Domain Context Enforcement for Script Execution Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cross domain security issues arise when scripts execute in the wrong domain, leading to potential malicious interactions, as the domain context of third-party code is often unknown, making it difficult for applications to make informed execution decisions.
Innovation Solution
An application executes scripts in the context of their original domain without navigating to a script URL, and third-party objects or code are required to provide their domain context for security-based decisions, either by passing it explicitly or through wrapping, ensuring proper domain execution and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the application navigates to a script URL to ascertain domain context, then the domain context can be determined, but the process becomes complex and time-consuming
Solution Approach 1:
The patent applies preliminary action by requiring third-party objects to provide their domain context in advance, before the application needs to make security decisions. This eliminates the need for the application to navigate to script URLs to ascertain domain context, as the information is already available when the object is instantiated or registered.
Solution Approach 2:
The patent extracts the domain context information from the third-party object itself, separating it from the application's navigation process. By requiring objects to self-identify their domain context through interfaces or attributes, the application no longer needs to perform complex navigation to determine where scripts originate from.
2Device complexity
If third-party code executes without providing domain context, then the application can maintain simplicity, but cross-domain security vulnerabilities arise
Solution Approach 1:
The patent introduces an intermediary mechanism in the form of a domain context interface or attribute that third-party objects must implement. This intermediary structure allows objects to self-identify their domain context without fundamentally changing the application's architecture, while still enabling security decisions to be made based on the provided information.
Solution Approach 2:
The patent applies preliminary anti-action by requiring domain context identification before execution, preventing malicious code from executing in wrong domains. By establishing this requirement upfront through interfaces or attributes, the system proactively blocks potential cross-domain exploits before they can occur.
3Productivity
If scripts are executed without verifying domain context, then execution speed is maintained, but malicious code can access unauthorized information
Solution Approach 1:
The patent applies preliminary action by requiring domain context verification to be performed in advance, during object instantiation or registration, rather than during script execution. This allows scripts to execute quickly once the domain context is established, while still ensuring security requirements are met before execution begins.
Data Source
AI summary
Various embodiments pertain to ascertaining domain contexts. In one embodiment, an application receives content that may contain a script (i.e. code). In this case, the domain context is ascertained and the script is executed in the context of the domain associated with the received content, rather than requiring the application or some other component to navigate to a location, such as a web location, to attempt to ascertain the domain context of the script. In another embodiment, third party objects or code are required to provide their domain context to an application in order for the application to make a security-based decision.