Secure Expandable Advertisements via API and Cross-Domain IFRAMEs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current implementations of expandable advertisements pose security risks and scalability issues for content publishers due to cross-domain communication challenges, as they either expose the publisher's system to third-party logic or compromise security by hosting 'frame buster' files.
Innovation Solution
Implementing expandable advertisements using an IFRAME that references a third-party HTML document and expanding the displayable area via an API call, thereby isolating third-party logic from the content publisher's system and reducing security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If expandable advertisements use cross-domain communication to enable advertisement expansion, then the advertisement functionality is improved, but the content publisher's system security is compromised
Solution Approach 1:
The patent introduces a message queue as an intermediary component that sits between the advertisement rendering system and the parent page system. This message queue receives expansion requests, validates them against security policies, and only permits communication if the publisher's domain is authorized to receive messages from the advertisement's domain. This mediator resolves the contradiction by enabling necessary cross-domain communication while blocking unauthorized access vectors.
Solution Approach 2:
The patent segments the system into distinct security zones: the advertisement rendering system, the message queue, and the parent page system. By dividing the communication path into separate, controllable segments with defined interfaces, the system enables advertisement expansion functionality while isolating the publisher's system from direct exposure to third-party advertisement code. Each segment enforces its own security policies independently.
2Object-affected harmful factors
If the content publisher hosts 'frame buster' files to prevent unauthorized access, then system security is improved, but the scalability and ease of implementation deteriorate
Solution Approach 1:
The message queue performs self-service security validation by automatically checking domain authorization policies against incoming expansion requests. Rather than requiring the publisher to manually implement and maintain complex frame buster logic, the system autonomously evaluates security conditions and permits or blocks communication based on pre-configured policies. This reduces implementation complexity while maintaining strong security.
Solution Approach 2:
The message queue serves multiple functions simultaneously: it enables cross-domain communication for advertisement expansion, enforces security policies, validates domain authorization, and manages the communication protocol. This multi-functional component replaces what would otherwise require multiple separate security mechanisms (frame busters, policy checks, communication management), thereby reducing overall system complexity.
3Ease of operation
If third-party logic is exposed to the content publisher's system to enable advertisement control, then advertisement control capability is improved, but system reliability and security are worsened
Solution Approach 1:
The patent implements a nested architecture where the advertisement rendering system is contained within an iframe, which is nested within the publisher's page. The message queue is nested between these two systems, receiving requests from the inner advertisement system and forwarding validated requests to the outer publisher system. This nesting enables advertisement control while maintaining security boundaries, as each nested layer operates with defined permissions and cannot directly access or compromise the outer layers.
Data Source
AI summary
A system to present secure expandable advertisements using an API and cross-domain communication. A content publishing system that hosts a website can implement an expandable advertisement using IFRAMEs that are expanded upon receiving an API call from a third party rich media vendor that hosts the expandable advertisement when the content publishing system and the third party media vendor are of differing domains.