Method and apparatus for secure web widget runtime system
AssigneeSamsung Electronics Co., Ltd.
InventorsOnur ACIICMEZ, Andrew C. BLAICH
Life of this patent
Estimating the term…
Abstract
The security of web widgets is improved by transferring a set of access control decisions conventionally handled by the Web Runtime system (WRT) to a more secure portion of the computing system, such as a kernel in the operating system. Access control rules are extracted and provided to the more secure portion. This may be performed during widget installation or at invocation of a widget. During runtime, the more secure portion performs security checking functions for the widget instead of the WRT.
Claims20
A method of providing security enforcement of widgets in a computer system having a processor and a memory, comprising:
- extracting access control information from a widget, generating access control rules, and providing the access control rules to a trusted portion of the computer system outside of the user code space of a Web Runtime (WRT) system;
- and
- delegating security checking of the widget, using the access control rules, from the WRT system to the trusted portion of the computer system;
- wherein at least a portion of the security checking of the widget in a runtime environment is performed by the trusted portion of the computer system.
A computer system having improved widget security, comprising:
- at least one processor and a memory;
- an operating system;
- a Web Runtime (WRT) system supporting installation and invocation of widgets, the WRT system configured to eliminate a security risk in the user code space associated with executing the widgets;
- the WRT system configured to receive a widget manifest from each installed widget and determine access control rules delegable from the WRT to a more secure portion of the computer system associated with the operating system;
- the WRT system passing a set of delegable access control rules to the more secure portion to perform security checking when each widget is invoked.
A computer system having improved widget security, comprising:
- at least one processor and a memory;
- an operating system having a kernel;
- the kernel receiving a set of access control rules for a widget from an entity in a user code space, and the kernel during runtime of the widget performing security checking for the widget based on the set of access control rules.
A computer program product comprising computer readable instructions stored on a non-transitory computer readable medium which when executed on a processor of a computer system implement a method including:
- extracting access control information from a widget, generating access control rules, and providing the access control rules to a trusted portion of the computer system outside of the user code space of a Web Runtime (WRT) system;
- and
- delegating security checking of the widget, using the access control rules, from the WRT system to the trusted portion of the computer system;
- wherein at least a portion of the security checking of the widget in a runtime environment is performed by the trusted portion of the computer system.
Dependencies are inferred from the claim text.