Resource-Based Dynamic Security Authorization for Sandboxed Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security restrictions in Internet browsers are overly restrictive, preventing legitimate actions between domains owned by the same company, even though they pose no increased threat to the user, due to static security policies that do not allow cross-domain scripting.
Innovation Solution
Implementing a resource-based security system for dynamic authorization, where sandboxed code can access resources based on evidence of authenticity and policy statements, allowing domains owned by the same company to script each other, and enabling domains to affirmatively grant access to sandboxed applications from other companies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static security policies are implemented to prevent malicious code, then user security is improved, but legitimate cross-domain resource access is blocked
Solution Approach 1:
The patent transitions from static security policies to dynamic authorization mechanisms. The system evaluates resource access requests in real-time based on the specific resource being accessed and the sandboxed code's credentials, rather than applying blanket restrictions. This dynamic approach allows the security system to adapt to each access attempt individually, granting permission when safe and blocking when risky.
Solution Approach 2:
The patent implements resource-based authorization where each resource can have its own access policy and credentials. Instead of a uniform security policy across all resources, the system evaluates access requests on a per-resource basis. Each resource owner can specify which sandboxed code is authorized to access their resource, creating localized security decisions that balance security with legitimate access needs.
2Object-affected harmful factors
If blanket security restrictions are applied to all code from unknown sources, then protection against malicious code is improved, but resource access efficiency deteriorates
Solution Approach 1:
The patent implements a system where resource owners themselves control access to their resources by specifying credentials and authorized sandboxed code. Rather than relying on centralized blanket restrictions, each resource owner can independently manage their own access policies. This self-service approach reduces unnecessary blocking of legitimate access while maintaining security through owner-controlled policies.
Solution Approach 2:
The system dynamically evaluates each resource access request by checking the sandboxed code's credentials against the specific resource's authorization requirements. This dynamic evaluation process replaces static blanket restrictions, allowing efficient access when credentials match while maintaining protection when they don't, thereby improving overall resource access efficiency.
3Reliability
If static client security policy is used to ensure user safety, then security assurance is improved, but flexibility in allowing legitimate actions deteriorates
Solution Approach 1:
The patent changes the parameters of security decision-making from fixed static policies to dynamic parameters based on resource identity and sandboxed code credentials. The authorization decision depends on specific parameters such as the resource being accessed, the credentials of that resource, and the credentials of the sandboxed code making the request. This parameter-based approach maintains security assurance while providing flexibility for legitimate actions.
Solution Approach 2:
The system replaces static client security policy with dynamic resource-based authorization. Instead of predetermined rules that apply universally, the system makes authorization decisions dynamically based on the specific context of each access request. This dynamic approach ensures user safety through careful evaluation while allowing flexibility for legitimate cross-domain actions when authorization criteria are met.
Data Source
AI summary
Access to a resource by sandboxed code is dynamically authorized by a client security system based on a resource based policy. A sandboxed application running on a client is granted access to a resource based on a resource based policy despite denial of the access based on a static policy associated with the client security system. The granting of access coincides with the determination that the threat to a user or the user's information is not increased should the access be granted.