App-Specific Client Certification for Secure Web Server Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deploying a web application as a web application within a web browser often results in operational difficulties due to lack of access to system level services, and a 'same box' configuration with a dedicated web server can lead to security breaches from unauthorized web applications.
Innovation Solution
Implement automatic generation of app-specific client certification in a packaged application, where the web server generates and stores server and client certificates in a private memory location, enabling secure authentication between the web server and web client.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a web application is deployed as a packaged application with a dedicated web server, then system level access is enabled, but security breaches from unauthorized web applications become possible
Solution Approach 1:
The patent segments the authentication mechanism by introducing app-specific certificates that are unique to each packaged application. The web server stores these certificates in a secure memory location, and the web client must present the corresponding private key during authentication. This segmentation ensures that even though multiple web applications can access the web server, each is isolated by its own certificate pair, preventing unauthorized applications from accessing system level services.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism using digital certificates as a mediator between the web client and web server. The server certificate and client certificate act as intermediaries that verify identities before allowing access to system level services. This intermediary layer ensures that only authenticated clients can access the server, preventing direct unauthorized access while maintaining system level access capabilities.
2Adaptability or versatility
If a web application runs inside a web browser sandbox, then accessibility is improved, but access to system level services is prevented
Solution Approach 1:
The patent applies preliminary action by generating and storing app-specific certificates during the application installation or launch phase. The web server creates the server certificate and client certificate before the actual operation begins, and stores them in secure memory. This preliminary preparation allows the application to maintain sandboxing benefits while pre-establishing the authentication mechanism needed for system level access when required.
Solution Approach 2:
The patent extracts the authentication credentials (certificates) from the general browser sandbox environment and places them in application-specific secure storage. By taking out the certificate generation and storage functions from the general web browser environment and embedding them within the packaged application, the system enables system level access while maintaining the security boundaries of the sandbox for other operations.
Data Source
Figure 1A
Figure 1B
Figure 2A
AI summary
Techniques for automatic generation of app-specific client certification are disclosed herein. In one embodiment, a method includes receiving, at a web server in a packaged application containing a co-packaged web client, a connection request from a web client and a first copy of a client certificate from the web client. Upon receiving the client certificate, the web server can authenticate the connection request from the web client using a second copy of a client certificate previously generated by the web server for the co-packaged web client. In response to successfully authenticating, based on both the first and second copies of the client certificate, the web server can establish a secure connection with the web client to allow the web client access to system level services on the computing device. Otherwise, the web server would refuse connection.