Browser Plug-in Application Isolation via Hidden Instance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
When non-first party components are used in applications hosted by plug-ins, such as Microsoft Silverlight, there is a risk of the hosted application altering the user interface or accessing sensitive data unless specifically designed for, which compromises security and control.
Innovation Solution
Implementing an isolation model where the host application instances a separate, hidden plug-in instance unknown to the browser, using a tag element like XapHost to isolate the hosted application, preventing access to host or other applications' data while allowing rendering and privileged operations within a controlled user interface area.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a plug-in hosts a third-party application, then the application can provide desired functionality and componentization benefits, but the hosted application may alter user interface code or access sensitive data compromising security
Solution Approach 1:
The system segments the plug-in architecture by introducing a host element that creates distinct isolation boundaries between the hosting application and hosted applications. This segmentation allows multiple third-party applications to be hosted simultaneously while preventing them from accessing each other's data or the host application's sensitive information, thus maintaining security while enabling componentization.
Solution Approach 2:
The host element acts as an intermediary between the hosting application and hosted applications. It mediates access by providing a controlled interface that allows hosted applications to render content and perform privileged operations only within their designated rendering areas, preventing unauthorized access to user interface code and sensitive data.
2Reliability
If the hosted application is completely isolated, then security is improved, but the hosted application cannot access necessary resources or perform privileged operations
Solution Approach 1:
The system applies local quality by providing different access levels to different hosted applications based on their specific needs. The host element allows privileged operations such as opening browser windows or accessing keyboard input only when explicitly permitted for specific hosted applications, rather than applying uniform isolation to all hosted applications. This enables necessary functionality while maintaining security through targeted, localized access permissions.
3Adaptability or versatility
If the hosted application can access host application data, then integration and functionality are improved, but the trust boundary is compromised and security control is lost
Solution Approach 1:
The host element serves as an intermediary that enables controlled integration between the hosting application and hosted applications. It allows hosted applications to access necessary resources and perform privileged operations through a defined interface, maintaining the trust boundary by preventing direct access to sensitive data while still enabling functional integration where needed.
Solution Approach 2:
The system changes the parameter of data accessibility by introducing a controlled access model. Instead of allowing complete access or complete isolation, the host element modifies the access parameters to permit specific operations (such as rendering content, opening browser windows, or accessing keyboard input) only within defined constraints and rendering areas, thus enabling integration without compromising the trust boundary.
Data Source
AI summary
Described is a technology in which one application running in a browser can host another application (e.g., an advertisement) in an isolated manner that prevents the hosted application from accessing browser data, or data of any other hosted application (including the host). The host and/or hosted application may be a browser plug-in (e.g., Microsoft® Silverlight™) application. The host application privately instantiates a hidden plug-in, with that hidden plug-in's access to browser data disabled, and loads the hosted application in the hidden plug-in. A XAML tag element may be used to identify the hosted application, along with a rendering area for the hosted application. Content from the hosted application is composited with content from the host application when rendering. The host application may provide keywords to the hosted application, such as for selecting relevant advertisements, and/or may allow the hosted application to open a browser window to display associated website content.