Browser Extension Payment Encryption Against Formjacking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for receiving customer payment information on online merchant websites are vulnerable to formjacking attacks, allowing malicious actors to steal credit card information before encryption, thus bypassing the security provided by payment service providers.
Innovation Solution
A browser extension that detects payment forms during transactions, determines the online merchant's record in a payment service provider database, receives payment information, and encrypts it within the browser before submission to prevent malware attacks, using APIs for validation by payment gateways.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional payment forms are used to receive customer payment information, then the ease of operation is improved, but the security against malware attacks deteriorates
Solution Approach 1:
A browser extension acts as an intermediary between the customer's browser and the merchant's payment form. The extension intercepts payment information at the browser level, encrypts it locally, and submits it through a secure channel to the payment gateway, bypassing the merchant's potentially compromised payment form while maintaining ease of use.
Solution Approach 2:
The browser extension performs preliminary encryption of payment information before it is submitted to the payment form. By encrypting the data in advance within the browser, the system prevents malicious code on the merchant's website from accessing unencrypted payment information, thus addressing the security vulnerability before the transaction proceeds.
2Ease of operation
If payment information is transmitted unencrypted to merchant servers, then the ease of operation is improved, but the loss of information security deteriorates
Solution Approach 1:
The browser extension serves as a secure intermediary that encrypts payment information locally in the customer's browser before transmission. This eliminates the need for merchant servers to handle unencrypted payment data, as the encrypted information is directly submitted to the payment gateway, preventing information exposure while maintaining simple payment processing.
Solution Approach 2:
The system changes the encryption parameter from server-side to client-side encryption. By implementing encryption at the browser level rather than relying on server-side security measures, the system fundamentally alters how payment information is protected, preventing exposure during transmission while keeping the process transparent to users.
3Adaptability or versatility
If merchant-hosted payment forms are used, then the adaptability is improved, but the reliability of payment security deteriorates
Solution Approach 1:
The browser extension acts as a trusted intermediary that validates payment forms by checking for proper security indicators (such as iframe implementation or scripting language authentication) before allowing encryption and submission. This maintains adaptability for different merchant payment form types while ensuring security validation integrity through the extension's verification process.
Solution Approach 2:
The browser extension implements feedback mechanisms to validate payment forms before processing. It checks whether the payment form is properly implemented (iframe or scripting language) and provides feedback by either enabling or disabling the encryption function, thus maintaining both adaptability and security validation integrity.
Data Source
AI summary
The disclosed computer-implemented method for utilizing a browser extension to encrypt online payment information may include (i) detecting, utilizing the browser extension, a payment form provided by an online merchant during a customer transaction session, (ii) determining a record in a payment service provider database that identifies the online merchant, (iii) receiving, by the one or more computing devices, payment information for completing the payment form, and (iv) performing a security action that protects against a potential malware attack by encrypting the payment information in the payment form for validation by a payment gateway provider and completing the customer transaction session. Various other methods, systems, and computer-readable media are also disclosed.