Intercepting and injecting calls into operations and objects

Abstract

A computer implemented method for improving security of a server computer that is configured to deliver computer program instructions to a remote client computer, and comprising, using an intermediary computer that is topologically interposed between the server computer and the remote client computer is provided. The intermediary computer is configured to intercept a first set of source code instructions from the server computer. The intermediary computer identifies first party operations that include operations on objects and the objects themselves. The intermediary computer identifies a first set of operations within the first party operations that are configured to define values for one or more objects based on one or more constants. The intermediary computer then generates a second set of operations, where the second set of operations are configured to define same values for the one or more objects, when executed by a web browser on the client computer. The intermediary computer transforms the first party operations into transformed first party operations by substituting the first set of operations with the second set of operations. The intermediary computer generates a second set of source code instructions that are based on the first set of source code instructions and the transformed first party operations. The intermediary computer then sends the second set of source code instructions to the client computer.

What is claimed is: 
     
         1 . A computer implemented method for improving security of a server computer that is configured to deliver computer program instructions to a client computer, and comprising:
 using an intermediary computer that is topologically interposed between the server computer and the client computer:   intercepting a first set of source code instructions from the server computer that are configured to achieve an expected result when executed by a web browser on a client computer;   within the first set of source code instructions, identifying first party operations that include at least operations on objects and the objects referenced by the first set of source code instructions;   identifying a first set of operations within the first party operations, that are configured to define values for one or more objects based on one or more constants;   generating a second set of operations, where the second set of operations are configured to define same values for the one or more objects, when executed by a web browser on the client computer;   transforming the first party operations into transformed first party operations by substituting the first set of operations with the second set of operations;   generating a second set of source code instructions that are based on the first set of source code instructions and the transformed first party operations;   sending the second set of source code instructions to the client computer.   
     
     
         2 . The computer implemented method of  claim 1 , wherein generating a second set of operations comprises implementing one or more obfuscation transformations to the first set of operations to generate the second set of operations. 
     
     
         3 . The computer implemented method of  claim 2 , wherein generating a second set of operations further comprises inserting additional functions that are executed as an IIFE. 
     
     
         4 . A computer implemented method for improving security of a server computer that is configured to deliver computer program instructions to a client computer, and comprising:
 using an intermediary computer that is topologically interposed between the server computer and the client computer:   intercepting a first set of instructions from the server computer that define one or more objects and a set of original operations that operate on the one or more objects;   identifying a subset of original operations from the set of original operations within the first set of instructions to be extracted from the set of original operations;   generating a set of additional operations, where the set of additional operations is based at least in part on the subset of original operations and the one or more objects;   transforming the set of original operations to produce a set of transformed operations that are based at least in part on the set of additional operations;   generating a second set of instructions that define the set of additional operations and the set of transformed operations;   sending the second set of instructions to the client computer.   
     
     
         5 . The method of  claim 4 , further comprising generating the second set of instructions which define the set of original operations. 
     
     
         6 . The method of  claim 4 , wherein the set of additional operations includes one or more supervisor operations, which when executed, cause interception of a call to an operation on the client computer. 
     
     
         7 . The method of  claim 6 , wherein the call to the operation is a base operation that is defined by a runtime environment, and wherein the one or more supervisor operations, which when executed in the runtime environment on the client computer, cause:
 sending, to the intermediary computer, a set of telemetry data indicating that the call to the base operation was made;   performing the base operation;   receiving, from the client computer, the set of telemetry data;   storing, in a database, the set of telemetry data which indicates that the call to the base operation was made.   
     
     
         8 . The method of  claim 7 , wherein generating the set of additional operations further comprises:
 applying one or more obfuscation transformations to the subset of original operations, to produce a set of obfuscated transformed operations;   wherein the subset of original operations is configured to achieve an expected result when executed by the client computer;   wherein the set of obfuscated transformed operations is configured to achieve the expected result as the subset of original operations when executed by the client computer;   wherein generating the set of additional operations includes the set of obfuscated transformed operations.   
     
     
         9 . The method of  claim 8 , wherein the subset of original operations comprise a literal text string;
 wherein the set of obfuscated transformed operations comprise a statement defining a closure having a body that is configured to return the literal text string when executed by the client computer and invocation of the closure, and which is configured to achieve the expected result when executed by the client computer.   
     
     
         10 . The method of  claim 9 , wherein the statement comprises a JavaScript immediately-invoked function expression. 
     
     
         11 . The method of  claim 7 , wherein the set of original operations comprise a first assignment expression that is configured to assign a first value to a variable;
 wherein the set of transformed operations include the first assignment expression that is configured to assign the first value to the variable and a first modification expression configured to modify the first value of the variable to a second value;   wherein the set of additional operations include a second modification expression configured to modify the second value of the variable to the first value.   
     
     
         12 . The method of  claim 11 , wherein the a first modification expression is configured to apply encryption to the first value of the variable; and
 wherein the a second modification expression is configured to apply decryption to the second value of the variable.   
     
     
         13 . The method of  claim 7 , wherein the set of original operations comprise a first assignment expression configured to assign a first value to a first variable;
 wherein the first value is a combined value of a second value from a second variable and a third value from a third variable, where the second variable and third variable are defined in the set of original operations;   wherein the set of transformed operations comprise the first assignment expression configured to assign the first value to the first variable;   wherein the first value is the combined value of the second value from the second variable and the third value from the third variable;   wherein the set of additional operations comprise defining the second variable and third variable.   
     
     
         14 . The method of  claim 7 , wherein the set of original operations comprise a first assignment expression configured to assign a first value to a first variable;
 wherein the set of additional operations comprise the first assignment expression configured to assign a first function to the first variable;   wherein the first function is a specific library function, where the specific library function is part of a library that is supported by the set of original operations.   
     
     
         15 . The method of  claim 7  further comprising:
 intercepting from the client computer, a request that includes one or more modified object identifiers; 
 transforming the request, based on the one or more modified object identifiers to produce a modified request, wherein the modified request is the request that would have been received by the client computer had the client computer received the first set of instructions; 
 sending the modified request to the server computer.