Browser-Independent Transaction Authentication via Encrypted Applet Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Browser-helper-object viruses, such as the ZeuS Trojan, can modify financial transaction information by manipulating the document object model in web browsers, making it difficult to ensure the security and authenticity of online transactions, as current anti-virus software often fails to detect such infections.
Innovation Solution
A computer system that receives transaction information from a network browser, provides an encrypted version to a separate application for comparison with original information, and obtains approval for the transaction independently of the browser, using an encryption key within a Java applet that can be modified randomly or pseudorandomly to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL encryption is used to secure communication between user and server, then communication security is improved, but vulnerability to browser-helper-object viruses increases because the virus can manipulate the DOM to alter transaction information before encryption
Solution Approach 1:
The patent introduces an intermediary authentication mechanism that operates independently of the browser's DOM manipulation. A separate authentication channel verifies transaction details directly with the user through a different interface (such as a popup or separate window), preventing the virus from altering transaction information without detection. This intermediary layer breaks the direct connection between the potentially compromised browser form and the authentication process.
Solution Approach 2:
The patent segments the authentication process into separate independent components: the main browser interface for user interaction, a separate authentication channel for verification, and direct server validation. By dividing the authentication flow into distinct segments that operate independently, the system prevents a single point of compromise (the browser DOM) from affecting the entire authentication process.
2Object-affected harmful factors
If current anti-virus software is used to detect infections, then basic virus protection is provided, but detection of browser-helper-object viruses fails because these viruses specifically target DOM manipulation
Solution Approach 1:
The patent implements a feedback mechanism where the server sends back authentication challenges that require direct user confirmation through an independent channel. The system continuously verifies that transaction information displayed to the user matches the information being submitted, creating a closed-loop feedback system that detects discrepancies caused by DOM manipulation viruses.
Solution Approach 2:
The patent applies preliminary anti-action by implementing server-side validation that checks transaction details against independently verified user inputs before processing. This preemptive verification occurs before the virus can successfully complete its manipulation, blocking fraudulent transactions in advance rather than attempting to detect the virus after infiltration.
3Ease of operation
If transaction information is displayed in the web page for user review, then user approval is obtained, but the information displayed may be different from the information sent to the server due to DOM manipulation
Solution Approach 1:
The patent introduces an intermediary verification step where transaction information is confirmed through a separate authentication channel that bypasses the browser's DOM. This intermediary ensures that the user reviews and approves the actual transaction details that will be submitted, not potentially manipulated display information.
Solution Approach 2:
The patent replaces reliance on the browser's visual display mechanism (which can be manipulated via DOM) with an alternative authentication interface such as a secure popup, separate window, or direct server-generated verification screen. This substitution eliminates the vulnerability to DOM manipulation while maintaining user review capability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A technique for conducting a transaction via a network is described. In this technique, in response to receiving transaction information associated with the transaction via the network from a network browser in a computer, a computer system provides an encrypted version of the received transaction information via the network to an application that executes in the computer, which facilitates a comparison of the received transaction information with original transaction information provided by a user to the computer. Note that this application is separate from the network browser, and the communication with the application via the network is independent of the network browser. Moreover, if the received transaction information matches the original transaction information, the computer system receives approval for the transaction from the computer via the network.