Sandbox Validator and Module Integrator for Secure Third-Party Code Integration

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Hotel entertainment systems face challenges in allowing third-party vendors to add custom features securely and efficiently, as existing sandboxing techniques either impede functionality sharing or introduce stability and security risks due to incomplete translation and verification processes.

Innovation Solution

A system that includes a sandbox validator to verify modules comply with sandbox constraints, preventing access to global variables and external information, and a module integrator that authorizes access to services based on a service authorization table, ensuring secure and controlled integration of third-party code.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If third-party vendors are allowed to directly modify or add new features to the system, then customization options and functionality are improved, but system stability and security deteriorate due to potential bugs and unauthorized access

Engineering Contradiction:

Improvecustomization optionsVSAvoidsystem stability

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system is segmented into isolated modules, each with defined boundaries and controlled access. Third-party code is divided into separate modules that cannot interfere with core system functions, allowing customization while maintaining stability through structural separation

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

An intermediary layer (module integrator and sandbox validator) is introduced between third-party code and the core system. This intermediary controls and filters access, allowing beneficial customizations while blocking harmful operations that would compromise system stability

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If third-party code is executed with unlimited access to system functions, then functionality and integration capabilities are improved, but security deteriorates due to potential data breaches and content protection violations

Engineering Contradiction:

Improveintegration capabilitiesVSAvoidsecurity risks

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

Different access rights and security levels are assigned to different modules based on their specific needs and trust levels. Third-party modules receive only the specific permissions they require for their function, rather than universal access, enabling integration while minimizing security exposure

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

Security validation and authorization checks are performed in advance before third-party code executes. The sandbox validator verifies module integrity and the integrator pre-establishes access rules, preventing security breaches before they can occur rather than reacting to them

Inventive Principle:

Principle #10Preliminary action

3Object-affected harmful factors

If existing sandboxing techniques are used to isolate third-party code, then security is improved, but functionality sharing and service access deteriorate due to overly restrictive constraints

Engineering Contradiction:

Improvesecurity protectionVSAvoidfunctionality sharing

Core Design Contradiction:

Object-affected harmful factorsVSAdaptability or versatility

Solution Approach 1:

The sandbox constraints are made dynamic rather than static. Access permissions are adjusted in real-time based on the specific service being accessed and the module's authorization level, allowing security protection while enabling necessary functionality sharing through flexible, context-dependent permission granting

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS9848002B2Allowing first module of computer code to make use of service provided by second module while ensuring security of system

Publication Date: 2017.12.19 GUEST TEK INTERACTIVE ENTERTAINMENT

AI summary

A system for integrating modules of computer code may include a sandbox validator for receiving a first module and verifying that the first module complies with one or more sandbox constraints. A computing device may execute the first module within a runtime environment. A module integrator may operate within the runtime environment for receiving a request from the first module to access a service provided by a second module and only allowing the first module to access the service when the first module is authorized to access the service according to a service authorization table. The sandbox validator may ensure the first module correctly identifies itself when requesting a service provide by another module and that the first module includes runtime policing functions for non-deterministic operations. A service authorizer may generate an authorization policy for the first module, which is sent to the computing device along with the first module.