Mobile Banking Security Core with Obfuscation and Camouflage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mobile and cloud banking applications face significant security challenges due to inadequate protection against malware, data theft, and other malicious activities, particularly in a rapidly changing environment with evolving platforms and operating systems, which compromises user data and transaction security.
Innovation Solution
A security core for mobile banking apps is introduced, featuring enrollment and authentication APIs that establish constant keys and unique identifiers across devices, support device-wide enrollment, malware detection, and transaction-level authentication, while also providing stream-level data authentication and encryption, and resistance to reverse engineering and denial-of-service attacks through obfuscation and camouflage techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current mobile banking apps use basic security measures, then the apps remain simple and flexible, but security against malware and data theft is insufficient
Solution Approach 1:
The patent divides the security functionality into a separate security core component that can be independently implemented and updated. This security core includes enrollment APIs, authentication APIs, and device characterization APIs that are distinct from the main banking application logic, allowing security enhancements without complicating the overall app structure
Solution Approach 2:
The patent introduces a security core as an intermediary layer between the banking application and the operating system/hardware. This security core handles all security-sensitive operations including key management, authentication, and device characterization, isolating these complex functions from the main application while providing simplified interfaces
2Reliability
If security cores are implemented to enhance security, then transaction security improves, but the system becomes more complex and harder to maintain in fast-changing environments
Solution Approach 1:
The patent designs the security core with universal APIs that can serve multiple functions across different banking applications and operating systems. The enrollment APIs, authentication APIs, and device characterization APIs provide standardized interfaces that work across platforms, reducing the need for platform-specific security implementations and simplifying maintenance
Solution Approach 2:
The patent implements a dynamic security core that can adapt to changing environments through software updates without requiring hardware changes. The security core is designed to be extendable and modifiable, allowing security protocols and algorithms to be updated in response to new threats while maintaining compatibility with existing applications
3Reliability
If device-wide enrollment is implemented for authentication, then authentication reliability improves, but the risk of malware compromising device-wide credentials increases
Solution Approach 1:
The patent implements installation-specific enrollment that creates unique credentials for each individual app installation rather than using device-wide credentials. This means that each banking app instance has its own security context and credentials, so if malware compromises one installation, it cannot automatically compromise other installations or the entire device
Solution Approach 2:
The patent changes the parameter of credential scope from device-wide to installation-specific. By modifying the enrollment process to create unique identifiers and credentials tied to individual app installations rather than the entire device, the system maintains authentication reliability while limiting the blast radius of potential malware attacks
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A security core supports a networked banking app for a client application device communicating with a server, such as e.g. a smartphone. It provides a secure environment for the banking app to conduct registration, enrollment, and transaction workflows with corresponding back-end servers on the network. It includes defenses against static analysis, attempts at reverse engineering, and real-time transaction fraud. A principal defense employed is obfuscation of the protocols, APIs, algorithms, and program code. It actively detects, thwarts, misdirects, and reports reverse engineering attempts and malware activity it senses. A routing obfuscator is configured to operate at the outer layer. Previous core designs are retainedas camouflage. An internal TLS library is used rather than the OS TLS layer. Cookies are managed internally in the core rather than in the webkit-browser layer.