Hot-Patched Upload Validation for Dynamic Web Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users often violate computer-usage rules when interacting with websites or cloud services, such as uploading sensitive files or entering credentials on phishing sites, due to difficulty in enforcing organizational policies.
Innovation Solution
Deploying a hot-patched method in a software application's method library to intercept file upload requests, analyze them against predefined policies, and control the upload process based on compliance with these policies, using auxiliary code to enforce computer-usage rules through user interactions and modifications to web content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional policy enforcement methods are used, then policy compliance can be monitored, but users can still violate policies when interacting with dynamically rendered webpages
Solution Approach 1:
The patent applies preliminary action by injecting auxiliary code into webpages before users can interact with them. The code is inserted into the HTML document during the loading process, establishing control over subsequent user actions before violations can occur. This allows the system to preemptively monitor and control file upload requests and other policy-relevant interactions.
Solution Approach 2:
The patent uses an intermediary approach by introducing auxiliary code as a mediator between the user and the webpage functionality. This auxiliary code acts as an intermediate layer that intercepts user actions, analyzes them against organizational policies, and controls execution accordingly. The intermediary code enables policy enforcement without directly modifying user behavior or webpage structure.
2Reliability
If auxiliary code is injected into webpages to enforce policies, then policy compliance improves, but system complexity increases
Solution Approach 1:
The patent applies universality by designing auxiliary code that performs multiple functions within a single implementation. The injected code simultaneously monitors user interactions, analyzes uploaded files against policies, controls webpage functionality, and enforces organizational rules. This multi-functional approach reduces the need for separate specialized components, thereby managing system complexity while maintaining comprehensive policy enforcement.
Solution Approach 2:
The patent implements self-service by enabling the auxiliary code to autonomously perform policy enforcement tasks without requiring constant external intervention. The injected code independently analyzes file uploads, determines policy violations, and controls webpage elements according to organizational policies. This self-contained approach simplifies the overall system architecture by eliminating the need for complex external monitoring and control mechanisms.
3Reliability
If file upload requests are intercepted and analyzed, then unauthorized uploads are prevented, but processing time increases
Solution Approach 1:
The patent applies partial action by selectively analyzing only those file upload requests that are relevant to organizational policies, rather than examining every single upload operation. The auxiliary code intercepts upload requests and applies policy analysis only when necessary conditions are met, such as when the upload targets restricted file types or exceeds size limits. This selective approach reduces unnecessary processing overhead while maintaining security.
Solution Approach 2:
The patent implements skipping by enabling rapid processing of routine upload requests that clearly comply with policies. The auxiliary code is designed to quickly evaluate and approve standard uploads without extensive analysis, only applying thorough inspection when policy violations are suspected. This allows legitimate uploads to proceed with minimal delay while maintaining security scrutiny where needed.
Data Source
AI summary
Methods, storage systems and computer program products implement embodiments of the present invention that include deploying, to a computer, a hot-patched method for an original method in a method library that is dynamically loaded by a software application running on the computer, wherein the hot-patched method is configured to intercept requests from the software application to the original method. An upload policy can then be specified. Upon the hot-patched method intercepting a request from the software application to the original method to upload a given file from the computer to an Internet site, a comparison can be made between the intercepted request to the policy. In response to the comparison, the upload can be controlled.