Scripting Engine External Function Execution Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security measures are inadequate in controlling and managing execution privileges of scripting engine functions, leading to potential vulnerabilities that can result in system exposure to threats and attacks.
Innovation Solution
Implementing an externalized representation of function execution privileges, allowing granular control over function execution by retrieving privilege indicators from external sources, such as configuration settings or repositories, to enable or disable specific functions within a scripting engine, thereby reducing exposure to vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures are used to protect against attacks, then system security is improved, but system functionality is lost due to inability to use exposed systems or applications
Solution Approach 1:
The patent segments security control to the function level within scripting engines. Instead of blocking entire scripting engines or applications, the system divides control into individual function calls, allowing selective enabling/disabling of specific functions based on security policies. This segmentation resolves the contradiction by maintaining system functionality through allowed functions while blocking only malicious ones.
Solution Approach 2:
The patent implements local quality by applying different security policies to different functions within the same scripting engine. Each function can have its own security policy configuration, allowing trusted functions to execute while blocking suspicious ones. This enables fine-grained control that preserves necessary functionality while maintaining security.
2Object-affected harmful factors
If scripting engine functions are restricted to improve security, then vulnerability exposure is reduced, but execution flexibility is decreased
Solution Approach 1:
The patent implements dynamic security policy configuration that can be adjusted without modifying the scripting engine code. Security policies are stored externally and can be modified at runtime, allowing the system to adapt to new threats while maintaining execution flexibility for approved functions. This dynamic approach resolves the contradiction by enabling security restrictions without permanently limiting functionality.
Solution Approach 2:
The patent creates a universal security policy mechanism that works across different scripting engines and applications. The same policy framework can control multiple functions with different security requirements, providing both vulnerability protection and execution flexibility through a single adaptable system.
3Measurement precision
If granular function control is implemented, then security precision is improved, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary security policy layer between the scripting engine and function execution. This mediator component handles the complexity of granular control by intercepting function calls, checking policies, and making allow/deny decisions. The intermediary absorbs the system complexity while providing precise security control, resolving the contradiction between precision and complexity.
Solution Approach 2:
The patent uses external policy configurations that can be copied and reused across different scripting engines and applications. Instead of implementing complex control logic in each system, standardized policy templates are copied and adapted, reducing overall system complexity while maintaining granular security precision.
Data Source
AI summary
Various embodiments include at least one of systems, methods, software, and data structures to evaluate function calls within a host, such as a scripting or application programming interface (API) host, prior to execution. Such embodiments may determine if a called function is authorized for execution. When the function is not authorized for execution, the function is not executed. Authorized and unauthorized functions may be set in a representation including one or both of authorized and unauthorized function functions. The representation may be stored external to the host so as to be modifiable.