Asynchronous Active Browser Cache Management for Efficient and Secure Web Applications

            Two major concerns with browsing the Internet are the time it takes for web content to load and its security (authenticity and integrity).  When a web application is launched as a web URL (uniform resource locator), the content is fetched or transmitted over a network as a set of objects (pages, code, framework, graphic images, etc.).  Typically, if a “fresh” or latest copy of an object is found in the browser cache, it can be served locally.  Otherwise, a fresh copy is fetched over the network and used.  In an online environment, the definition of “fresh” typically means that there is not a newer copy available.  This can only be determined after querying servers to validate the status of the local cache first which is a passive approach meaning that it is automatically performed by a web browser and is not under control of an executed web program.  Therefore, this passive approach can have at least two drawbacks: increased page load time (PLT) and more security exposure.

            The increased PLT happens because the browser’s local cache cannot be used until it is verified by an online call to a server.  This also causes degradation in the user experience because it takes that much longer for pages to load.  Existing solutions attempt to solve this issue of increased PLT further increases overhead and delays in the load time to attempt solving the other drawback which is the increase in security exposure.  The security issue happens because of the exposure to the “man-in-the-middle” attacks.  These attacks happen because every online call to a server carries a risk of being intercepted by a “man-in-the-middle,” who can invalidate the “good” cache and replace it with a bad or potentially harmful version.  A cache management solution was developed that solves both of these problems.

            The cache management solution introduces a novel concept in loading and running online applications (e.g. dynamic pages), which address two traditionally conflicting needs: high security and lower PLT.  The solution implements an application driven cache management solution which achieves two goals.  The first goal is that the cache management is performed asynchronously in the background while the service is already running.  Since the application handles the fetching of the content that is put in the browser cache, the application can verify the integrity of the fetched content though signatures rather than resorting to other transport securities, which fulfills the second goal.  The overall effect to the user appears as if the application is installed locally and while the application is running, it checks for a new online version.  If a new ver...