Shape Security, Inc.

F5, Inc.

Michael J Ficarra

Kevin Gibbons

Tim Disney

Justin David Call

Bei Zhang

Jarrod S Overson

Ariya Hidayat

Nitish Kishore Khadke

Technology related to obfuscating programs using different instruction set architectures is disclosed. In one example, a method includes receiving a program implemented as a set of ordered instructions. Each instruction of the set of ordered instructions has a type specified by a first instruction set architecture (ISA). A subgroup of instructions is selected from the set of ordered instructions. A new instruction type is generated to perform the operations of the subgroup of consecutive instructions. The new instruction type is added to a second ISA. An updated program is generated by replacing the subgroup of instructions with a new instruction of the generated new instruction type. An interpreter for executing programs using the second ISA is generated. In response to a request for the program, the updated program and the interpreter is sent.

Obfuscating programs using different instruction set architectures

A method non-transitory computer readable medium, device and system that receives one of one or more requests from a client to a web server system. An interstitial page is served to the client and comprises instrumentation code that, when executed at the client, collects telemetry data. The telemetry data is received and a threat analysis is performed on the telemetry data collected in association with the one of the requests. A determination is made on when, based on the performing the threat analysis, that the one of the requests is from a potential attacker. When the determination indicates the one of the requests is not from the potential attacker then the one of the requests is allowed.

Advanced interstitial techniques for web security

Programs written in interpreted languages, such as JavaScript, are distributed in source form, which is helpful to attackers so that they can more easily derive the purposes and effects of a program. As discussed herein, a program's high-level code may be effectively obfuscated by transforming the program's code from its high-level programming language to low-level processor-specific language, such as x86 instructions for x86 processors, JVM bytecode for JVMs, or proprietary opcodes for a corresponding proprietary processor or interpreter. Additional obfuscation techniques can be applied the program's low-level processor-specific code.

Obfuscating source code sent, from a server computer, to a browser on a client computer

Techniques are provided for determining environment parameter values based on rendered emoji analysis, A server computer provides a first set of code that, when executed by a browser application at a client computing device, renders a set of emoji at the client computing device, generates a set of rendered graphic data for the set of emoji at the client computing device, and transmits the set of rendered graphic data for each emoji of the set of emoji from the client computing device to the server computer. The server computer receives the rendered graphic data generated at the client computing device, Based on the set of rendered graphic data for the set of emoji generated at the client computing device, the server computer determines a set values for one or more environment parameters of the client computing device.

Determining environment parameter values using rendered emoji analysis

In an approach, an apparatus comprises: one or more processors; a processor logic coupled to the one or more processors and configured to: intercept, from a client computer, a request directed to a server computer that identifies a purported user agent executing on the client computer; send, to the server computer, the request from the client computer; intercept, from the server computer, one or more original instructions to be executed by the purported user agent of the client computer; determine one or more features supported by the purported user agent that are not utilized by the one or more original instructions; transform the one or more original instructions into one or more revised instructions which, when executed by the purported user agent, cause the purported user agent to utilize the one or more features; send, to the client computer, the one or more revised instructions.

Variable runtime transpilation

In an embodiment, a computer system configured to improve security of client computer interacting with server computers comprises one or more processors; a digital electronic memory storing a set of program instructions which when executed using the one or more processors cause the one or more processors to: process a first set of original instructions that produce a first set of outputs or effects; generate a first set of interpreter instructions that define a first interpreter; generate a first set of alternate instructions from the first set of original instructions, wherein the first set of alternate instructions is functionally equivalent to the first set of original instructions when the first set of alternate instructions is executed by the first interpreter; send, to the first client computer, the first set of alternate instructions and the first set of interpreter instructions.

Applying bytecode obfuscation techniques to programs written in an interpreted language

Computer systems and methods for improving the security and efficiency of client computers interacting with server computers through an intermediary computer using one or more polymorphic protocols are discussed herein. In an embodiment, a computer system comprises a memory; one or more processors coupled to the memory and configured to: generate a modified identifier for a original object based on a original identifier and a nonce; render one or more instructions that include the nonce and define a modified object that corresponds to the original object and includes the modified identifier; send the one or more instructions to a client computer, wherein the one or more instructions, when executed by the client computer, are configured to cause the client computer to send a request from the client computer with the modified identifier and the nonce; receive, from the client computer, a request with a challenge identifier and a challenge nonce; generate a test identifier based on the original identifier and the challenge nonce; determine whether the test identifier matches the challenge identifier.

Deterministic reproduction of system state using seeded pseudo-random number generators

Computer systems and methods for improving security or performance of one or more client computers interacting with a plurality of server computers. In an embodiment, a computer system comprises a first server computer and a second server computer; wherein the first server computer is configured to: generate a challenge nonce, wherein the challenge nonce corresponds to a challenge state; generate the challenge state based on the challenge nonce, wherein the challenge state corresponds to a response state; send, to a first client computer, the challenge nonce and the challenge state, but not the response state; wherein the second server computer is configured to: receive, from the first client computer, a test nonce and a test response state; determine whether the test response state matches the response state based on the test nonce, without: receiving the challenge state from the first server computer; receiving the challenge state from the first client computer.

Growing community of inventors

Mountain View, CA, United States of America

Michael J Ficarra