Trusted zone protection

Abstract

A trusted zone protector in exemplary embodiments of an electronic system helps reduce unwanted attempts to use a consumer machine in a trusted zone to address a network resource that lies inside the trusted zone on behalf of a website that lies outside of the trusted zone. An address manager in the electronic system is arranged to provide an indication whether an element retrieved by a network-enabled application executing on the consumer machine is arranged to address a network resource that lies inside the trusted zone. The trusted zone protector is arranged to generate a protective action in response to the indication that the element retrieved by the network-enabled application is arranged to address the network resource that lies inside the trusted zone.

1 . A method, comprising:
 receiving an element origin indication that indicates whether an element is received by a network-enabled application from a network resource that lies outside a trusted zone;   receiving an element address indication that indicates whether the element is arranged to address a network resource that lies inside the trusted zone; and   taking a protective action in response to the element origin indication and the element address indication.   
     
     
         2 . The method of  claim 1 , wherein the trusted zone of network resources includes a group of network resources having trusted communications amongst the network resources of a first selected trusted zone associated with the network-enabled application and having untrusted communications between a network resource of the first selected trusted zone and a network resource outside of the first selected trusted zone associated with the network-enabled application. 
     
     
         3 . The method of  claim 2 , wherein the element address indication is generated by comparing the address by which the element is arranged to address a network resource against addresses included in a list of network resources in the trusted zone. 
     
     
         4 . The method of  claim 3 , comprising networking the group of trusted network resources together via a network that is otherwise inaccessible to an attacker because of the presence of one or more firewalls or authentication requirements. 
     
     
         5 . The method of  claim 4 , wherein the element address indication is generated in response to rendering the element received by the network-enabled application. 
     
     
         6 . The method of  claim 5 , wherein the element address indication is generated in response to an initiation of a request to the network resource that lies inside the trusted zone. 
     
     
         7 . The method of  claim 6 , wherein the list of network resources in the trusted zone includes a blacklist of network resources. 
     
     
         8 . The method of  claim 7 , wherein the blacklist of network resources includes network addresses of network resources that are securely accessed over a public network. 
     
     
         9 . The method of  claim 8 , comprising specifying the addresses of the network resources that are included in the trusted zone as IP (Internet protocol) addresses, as IP address lists, as a top-level domain-name, domain-name, hostname, or subdomain-name addresses, as a hash of IP (Internet protocol) addresses, as a hash of IP address lists, or as a hash of top-level domain-name, domain-name, hostname, or subdomain-name addresses. 
     
     
         10 . The method  claim 9 , comprising translating addressable hostnames to associated IP addresses and domain names. 
     
     
         11 . The method of  claim 9 , comprising generating a warning signal that is internal to the network resource that lies inside the trusted zone and upon which the network-enabled application is executing. 
     
     
         12 . The method of  claim 11 , wherein the taken protective action includes generating a warning signal that is conveyed to an entity related to the network-enabled application. 
     
     
         13 . The method of  claim 11 , wherein the taken protective action includes blocking a request to the network resource referred to by the network-enabled application in response to the warning signal. 
     
     
         14 . The method of  claim 13 , comprising loading the element received by the network-enabled application from an external network resource as part of a webpage, wherein the element is associated with an internal address of a network resource that lies inside the trusted zone and that is otherwise inaccessible by the external network resource. 
     
     
         15 . The method of  claim 14 , wherein a parent document object model (DOM) of the webpage that the network-enabled application renders is not included in the blacklist of network resources. 
     
     
         16 . A tangible medium including instructions that, when executed on a processor of an electronic system, comprise:
 receiving an element origin indication that indicates whether an element is received by a network-enabled application from a network resource that lies outside a trusted zone;   receiving an element address indication that indicates whether the element is arranged to address a network resource that lies inside the trusted zone; and   taking a protective action in response to the element origin indication and the element address indication.   
     
     
         17 . The medium of  claim 16 , wherein the trusted zone of network resources is a group of network resources having trusted communications amongst the network resources of a first selected trusted zone and having untrusted communications between a network resource of the trusted zone and a network resource outside of the first selected trusted zone. 
     
     
         18 . The medium of  claim 16 , wherein the element address indication is generated by comparing the address by which the element is arranged to address a network resource against addresses included in a list of network resources in the trusted zone. 
     
     
         19 . The medium of  claim 18 , wherein the group of trusted network resources are otherwise inaccessible to an attacker because of the presence of one or more firewalls or authentication requirements. 
     
     
         20 . The medium of  claim 16 , comprising determining whether an address of the network resource is included a blacklist of network resources. 
     
     
         21 . A web browsing system, comprising:
 a network-enabled application of a consumer machine that is arranged to receive a communication from a networked service provider that describes the structure and functionality of content of the communication that is received by the content user;   an address manager that is arranged to generate an indication whether an element retrieved by a network-enabled application from a network resource outside of a trusted zone of network resources is arranged to address a network resource that lies inside the trusted zone; and   a trusted zone protector that is arranged to generate a protective action in response to the indication that the element loaded by the network-enabled application is arranged to address the network resource that lies inside the trusted zone.   
     
     
         22 . The system of  claim 21 , wherein the address manager is arranged to generate an indication whether the element is arranged to address a network resource that lies inside the trusted zone. 
     
     
         23 . The system of  claim 21 , wherein the trusted zone includes a group of trusted network resources that are networked together via a network that is otherwise inaccessible to an attacker because of the presence of one or more firewalls or authentication requirements. 
     
     
         24 . The system of  claim 21 , wherein the indication whether the element retrieved by the network-enabled application is arranged to reference the network resource that lies inside the trusted zone is made by analyzing the element retrieved by the network-enabled application. 
     
     
         25 . The system of  claim 21 , wherein the indication whether the element retrieved by the network-enabled application is arranged to reference the network resource that lies inside the trusted zone is made by rendering the element retrieved by the network-enabled application. 
     
     
         26 . The system of  claim 25 , wherein the indication that the element retrieved by the network-enabled application is arranged to address the network resource that lies inside the trusted zone is made in response to an request initiated by a rendered element to address a network resource that lies inside the trusted zone on behalf of a website that lies outside of the trusted zone. 
     
     
         27 . The system of  claim 21 , wherein the address manager includes a first list of addresses of network resources in a first selected trusted zone. 
     
     
         28 . The system of  claim 27 , wherein the address manager includes a second list of addresses of network resources in a second selected trusted zone. 
     
     
         29 . The system of  claim 27 , wherein the first list of addresses of network resources in the first selected trusted zone includes addresses that are securely accessed over a public network. 
     
     
         30 . The system of  claim 21 , wherein the protective action taken includes blocking a request to the network resource referred to by the network-enabled application.