Virtual iFrame Containment Enclosure for Browser Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Websites face challenges in controlling and restricting the access of third-party computer code, which can lead to malicious activities such as data theft, ad replacement, and user tracking, due to the unrestricted access provided by HTML and JavaScript, necessitating a system to enforce permissions and limit third-party activity.
Innovation Solution
The VICE system employs a combination of techniques including Enclosure iFrames, Reflection, DOM functionality overriding, Policy-Center, Evasion, and CORS-Proxy to limit third-party code access, allowing for real-time enforcement of policies without disrupting the third-party's algorithm, and provides tools for monitoring and reporting suspicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If third-party code is allowed to execute freely in a website, then the website can provide services such as ad-serving, analytics, and social media functionalities, but the website becomes vulnerable to malicious activities including data theft, ad replacement, and user tracking
Solution Approach 1:
The patent divides the execution environment into separate segments: the main website context and sandboxed iframes. Third-party code executes in isolated iframe contexts that are segmented from the main document, preventing direct access to website resources while allowing controlled communication through postMessage APIs. This segmentation resolves the contradiction by enabling third-party functionality while containing potential malicious effects within isolated segments.
Solution Approach 2:
The patent introduces intermediary mechanisms including the VICE proxy server and message forwarding services that mediate between third-party code and website resources. Instead of direct access, third-party code communicates through controlled intermediaries that enforce security policies, filter malicious content, and manage data flow. This intermediary layer enables functionality while blocking harmful activities.
2Reliability
If the website restricts access to resources for third-party code, then security is improved, but the third-party code cannot perform its intended functions such as ad-serving and analytics
Solution Approach 1:
The patent implements local quality by applying different access permissions to different resources and different third-party contexts. Instead of uniform restriction or access, the system configures specific permissions for each iframe and resource type, allowing third-party code to access only the specific resources it needs for its function while blocking access to sensitive website resources. This resolves the contradiction by providing targeted access control.
Solution Approach 2:
The patent introduces dynamic permission management where access rights are not static but can be adjusted based on the third-party's behavior, the specific resource being accessed, and security policies. The system can dynamically grant or revoke permissions during execution, allowing flexibility in enabling functionality while maintaining security. This dynamic approach resolves the contradiction by adapting access control to specific operational needs.
3Ease of manufacture
If third-party code is executed without restrictions, then implementation is simple, but the website administrator cannot control or monitor third-party activities
Solution Approach 1:
The patent implements a universal permission enforcement framework that handles multiple third-party services, resource types, and security policies through a single standardized system. The VICE proxy and iframe sandboxing mechanism provide multi-functional capabilities including access control, content filtering, message routing, and monitoring all through one unified architecture. This universal approach manages complexity by providing a single enforcement point rather than separate controls for each third-party service.
Solution Approach 2:
The patent incorporates feedback mechanisms where the permission enforcement system monitors third-party code execution, tracks resource access patterns, and reports suspicious activities to the website administrator. The system provides real-time feedback on third-party behavior, enabling administrators to adjust permissions and respond to security events. This feedback loop manages complexity by automating monitoring and control rather than requiring manual configuration for each scenario.
Data Source
AI summary
Computer system, methods, and non-transitory storage medium for protecting a client device that is browsing a website from undesired actions of third-party software. Virtual iFrame Containment Enclosure (VICE) code (e.g. JavaScript/WebAssembly) is tailored per website that defines a set of policies of what each third-party code can and cannot do. The server also tracks and analyzes data reports from the websites, and provides reports and alerts to website administrators. Therefore, a browser on a client device visiting the website, and thus executing the VICE code that is tailored for that specific website, is protected from the third-party code, without hindering the proper action of the third-party software and without the third-party knowing that their code was monitored and controlled. Third-party activity can be monitored by the system via the combination of functionality for or more of the following: Enclosure iFrame; Reflection; DOM functionality overriding; Instrumentation; Policy-Center; Evasion; and CORS-Proxy.