Secure Aggregated Web Application Runtime Environment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Aggregated web applications face challenges in maintaining both security and functionality due to the lack of absolute trust between different domains, often resulting in sacrificing either security or functionality when integrating external APIs.
Innovation Solution
The aggregated web application runtime environment controls access to resources based on the originating domain of program fragments by appending an access attribute to the Document Object Model (DOM) node, associating it with access rights definitions that define specific access rights for different domains, allowing granular control over read, write, and execute permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an external web application is imported into an aggregated web application to create new functionality, then the functionality of the aggregated web application is improved, but the security of the aggregated web application deteriorates because the external application gains full access to all resources
Solution Approach 1:
The patent applies local quality by assigning different access rights to different DOM nodes based on their security sensitivity. Each DOM node is evaluated individually and granted only the minimum necessary access rights for its specific function, rather than providing uniform full access to all nodes. This allows the external web application to access specific resources it needs while preventing access to sensitive information, thus resolving the contradiction between functionality and security.
Solution Approach 2:
The patent segments the resource access control into granular permission levels (read, write, execute) that can be independently assigned to different DOM nodes. This segmentation allows the system to provide precise control over what the external web application can access, enabling functionality where needed while maintaining security where required, thereby resolving the contradiction between adaptability and reliability.
2Adaptability or versatility
If full access rights are granted to an external web application to ensure functionality, then the adaptability of the aggregated web application is improved, but the harmful factors generated by the external application increase
Solution Approach 1:
The system evaluates each DOM node's security sensitivity locally and assigns access rights accordingly. Non-sensitive nodes receive full access to enable functionality, while sensitive nodes receive restricted or no access, thereby reducing security risks while maintaining adaptability.
Solution Approach 2:
The patent introduces an intermediary security mechanism that mediates between the external web application and the DOM nodes. This intermediary evaluates security sensitivity and enforces access control policies, allowing the external application to function while preventing it from generating harmful effects by accessing sensitive information.
3Reliability
If access control restrictions are imposed on program fragments from different domains to maintain security, then the reliability of the aggregated web application is improved, but the ease of operation deteriorates due to complex access management
Solution Approach 1:
The system implements self-service by automatically evaluating the security sensitivity of each DOM node and assigning appropriate access rights without requiring manual configuration. The runtime environment autonomously manages access control based on predefined security policies, reducing the operational burden while maintaining security.
Solution Approach 2:
The patent applies preliminary action by pre-defining security sensitivity levels and access control policies before the external web application executes. The system evaluates and assigns access rights in advance based on the DOM node's inherent security characteristics, simplifying access management during runtime while ensuring security.
Data Source
AI summary
A web browser client includes an aggregated web application runtime environment that controls access by a program fragment of an aggregated web application to a resource therein based upon the originating domain of the program fragment. To do so, the aggregated web application runtime environment appends an access attribute to the Document Object Model (DOM) node associated with the resource. This access attribute is associated with a plurality of access rights definitions where each access rights definition defines a set of access rights to the resource for program fragments originating from a domain with a specific access rights status. Accordingly, the aggregated web application runtime environment sets one or more access rights statuses of the originating domain of the program fragment, and thereafter, grants or denies the program fragment access to the resource based upon one or more sets of access rights defined for that program fragment.