Browser iframe isolation for secure cloud resource management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current interfaces lack secure control and isolation of multiple applications running in different environments such as Virtual Machines (VMs), Containers, and server-based applications, leading to potential security breaches as code within one browser window can access and modify resources across different sub-windows without permission.
Innovation Solution
A universal interface is developed using iframe technology to isolate applications and resources at the browser level by placing applications on different domains, ensuring code within one iframe cannot interfere with code in another, providing secure access and control through a unified interface.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If multiple applications are displayed in the same browser window using iframes, then a unified interface for controlling multiple applications is achieved, but code in one iframe can access and modify resources in other iframes leading to security breaches
Solution Approach 1:
The patent divides the browser window into multiple iframes, each hosting a separate application. This segmentation allows each application to run in an isolated context while still being accessible through a unified browser interface, resolving the contradiction between unified access and security isolation.
Solution Approach 2:
The patent introduces a gateway service as an intermediary between iframes and external resources. This mediator controls and filters communications, allowing legitimate access to shared resources while blocking unauthorized cross-iframe interactions, thus maintaining both unified interface functionality and security.
2Ease of operation
If all applications share the same domain, then seamless navigation and unified interface are maintained, but code isolation between applications cannot be ensured
Solution Approach 1:
The patent moves the isolation mechanism from the domain level to the iframe level within the same domain. By using iframes as the primary isolation boundary rather than relying on domain separation, the system maintains seamless navigation within the same domain while achieving code isolation through the iframe sandboxing mechanism.
3Reliability
If code isolation between iframes is implemented, then security is improved, but access to shared resources and coordinated operations become restricted
Solution Approach 1:
The gateway service acts as a controlled intermediary that manages resource access between isolated iframes. It provides a secure mechanism for applications to request and access shared resources without compromising the isolation boundaries, thus maintaining both security and resource accessibility.
Solution Approach 2:
The gateway service provides universal access control for multiple applications sharing common resources. It implements a centralized authorization mechanism that can grant or deny access based on application credentials, enabling coordinated operations while maintaining security isolation.
Data Source
AI summary
Method for web-based management of resources. On a cloud computing system, for groups of user resources, defining commonly managed subgroups. Accessing cloud-based control procedures of one subgroup using a dedicated communication channel. Control procedures reside on a server, and are visible with a single specified domain ID unique for the subgroup. Multiple domain IDs are used in one communication session. On the client, isolated windows for each domain ID contain graphical representation of local applications, and where applications of one window share local data and are connected to control procedures using the same domain ID. Managing user resources through control procedures that are controlled by the applications. Only one of the isolated windows is activated at any one time on the user's computer.