Entity Identifier Access Control for Web Browser Resources

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing systems for data distribution over networks lack granular control over access to resources by entities within execution extension environments, such as web browsers, leading to security and privacy issues due to exposure to malicious code.

Innovation Solution

Implementing a policy set that includes a principal identifier, resource identifier, and access rights, with an entity identifier, to manage access rights at a finer granularity, allowing for differentiated access control between entities within the same execution environment, such as web sites, using 3-tuples like {Principal, Right, Resource}.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a browser is authorized to access particular resources on a mobile computing device, then the user experience is enhanced, but security and privacy risks increase due to potential malicious code

Engineering Contradiction:

Improveuser experienceVSAvoidsecurity and privacy risks

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments access control at multiple levels: application level (browser), entity level (web page), and resource level (device resource). This segmentation allows the system to grant access to resources at different granularities, enabling enhanced user experience while maintaining security through fine-grained control. The access control policy is divided into principal identifiers, entity identifiers, and resource identifiers that can be independently managed.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements local quality by allowing different entities within the same execution environment to have different access rights to resources. Instead of uniform access control, the system provides differentiated access policies for different web pages or entities, enabling selective resource access that enhances user experience for trusted entities while protecting against malicious code.

Inventive Principle:

Principle #3Local quality

2Reliability

If existing access policy rules are used to control access by application programs, then access control is provided, but granular control over entities within execution extension environments is lacking

Engineering Contradiction:

Improveaccess controlVSAvoidaccess control granularity

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The patent segments the access control mechanism into distinct components: principal identifier (for execution environment), entity identifier (for hosted entity), and resource identifier (for device resource). This segmentation enables precise measurement and control of access at multiple granularities, resolving the contradiction between providing access control and achieving fine-grained measurement precision.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent adds another dimension to access control by introducing entity identifier as an intermediate layer between the execution environment and device resources. This dimensional addition transforms the access control model from binary (allow/deny at application level) to multi-level (application level, entity level, resource level), enabling both reliable access control and precise granular measurement.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

3Adaptability or versatility

If web pages can access device resources through the browser, then functionality is enhanced, but discrimination between different web sites is lost

Engineering Contradiction:

ImprovefunctionalityVSAvoiddiscrimination capability

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

The patent implements local quality by enabling differentiated access control for different web sites and entities. Each entity can have its own access rights defined in the access control policy, allowing the system to distinguish between trusted and untrusted entities. This enables enhanced functionality for authorized web sites while maintaining discrimination capability through entity-specific policies.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent introduces an intermediary access control policy layer that mediates between web pages and device resources. This intermediary layer evaluates entity identifiers against defined policies before granting access, enabling the system to maintain discrimination between different web sites while still allowing authorized functionality to proceed.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS8943208B2Controlling access to resources by hosted entities

Publication Date: 2015.01.27 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Controlling resource access by entities hosted by an execution extension environment via entity identifiers associated with the resources or with the execution extension environment. Policy sets define the access to the resources. Each policy set includes a principal identifier for execution extension environment, a resource identifier for one of the resources, and access rights. The principal identifier or the resource identifier includes one of the entity identifiers. Access requests from entities are evaluated by comparing the entity identifiers to the policy sets. In some embodiments, the policy sets implement access control for web browsers hosting executable code that attempts to access resources on a computing device.