Module Access Control via Exposure Declarations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional module systems fail to strictly control access to non-exposed module elements, allowing unauthorized access even through reflective APIs or accessibility override configurations.
Innovation Solution
Implementing a strict access control mechanism that prohibits access to non-exposed module elements regardless of access modifiers or override configurations, ensuring that access is only allowed if the module element has been explicitly exposed to the requesting module.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If reflective APIs or accessibility override configurations are used to access module elements, then ease of operation is improved, but access control reliability deteriorates
Solution Approach 1:
The patent applies preliminary anti-action by pre-defining module descriptors that explicitly declare which module elements are exposed to which other modules. This preliminary declaration creates a whitelist of permitted accesses, and the system proactively blocks any access attempts that do not match these declarations, even if reflective APIs or accessibility overrides are used. The access control mechanism checks each access request against the module descriptor before allowing it, preventing unauthorized access in advance.
2Ease of operation
If conventional access control mechanisms are used, then ease of operation is improved, but security deteriorates
Solution Approach 1:
The patent introduces module descriptors as an intermediary layer between modules. These descriptors act as mediators that explicitly declare the intended access relationships between modules. The access control mechanism uses these descriptors to verify whether an access request is authorized, creating a formal contract that must be satisfied before access is permitted. This intermediary structure prevents direct unauthorized access while maintaining legitimate communication channels.
3Reliability
If module descriptors with explicit dependencies are implemented, then access control reliability is improved, but device complexity increases
Solution Approach 1:
The patent applies preliminary action by requiring module descriptors to be defined and registered before modules are loaded or accessed. The module descriptors contain pre-computed information about which elements are exposed to which modules, eliminating the need for complex runtime analysis or introspection to determine access permissions. This preliminary structuring of access information simplifies the runtime access control checks while maintaining high reliability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Access to a module element within a first module by a second module is prohibited if the module element within the first module has not been exposed to the second module. If a particular module element within a first module has been exposed to a second module, then access to the particular module element by the second module may or may not be allowed depending on: (a) whether the particular module element has been declared with a public or non-public access modifier, (b) whether a second exposed module element, which includes the particular module element, has been declared with a public or non-public access modifier, (c) a level of access associated with the operation that attempts to access the particular module element of the first module, and/or (d) whether an accessibility override configuration is set for accessing the particular module element.