Plugin Control via Shared Library Injection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing software platforms lack effective mechanisms to control the execution of application extensions, leading to security risks as malicious actors can exploit vulnerabilities in plugins, and existing OS application control functions are limited in managing script files used by third-party applications.

Innovation Solution

A shared library is injected into pluggable applications to detect file processing calls and interact with OS application control functions like AppLocker to conditionally allow or prevent the execution of extension files, using a set of rules to determine if the call involves an extension file.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If plugins are allowed to extend application functionality, then application versatility is improved, but security risks increase due to malicious actors exploiting plugin vulnerabilities

Engineering Contradiction:

Improveapplication functionality extensionVSAvoidsecurity risks from malicious plugins

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces an intermediary component (the injected shared library) that sits between the application and the plugins. This intermediary monitors file processing calls, evaluates them against security rules, and selectively blocks or allows plugin execution. This resolves the contradiction by maintaining plugin versatility while adding a security layer that prevents malicious exploitation.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary evaluation of plugin file processing calls before actual execution occurs. By injecting the shared library that intercepts and evaluates file processing calls against a set of rules beforehand, the system prevents malicious plugins from executing harmful code while still allowing legitimate plugins to function, thus maintaining versatility while reducing security risks.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If OS application control functions are used to manage extension files, then security control is improved, but existing OS controls are insufficient for managing third-party application script files

Engineering Contradiction:

Improvesecurity control over extensionsVSAvoidcompatibility with third-party applications

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent creates a universal control mechanism that works across multiple third-party applications (Chrome, Firefox, Visual Studio Code, etc.) by injecting a shared library that interfaces with existing OS controls like AppLocker. This multi-functional approach allows the same security mechanism to manage extension files across different applications, improving both security control and compatibility without requiring application-specific modifications.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The injected shared library acts as an intermediary that bridges existing OS application control functions and third-party application extension files. It translates and adapts OS-level controls to work with various plugin architectures, making existing security controls applicable to third-party applications that previously lacked such management capabilities.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If application control mechanisms are implemented, then security management is improved, but application transparency and ease of operation may be reduced

Engineering Contradiction:

Improvesecurity management of pluginsVSAvoidapplication transparency

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system implements self-service security management by automatically injecting the shared library into applications and having it autonomously monitor and evaluate file processing calls against security rules. This automatic operation maintains application transparency for users while providing robust security management, as the control mechanism operates in the background without requiring user intervention or visible changes to application behavior.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12190129B2Control over application plugins

Publication Date: 2025.01.07 CITRIX SYSTEMS INC

AI summary

A system and method for implementing a plugin control mechanism. A disclosed method includes: launching an application; injecting additional functionality into the application; and utilizing the additional functionality to: detect a file processing call; evaluate the file processing call against to a set of rules to determine whether the file processing call involves execution of an extension file; and call an operating system (OS) application control function in response to determining the file processing call involves execution of the extension file, wherein the OS application control function is configured to conditionally prevent execution of the extension file.