Web Proxy Process Isolation for Secure Resource Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security mechanisms that isolate untrusted web resources often inhibit legitimate access, failing to differentiate between user-initiated and programmatic access, thus posing a risk of denying access to trusted content while exposing devices to malicious content.
Innovation Solution
A computer system with a web proxy running in the address space of a process, capable of selectively allowing or denying access to web resources based on connection origin and context information, providing controlled access while isolating untrusted content in a sandbox.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If isolation mechanisms (blacklists and whitelists) are used to protect from malicious content, then security protection is improved, but legitimate access to web resources is denied
Solution Approach 1:
The patent segments web requests into different categories based on their origin: user-initiated requests are separated from programmatic requests. This segmentation allows differential handling where user requests can access web resources while programmatic requests are restricted, thereby maintaining security without blocking legitimate user access.
Solution Approach 2:
The patent introduces an intermediary mechanism (the web proxy with process identification capability) that sits between the process and web resources. This intermediary examines the origin of web requests and selectively permits or blocks access based on whether the request is user-initiated or programmatic, thus mediating between security requirements and legitimate access needs.
2Reliability
If access control mechanisms are implemented to block malicious content, then security is improved, but differentiation between user-initiated and programmatic access is lost
Solution Approach 1:
The patent replaces traditional mechanical blacklist/whitelist filtering mechanisms with a more sophisticated system that uses process identification and origin tracking. Instead of simply blocking based on URL patterns, the system substitutes a mechanism that identifies the originating process and distinguishes between user-initiated and programmatic requests through process state analysis.
Solution Approach 2:
The patent changes the parameter used for access control from static URL-based filtering to dynamic process-origin-based filtering. By changing the controlling parameter from what is being accessed (URL) to where the request comes from (process origin and type), the system achieves precise differentiation between legitimate user access and potentially malicious programmatic access.
3Ease of operation
If isolation mechanisms are relaxed to allow web resource access, then ease of operation is improved, but exposure to malicious content increases
Solution Approach 1:
The patent implements dynamic access control where the permission level changes based on the request origin. User-initiated requests dynamically receive access permission while programmatic requests are dynamically blocked. This dynamic approach allows the system to be permissive when safe (user access) and restrictive when dangerous (programmatic access), optimizing both ease of operation and security.
Solution Approach 2:
The patent applies different security qualities to different types of requests rather than applying a uniform security policy. User-initiated requests are granted local quality of trust and access, while programmatic requests are granted local quality of restriction. This localized differentiation of security attributes allows legitimate access while maintaining protection against malicious content.
Data Source
AI summary
Web resources are accessible by a process on a computer device. Access to the web resources is controlled by a web proxy running in an address space of the process. The web proxy receives a web request for a web resource from the process. The web proxy examines the web request for the web resource and selectively allows or denies access to the web resource. If the web request for the web resource is allowed, the web proxy arranges access to the web resource, for example, directly via an operating system of the computer device or via a registered web proxy.