Cross-Domain Access Control via Client-Side Permission Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security standards for providing services over the Internet lack flexibility in controlling cross-domain access, making it difficult for service providers to manage permissions for services across different domains, especially when enforcing security restrictions on client computer systems without introducing compatibility issues or increasing bandwidth usage.
Innovation Solution
A system and method that utilize cross-domain files to specify permissions for services, allowing programs to access files or socket connections based on domain-specific or default settings, with enforcement occurring on the client computer system, ensuring secure and controlled access while minimizing bandwidth impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cross domain access is prohibited to maintain security, then system security is improved, but service flexibility and accessibility are worsened
Solution Approach 1:
The patent introduces a permission file as an intermediary mechanism that mediates between security requirements and cross-domain service needs. The permission file contains domain information and permission settings that act as a bridge, allowing the system to enforce security policies while enabling authorized cross-domain access without direct trust between domains.
Solution Approach 2:
The patent segments the permission control into discrete permission files that can be independently configured for different domains and services. Each permission file contains specific domain identifiers and permission settings, allowing fine-grained control over which domains can access which services, rather than applying blanket security restrictions.
2Reliability
If permission enforcement is implemented on server systems, then access control is improved, but bandwidth consumption and system complexity are worsened
Solution Approach 1:
The patent implements preliminary action by pre-configuring permission files on client systems before access requests are made. The permission information is stored locally on the client, eliminating the need for repeated server queries during access control decisions. This reduces bandwidth consumption by avoiding continuous server-client communication for permission verification.
Solution Approach 2:
The client system performs self-service by locally storing and enforcing permission policies without requiring continuous server intervention. The client autonomously checks permission files against access requests, reducing the computational and bandwidth burden on server systems while maintaining access control integrity.
3Reliability
If multiple permission enforcement mechanisms are used on different server systems, then comprehensive access control is improved, but compatibility issues are worsened
Solution Approach 1:
The patent creates a universal permission file format that can be used across different domains and service types. The standardized structure with domain information and permission settings allows the same mechanism to enforce access control across diverse systems and protocols, ensuring compatibility while providing comprehensive coverage.
Solution Approach 2:
The patent applies homogeneity by using a consistent permission file structure and enforcement mechanism across all client systems, regardless of the underlying server architecture. This uniform approach ensures that permission files created for one domain can be universally interpreted and enforced by any compliant client system, eliminating compatibility issues between different enforcement mechanisms.
Data Source
AI summary
A system and method provides a service, such as complete access to a file or a socket request, in response to a file describing permissions for individual or multiple domains.