a web page, further causing said client computer processor to
 open a communications channel to said rendering computer processor only after rendering said webpage with only benign code;   continually listen for Document Object Model updates from said rendering browser;   make webpage changes according to any new Document Object Model structure;   send client actions to said rendering computer processor; and   send new webpage requests to said proxy computer processor.   
     
     
         14 . The article of manufacture of  claim 10 , wherein when said internet resource is other than a web page, further causes
 determining whether the internet resource can be converted to a secure format and whether a new format is acceptable to a client, and if so;
 converting said internet resource to a secure format; and 
 sending said converted internet resource to said client otherwise, 
 sending said internet resource to said rendering computer processor; 
 sending a framework for remotely viewing said internet resource to said client computer processor; 
 enabling a secure communications channel between said rendering computer processor and said client computer processor; 
 enabling said rendering computer processor to provide a remote view of said internet resource to said client computer processor; 
 enabling said client computer processor to pass actions back to said rendering computer processor; 
 enabling said rendering computer processor to make changes to the view of said internet resource according to said client computer processor actions; and 
 enabling said rendering computer processor to provide said changed view of said internet resource to said client computer processor. 
   
     
     
         15 . The article of manufacture of  claim 9 , wherein any of said
 at least one a rendering computer processor;   at least one proxy computer processor; and   at least one client computer processor;   are implemented as either virtual or physical devices.