SHIELD Web Core Technology
1. Remote Browser Isolation (RBI)
Overview
SHIELD Web's RBI is a server-side rendering technology specialized in protecting external web services. Moving away from the traditional 'detection and blocking' method, it structurally isolates the attacker from the web server, effectively eliminating the attack surface itself. Instead of the actual web server, SHIELD Web handles all access, fundamentally blocking vulnerabilities and attacks.
Operating Principle
Traditional Web Services
1. User inputs website URL
2. Browser directly connects to web server
3. Web server responds with HTML, JS, CSS
4. Render and execute in user browser
└─ Risk: Vulnerabilities are exposed, possible attacks
API structure exposure, parameter manipulation possible
Server IP, OS, middleware information exposure
SHIELD Web Method
1. User inputs website URL (example.com)
2. Connects to SHIELD Web via DNS settings
3. SHIELD Web accesses the actual web server in an isolated virtual container
4. Rendering in the SHIELD Web isolated environment
5. Only safe pixel streams are sent to the user
└─ Safe: Blocks vulnerability exposure, impossible to attack
API structure not exposed, parameter manipulation not possible
Complete concealment of server infrastructure information
Isolated Elements
Web Content
- HTML Parsing and Rendering
- Applying CSS Styles
- Running JavaScript
- Image, font loading
Network
- All HTTP/HTTPS requests
- API call
- WebSocket Connection
- AJAX Communication
Blocking Security Threats
- Parameter Manipulation
- Session Hijacking Attempt
- Insert OS command
- SSRF(Server Side Request Forgery)
2. Attack Surface Hiding (Invisible Infrastructure)
Overview
SHIELD Web provides an 'Invisible Infrastructure' structure that hides the very existence of the web server from external sources. If an attacker cannot identify the target of the attack, the attack itself becomes impossible.
Hidden Infrastructure Information
- Server IP address: The actual web server IP is not exposed to the outside.
- OS and Version Information: Unable to identify operating system type and version
- Middleware Environment: Web server (Apache, Nginx, etc.), WAS (Tomcat, etc.) information non-disclosure
- Source Code and Directory Structure: Unable to infer file system path
- Error message: Internal system information errors are not delivered to the user.
Utilization Effect
- Disabling the reconnaissance phase of advanced targeted attacks such as APT (Advanced Persistent Threat)
- Especially effective in protecting the infrastructure of high-risk institutions such as defense and national security.
- Even when zero-day vulnerabilities are disclosed, it is impossible to identify the server itself, minimizing damage.
3. DNS-based Application Method
Overview
SHIELD Web is designed to be easily applied with just a DNS change. No modifications to existing web services are required at all.
Application Procedure
-
Step 1: Change DNS
-
Step 2: Provide SSL Certificate
-
Step 3: Firewall Configuration
- Direct access to the web server from outside is not possible.
- Only access through SHIELD Web is allowed
- Blocking Bypass Access
4. Server-side Rendering
Chromium Engine
Technology Stack
- Google Chromium-based rendering engine
- Perfect support for the latest web standards
- JavaScript V8 Engine
- WebGL, Canvas support
Scope of Support
- HTML5, CSS3
- ECMAScript 2015+ (ES6+)
- Latest JavaScript API
- Web Animation, Transition
WebJet™ Protocol
SOFTCAMP Custom Development Technology
Features
- Use only standard HTTPS (port 443)
- Additional firewall configuration unnecessary
- Direct Streaming Without a Relay Server
Security
- Send only screen data (pixel stream)
- Source code not exposed
- API Structure Non-Exposure
- Access to original content is not available.
Performance
- Low Latency
- High-Quality Screen Transmission
- Efficient Bandwidth Usage
5. Web Vulnerability Protection
Response to 21 Items of Vulnerabilities in the National Intelligence Service Website
SHIELD Web is used during regular security assessments of public institutions.Compensating ControlIt can be used as a means. Even if there are vulnerabilities in the server itself, the RBI isolation structure fundamentally blocks the attack path.
| number | National Intelligence Service Diagnosis Items | SHIELD Web Response Method | Diagnosis Result (Example) |
|---|---|---|---|
| 1 | SQL Injection | Input validation and abnormal protocol blocking at the RBI layer | Good |
| 2 | Cross Site Scripting (XSS) | The script runs only in an isolated container, resulting in zero impact on the user's PC. | Good |
| 3 | Location Disclosure (Directory Listing) | Server directory structure is pixelated to block exposure sources. | Good |
| 4 | Vulnerable Method (WebDAV) | Rejecting unnecessary HTTP methods such as PUT and DELETE due to RBI policy | Good |
| 5 | Error message display | Server internal error is not communicated to the user screen as text. | Good |
| 6 | Backup file/log exposure | The actual file system path is isolated in an untraceable manner. | Good |
| 7 | File Upload Vulnerability | Upload after blocking the influx of malicious files in conjunction with CDR technology. | Good |
| 8 | File Download Vulnerability | Hiding Actual Server Path and Blocking Path Traversal | Good |
| 9 | Admin Page Exposure | Block access to management page paths outside of authenticated users. | Good |
| 10 | Vulnerable Information Exposure | Source code comments, metadata, etc. are hidden by pixel streaming. | Good |
| 11 | Parameter Tampering | Isolate user URL manipulation so that it does not affect the server. | Good |
| 12 | Insufficient authentication | Strong access control through integration of two-factor authentication (MFA) at the RBI stage | Good |
| 13 | Insufficient session management | Application of one-time/isolation session structure that makes session hijacking impossible | Good |
| 14 | Insufficient Authorization (ACL) | Fine-grained control of user-specific accessible resources in RBI policies | Good |
| 15 | Cookie Tampering/Vulnerability | Does not store actual service cookies on the user's local device. | Good |
| 16 | HTTP Header Tampering | Reconstructing and forwarding request/response headers from the RBI server | Good |
| 17 | Untrusted external input | Zero Trust Model for Primary Processing of All Inputs in a Container | Good |
| 18 | Weak Encryption Algorithm | Even on older version servers, RBI performs the latest TLS communication instead (SSL Offloading) | Good |
| 19 | Redirection Vulnerability | Policy Blocking of Forced Redirection to Unapproved External Domains | Good |
| 20 | Server-Side Request Forgery (SSRF) | Detect/Block Internal Network Access Attempts on Web Server at Isolation Layer | Good |
| 21 | Insert OS command | Since it does not communicate directly with the web server OS, command injection is not possible. | Good |
6. Protecting Web API
API Non-exposure
General Web Service
Open Browser Developer Tools (F12)
→ Check API calls in the Network tab
→ Understand URL and parameter structure
→ You can directly call the API using Postman, curl, etc.
Example:
GET /api/users/123
POST /api/payment
DELETE /api/order/456
SHIELD Web
Open Browser Developer Tools (F12)
→ Only SHIELD Web streaming protocol is visible
→ Actual API URL and parameters cannot be checked
→ Direct API calls are not possible
Users can only see and manipulate the screen
The actual API can only be called by SHIELD Web
API Access Control
Firewall Integration
Actual web server firewall settings:
- Allow: SHIELD Web IP only
- Block: All other external access
Effects:
- Prevent external exposure of API endpoints
- Completely block unauthorized access
- First line of defense against DDoS attacks
- Direct API calls not possible