Browser Access Control via Pre-defined Lists
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Built-in browsers in devices like set-top boxes and video game consoles, when extended to expose additional functions, pose a serious security risk when rendering pages from untrusted domains due to uncontrolled access to custom browser functionality.
Innovation Solution
Implementing an access control list pre-defined by a service provider that is transmitted to the device, which checks and controls access to custom browser functions by comparing parameters against the list before executing them, ensuring only authorized domains can access and execute custom functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If built-in browsers are extended to expose additional functions, objects, and variables, then functionality of the device is increased, but security risk increases when rendering pages from untrusted domains
Solution Approach 1:
The patent implements an access control list that is pre-defined by a service provider and transmitted to the device before the browser executes any custom functions. This preliminary configuration establishes security rules in advance, allowing the browser to safely execute custom functionality from trusted domains while blocking untrusted ones, thus resolving the contradiction between enhanced functionality and security risk
Solution Approach 2:
The patent introduces an access control list as an intermediary layer between the browser's custom function execution capability and the actual system resources. This intermediary checks domain trustworthiness and controls access to custom functions, objects, and variables, enabling the system to provide extended functionality while maintaining security through the mediating access control mechanism
Data Source
AI summary
A method, non-transitory computer readable medium and apparatus for controlling access of a custom browser function are disclosed. For example, the method includes a processor that sends a request to a third party website, receives a hypertext markup language code and a browser script, renders the hypertext markup language code, detects that the browser script is trying to access a custom browser function, compares one or more parameters associated with the custom browser function to an access control list to control an access of the custom browser function, and executes the custom browser function when a match of the one or more parameters is found in the access control list.