Access Permission Verification Tags for Scriptable Request Parameters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity measures in computing systems are susceptible to vulnerabilities such as Insecure Direct Object Reference (IDOR), SQL Injection (SQLI), and Cross-Site Scripting (XSS), which allow unauthorized access and data manipulation, particularly due to the complexity and scale of user access requests in computing platforms.
Innovation Solution
A technique involving the application of verification tags to parameters within user access requests to ensure permission verification before granting access, using the computing platform's API information to identify parameters requiring verification, and updating the tag based on successful permission checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control measures are implemented, then basic authentication and authorization are provided, but the system remains susceptible to IDOR, SQLI, and XSS vulnerabilities
Solution Approach 1:
The patent applies preliminary action by performing permission verification on parameters before processing user access requests. Verification tags are applied to parameters in advance, and the system proactively checks whether users have permission to access resources identified by these parameters, preventing IDOR attacks before they can exploit the vulnerability.
Solution Approach 2:
The patent introduces verification tags as an intermediary mechanism between the user access request and the resource access decision. These tags act as mediators that carry permission verification information, enabling the system to systematically check and enforce access permissions while protecting against SQLI and XSS attacks through the additional verification layer.
2Reliability
If comprehensive permission verification is performed on all parameters, then unauthorized access is prevented, but system complexity and processing overhead increase
Solution Approach 1:
The patent applies local quality by performing permission verification selectively on specific parameters that require it, rather than uniformly on all parameters. The system identifies parameters needing verification based on their sensitivity and the potential for exploitation, applying verification tags only where necessary. This targeted approach prevents unauthorized access while avoiding the complexity and overhead of verifying every single parameter in every request.
Data Source
AI summary
An example computing platform is configured to detect a request on behalf of a given user, the request comprising a parameter of a given type; determine that the parameter requires a permission verification; apply to the request a verification status indicator that indicates whether or not a permission verification has been successfully performed for the given user with respect to the parameter; perform a permission verification for the given user with respect to the parameter; either (i) leave the verification status indicator set to a first value if the given user does not have permission to embed scripts into the given type of parameter, or (ii) update the verification status indicator from the first value to a second value if the given user has permission to embed scripts into the given type of parameter; and grant or deny the request based at least in part on the verification status indicator.