Third Party Program Integrity Control in Web Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web sites face security concerns when integrating third-party web applications, as untrustworthy applications can compromise site and user device security, leading to vulnerabilities and the avoidance of desirable functionality due to trustworthiness guarantees being unmet by resource-constrained providers.
Innovation Solution
A monitoring and integration control system using a redirect mechanism that periodically analyzes third-party applications, detects changes, and alerts for review, denying access if not approved, ensuring only approved versions are accessed through HTTP requests with integrity checks and automated or user reviews.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If third-party web applications are integrated into a web site, then functionality and user experience are improved, but security vulnerabilities increase due to untrustworthy applications
Solution Approach 1:
The patent introduces a resource control service as an intermediary component between the web site and third-party web applications. This service acts as a gatekeeper that receives requests for third-party applications, performs integrity checks, and controls access by redirecting approved applications while blocking unapproved ones. The intermediary resolves the contradiction by enabling functionality integration while maintaining security control through its mediation role.
Solution Approach 2:
The system performs preliminary integrity checks and approval processes before allowing third-party applications to be accessed. The resource control service proactively fetches, analyzes, and approves web applications in advance, maintaining a list of approved applications. This preliminary action ensures that only trustworthy applications are integrated, preventing security vulnerabilities before they can affect the web site.
2Reliability
If security checks are performed on all third-party web applications, then security is improved, but system complexity and processing overhead increase
Solution Approach 1:
The patent extracts the security checking functionality into a separate, dedicated resource control service component. This extraction isolates the complexity of security checks from the main web site system, allowing the core web site to remain simple while the specialized service handles all security-related operations. The separated service manages integrity checks, approval workflows, and access control without complicating the overall web site architecture.
3Productivity
If resource-constrained third-party providers are allowed to publish applications, then application availability increases, but trustworthiness guarantees cannot be ensured
Solution Approach 1:
The resource control service implements an automated self-service system that independently fetches, analyzes, and evaluates third-party web applications without requiring manual intervention from resource-constrained providers. The service automatically performs integrity checks, determines approval status, and controls access. This self-service approach enables broad application availability from various providers while maintaining consistent trustworthiness verification through automated processes.
Data Source
AI summary
Disclosed herein are a resource control service, system, method and architecture. A client device's resource access is limited to an approved resource, or resources. A request for a resource is directed to a resource control service that determines whether or not to grant access to the requested resource. Where a determination is made to grant access to the resource, a response is transmitted to the client device, the response redirecting the client device to a second URI for the approved version of the requested resource. The response can be used by the client device request the resource from the location identified in the response.