Access Control Module for WebGL Resource Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
WebGL and WebCL technologies, when executing native code outside browser control, can interfere with other workloads and access system memory, posing security risks due to their unhindered access to graphics processing units, leading to potential malicious attacks and resource misuse.
Innovation Solution
Implementing a sandboxer system that filters and controls access of browser-independent web page technologies like WebGL and WebCL through an access control module (ACM), which generates an access control map to restrict resource access and prevent malicious behavior, ensuring only legitimate operations are executed on the graphics processing unit.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If WebGL/WebCL code is allowed to execute native code outside browser control on the graphics processing unit, then computing speed and rendering quality are improved, but system security and resource protection are worsened
Solution Approach 1:
The patent divides the graphics processing unit's resource access into segmented, controlled portions. The access control module creates virtual address spaces and memory regions that segment the GPU resources, allowing WebGL/WebCL code to access only specific allocated regions while preventing access to other system resources. This segmentation enables secure parallel execution of multiple workloads on the same GPU.
Solution Approach 2:
The access control module acts as an intermediary between the WebGL/WebCL code and the graphics processing unit resources. It translates virtual addresses to physical addresses, filters memory access requests, and controls resource allocation. This intermediary layer allows the beneficial execution of native code while blocking harmful unauthorized accesses to system memory and resources.
2Ease of operation
If WebGL/WebCL code is allowed to access system memory without restrictions, then ease of operation is improved, but system stability and protection of other workloads are worsened
Solution Approach 1:
The patent implements local quality control by creating distinct access permissions for different memory regions and resources. Each WebGL/WebCL module is granted specific access rights to particular memory areas and GPU resources it needs, while other regions remain protected. This localized access control maintains system stability by preventing any single module from affecting unrelated system areas.
Solution Approach 2:
The access control module performs preliminary actions by pre-configuring access control lists, virtual address spaces, and memory region permissions before WebGL/WebCL code executes. These preliminary security configurations establish boundaries and restrictions in advance, preventing potential stability issues before they can occur during code execution.
3Adaptability or versatility
If browser-independent web page technology is implemented with full access rights, then functionality and versatility are improved, but vulnerability to malicious attacks is worsened
Solution Approach 1:
The patent implements dynamic access control where permissions and resource allocations can be adjusted during runtime based on trust levels, code origin, and execution context. The access control module can dynamically modify access control lists, allocate or revoke resources, and adjust security policies without requiring system reconfiguration. This dynamic approach maintains versatility while adapting security measures to respond to potential malicious behaviors.
Solution Approach 2:
The access control module applies preliminary anti-action by pre-establishing security policies, access control lists, and resource allocation rules that prevent malicious behaviors before they can occur. The system proactively blocks potentially harmful operations, filters suspicious access patterns, and enforces security constraints in advance, countering malicious intentions before they can compromise the system.
Data Source
Figure 1
Figure 2
AI summary
In some embodiments, a filter may filter web graphics library code executing on the graphics processing unit. As a result the web graphics library code may be prevented from accessing memory or other resources that are not allocated specifically for the web graphics library module. Likewise web graphics library code may not access any shared resources that have been explicitly assigned to the process specific web graphics library module.