Session-Based Third-Party Resource Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing content delivery networks (CDNs) face challenges in efficiently updating third-party resources, such as library files, without disrupting user web pages or applications, due to the need for new URLs and security integrity hashes.
Innovation Solution
A new URL flow is introduced that requires an upfront, authenticated request from the integrator to provision a 'session' for using the resource, allowing the content author to respond with the latest version of the resource and its corresponding security integrity hash.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a new URL and security integrity hash are created for updated resources, then security is improved, but disruption to user web pages and applications occurs
Solution Approach 1:
The patent introduces a session-based intermediary mechanism between the content author and the requester. The session object acts as a mediator that stores both the URL and the security integrity hash, allowing the requester to access updated resources without directly managing multiple URLs or hashes. This intermediary layer resolves the contradiction by centralizing the security credentials while maintaining backward compatibility with existing URL references.
Solution Approach 2:
The patent implements dynamic resource resolution where the same URL can point to different resource versions depending on the active session. The system dynamically updates the resource reference based on session state, allowing security hashes to be updated without changing the visible URL in user applications. This dynamic behavior resolves the contradiction by making the security layer flexible while keeping the user interface stable.
2Ease of operation
If the prior URL is maintained for backward compatibility, then ease of operation is improved, but security verification becomes complex
Solution Approach 1:
The patent segments the security verification process into separate components: the URL remains stable for backward compatibility, while the security integrity hash is stored separately in the session object. This segmentation allows the URL to maintain backward compatibility while the security verification uses the updated hash from the session, resolving the contradiction between ease of operation and security verification complexity.
Solution Approach 2:
The session object serves as an intermediary that decouples the URL from the security hash. The URL can remain unchanged for backward compatibility, while the session stores the current security hash. This intermediary layer simplifies security verification by providing a single source of truth for the current hash without requiring changes to the URL structure.
3Productivity
If resource updates are implemented quickly, then productivity is improved, but security integrity cannot be verified
Solution Approach 1:
The patent implements preliminary action by requiring the content author to explicitly create a session and provide both the URL and security integrity hash before the resource can be accessed. This preliminary session creation ensures that security integrity is verified before any resource update occurs, resolving the contradiction by making security verification a prerequisite rather than an afterthought.
Solution Approach 2:
The system provides feedback to the requester by returning the security integrity hash along with the URL in the session response. This feedback mechanism ensures that the requester receives accurate security information with each resource update, allowing quick updates while maintaining security integrity verification through the feedback loop.
Data Source
AI summary
A system for providing updatable secure content resource. A content server may pay a content resource on the content author for an access by a requester. The content server receives a session request call from the requester prior to accessing the content resource. In response to the session request, the content server generates a session for the requester. The content server generates a payload that includes a location identifying the content resource on the content author and embeds the embedded cryptographic content. The content server transmits the generated payload to the requester. A resource server may receive an authentication access request in response to the embedded cryptographic content. In response to authenticating the authentication access request, the resource server provides the access to the requester.