Secure Browser-Native Messaging via Manifest Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for enabling communication between browser-based applications and native applications, such as through NPAPI, pose security risks due to unrestricted permissions and lack of sandboxing, allowing potential malicious exploitation.
Innovation Solution
Implementing a system where a native application includes a manifest file that authorizes specific browser-based applications to communicate with it, using a native application messaging host, and ensuring secure storage of this data to prevent unauthorized access, thereby controlling communication requests and maintaining a secure environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If NPAPI is used to enable communication between browser-based applications and native applications, then communication capability is improved, but security is worsened due to unrestricted permissions and lack of sandboxing
Solution Approach 1:
The patent introduces a manifest file as an intermediary component that mediates between browser-based applications and native applications. This manifest file, stored in a secure location, contains authorization information that controls which browser applications can communicate with which native applications, thereby preventing unauthorized access while allowing legitimate communication.
Solution Approach 2:
The patent segments the communication authorization process into distinct components: a manifest file stored in a secure location containing authorization data, a browser process that reads and validates the manifest, and a controlled communication channel. This segmentation allows security validation to be separated from the actual communication functionality.
2Object-affected harmful factors
If browser-based applications are run in a sandboxed environment with strict control, then security is improved, but functionality is worsened due to restricted access to system resources
Solution Approach 1:
The patent implements dynamic authorization where the sandboxed browser application can access native application functionality based on runtime validation of the manifest file. The authorization is not static but determined dynamically when communication is requested, allowing the system to maintain security while providing flexible access control.
Solution Approach 2:
The manifest file acts as an intermediary that bridges the sandboxed browser environment and the native application resources. It provides a controlled interface that allows authorized browser applications to access specific native functionalities without compromising the sandbox security model.
3Ease of operation
If unrestricted communication is allowed between browser and native applications, then ease of operation is improved, but security risks worsen due to potential malicious exploitation
Solution Approach 1:
The patent implements preliminary authorization by storing the manifest file in a secure location before any communication occurs. The browser process validates the manifest file and establishes authorized communication channels in advance, so that when communication is requested, the authorization is already verified, maintaining ease of operation while preventing malicious exploitation.
4Object-affected harmful factors
If a manifest file is stored in a secure location writable only by administrator, then security is improved, but device complexity worsens due to restricted write access
Solution Approach 1:
The patent segments the file system access into two distinct modes: a secure location that is writable only by administrator for storing the manifest file, and readable locations for both administrator and standard users. This segmentation allows the system to enforce strict write protection for security-critical data while maintaining ease of reading for all users.
Data Source
AI summary
A system for securely mediating messages between a native application and a browser application on a computing device includes running the browser application and a browser process that controls access by the browser-based application to the native resource. The browser process may use a data file distributed with the native application to allow or deny communications between the browser-based application and the native application. When communications are allowed the browser-based application accesses the native resource via the native application. In one implementation, the browser process may initiate a native messaging host and send communication requests to the native messaging host. The data file may be downloaded with the native application or separately from the native application from a site that distributes the native application or a site controlled by the developer of the native application. The data file identifies browser-based applications allowed to communicate with the native application.