Sandbox Proxy for Securing Third-Party Web Modules

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Mashup web pages are vulnerable to attacks from third-party modules due to exposure of APIs, and existing browser abstractions are not feasible for security, especially with varying web browser versions.

Innovation Solution

Implementing a sandbox proxy and sandbox engine to secure hosting web pages by validating and executing third-party module API calls, creating a secure environment that blocks malicious scripts and controls communication between third-party modules and the hosting page.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If browser abstractions are used to secure hosting web pages, then access control is improved, but the solution is not feasible with varying web browser versions

Engineering Contradiction:

ImprovesecurityVSAvoidbrowser compatibility

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent introduces a sandbox proxy as an intermediary component between third-party modules and the hosting web page. This proxy validates all API calls from third-party modules before they reach the hosting page, creating a secure layer that works independently of browser versions. The intermediary approach allows security without requiring browser-specific abstractions.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If third party modules are integrated into hosting web pages, then functionality is improved, but vulnerability to attacks increases

Engineering Contradiction:

ImprovefunctionalityVSAvoidsecurity vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the execution environment by introducing a sandbox proxy that creates a controlled interface between third-party modules and the hosting web page. The proxy validates each API call individually, separating the functionality integration from the security risks. This segmentation allows third-party modules to function while preventing direct access to harmful APIs.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The sandbox proxy acts as a mediator that intercepts and validates all communication between third-party modules and the hosting web page. It ensures that only sanitized and validated API calls are permitted, maintaining functionality while blocking malicious operations.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If APIs of hosting pages are exposed to third party modules, then integration is improved, but security is worsened

Engineering Contradiction:

ImproveintegrationVSAvoidsecurity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The sandbox proxy serves as an intermediary that sits between third-party modules and the hosting page APIs. It validates each API call before it reaches the hosting page, allowing integration to proceed while maintaining security through controlled access.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The proxy performs preliminary validation of API calls before they can access hosting page APIs. By checking and sanitizing calls in advance, the system prevents malicious operations while allowing legitimate integration to proceed.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS8347352B2Method and system for securing a third party communication with a hosting web page

Publication Date: 2013.01.01 ANDREAS ACQUISITION LLC

AI summary

A method and system for securing hosting web pages from malicious third party modules. The method includes uploading a third party module to a hosting web page; validating a proxy API call received from the third party module, wherein the proxy API call includes at least a payload parameter provided by the third party module; generating an engine API call including at least the payload parameter; validating the engine API call; and executing the payload parameter if the engine API call is validated.