Obfuscating web code

Abstract

A computer-implemented method, the method includes identifying a piece of data to be served from a server system to a client device that is remote from the server system; creating a plurality of expressions that, when executed, provide a result that corresponds to the piece of data; and providing the plurality of expressions to the client device with code for executing the plurality of expressions.

What is claimed is: 
     
         1 . A computer-implemented method, comprising:
 identifying a piece of data for serving from a server system to a client device that is remote from the server system, the piece of data being part of executable code requested from the server from the client device;   creating a plurality of expressions that, when executed, provide a result that corresponds to the piece of data; and   providing, to the client device and as part of the executable code, the plurality of expressions along with code for executing the plurality of expressions, so that when the plurality of expressions are executed on the client device, the identified piece of data is returned on the client device without a need to serve the identified piece of data to the client device.   
     
     
         2 . The computer-implemented method of  claim 1 , further comprising performing a permutation on the plurality of expressions so that the plurality of expressions are ordered in the executable code in an order different than they were created. 
     
     
         3 . The computer-implemented method of  claim 2 , wherein the order of the expressions is selected randomly as part of the permutation. 
     
     
         4 . The computer-implemented method of  claim 1 , further comprising:
 creating one or more additional expressions whose executed results are not used by other code that is part of the executable code served to the client device; and   providing to the client device the plurality of expressions with the one or more additional expressions.   
     
     
         5 . The computer-implemented method of  claim 1 , further comprising:
 identifying, in the piece of data, data that needs to be kept away from malware that may be in the client device, and   wherein creating a plurality of expressions comprises creating one or more replacement statements that when executed, provide a result that corresponds to the potentially sensitive data.   
     
     
         6 . The computer-implemented method of  claim 5 , wherein the one or more replacement statements comprise one or more expressions that do not execute on the client device when the executable code is executed. 
     
     
         7 . The computer-implemented method of  claim 1 , further comprising identifying, in the piece of data, a first expression and a second expression to be replaced, wherein creating a plurality of expressions comprises creating a first set of replacement expressions corresponding to the first expression and a second set of expressions corresponding to the second expressions; and
 interleaving the replacement expressions of the first set of replacement expressions with the replacement expressions of the second set of replacement expressions,   wherein the plurality of expressions provided to the client device comprise the interleaved replacement expressions.   
     
     
         8 . The computer-implemented method of  claim 1 , wherein creating a plurality of expressions comprises:
 creating a first set of replacement expressions;   identifying a first replacement expression in the first set of replacement expressions;   creating a second set of replacement expressions that, when executed, provide a result that corresponds to the first replacement expression; and   replacing the first replacement expression with the second set of replacement expressions.   
     
     
         9 . The computer-implemented method of  claim 1 , wherein the piece of data to be served comprises formats of code in HTML, CSS, and JavaScript, and wherein each of the formats interoperates with the other formats. 
     
     
         10 . A computer-implemented method, the method comprising:
 receiving, from a server system, web content comprising original code, wherein the web content is requested by a client device that is remote from the server system;   identifying a piece of data in the code;   creating a plurality of expressions that, when executed, provide a result that corresponds to the piece of data;   generating modified code comprising the original code with the piece of data replaced with the plurality of expressions; and   providing the modified code to the client device, wherein, when executed, the modified code provides a result that corresponds to the original code.   
     
     
         11 . The computer-implemented method of  claim 10 , wherein generating modified code comprises:
 interleaving the plurality of expressions into the original code with the identified piece of data removed.   
     
     
         12 . The computer-implemented method of  claim 11 ,
 wherein the plurality of expressions are created in a first ordering, and   wherein the plurality of expressions are interleaved into the original code so that the plurality of expressions maintain the first ordering.   
     
     
         13 . The computer-implemented method of  claim 11 ,
 wherein the plurality of expressions are created in a first ordering, and   wherein the plurality of expressions are interleaved into the original code so that the plurality of expressions are in a second ordering that is different than the first ordering.   
     
     
         14 . The computer-implemented method of  claim 10 , wherein the plurality of expressions comprises one or more junk expressions that do not execute. 
     
     
         15 . The computer-implemented method of  claim 10 , further comprising:
 selecting a first expression among the plurality of expressions; and   creating a second plurality of expressions that, when executed, provide a result that corresponds to the selected first expression,   wherein the generated modified code comprises the original code with the piece of data replaced with the plurality of expressions, with the selected first expression replaced with the second plurality of expressions.   
     
     
         16 . A computer system for recoding web content served to client computers, the system comprising:
 an interface for receiving information from a web server system configured to provide computer code in multiple different formats in response to requests from client computing devices; and   a security intermediary that is arranged to (i) receive the computer code from the interface before the computer code is provided to the client computing devices, (ii) identify a piece of data in the computer code that is to be replaced; (iii) create a plurality of expressions that, when executed, provide a result that corresponds to the piece of data; and (iv) provide the plurality of expressions to the client computing devices with code for executing the plurality of expressions.   
     
     
         17 . The computer-implemented system of  claim 16 , wherein the piece of data in the computer code that is to be replaced is identified as potentially sensitive data. 
     
     
         18 . The computer-implemented system of  claim 16 , wherein the security intermediary is further arranged to perform a permutation of the plurality of expressions. 
     
     
         19 . The computer-implemented system of  claim 16 , wherein the plurality of expressions comprise one or more expressions that do not execute. 
     
     
         20 . The computer-implemented system of  claim 16 , wherein the security intermediary is further arranged to interleave the plurality of expressions with the code of executing the plurality of expressions.