Browser-in-Browser Remote App Access Without VDI Resource Layers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for accessing enterprise applications from untrusted environments face challenges such as high costs, inefficient performance, and security vulnerabilities due to the need for resource layers and additional software installations, which can be exploited by malicious applications.
Innovation Solution
A method and system that allows a client endpoint device with a first web browser to access a web application in a remote data centre by retrieving and launching a second web browser within the first browser, establishing a secure tunnel connection, and rendering the application interface locally, eliminating the need for resource layers and additional software installations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VDI technology is used to provide secure access to enterprise applications, then security is improved, but operational costs increase due to the need for resource layer management
Solution Approach 1:
The patent extracts the browser execution environment from the resource layer and places it directly on the client endpoint device. By using a locally executed browser that downloads and runs web applications directly on the device, the system eliminates the need for a managed resource layer while maintaining secure access capabilities.
Solution Approach 2:
The patent introduces a gateway as an intermediary component that mediates between the client endpoint device and the web application server. The gateway handles authentication, authorization, and secure communication, replacing the complex resource layer management while maintaining security controls.
2Reliability
If VDI technology with dedicated browser instances is deployed, then access security is improved, but performance deteriorates due to networking issues
Solution Approach 1:
The patent segments the system into three distinct components: the gateway on the client device, the web application server, and the local browser environment. This segmentation allows the browser to execute locally with direct access to the device's processing resources, eliminating network latency associated with remote browser instances while maintaining security through the gateway's mediation.
Solution Approach 2:
The patent transitions from a centralized remote browser model to a distributed local browser model. By moving browser execution from the resource layer to the client endpoint device, the system changes the dimensional arrangement of components, placing the browser in a new operational dimension (local device environment) that provides both security and performance benefits.
3Reliability
If a local secure browser is installed on the endpoint device, then security is improved, but usability deteriorates due to installation requirements and platform compatibility issues
Solution Approach 1:
The patent makes the gateway component universal by designing it to run on any standard web browser across multiple operating systems and devices. The gateway is implemented as web-based JavaScript code that can execute in any modern browser environment, eliminating the need for device-specific installations while maintaining security controls across diverse platforms.
Solution Approach 2:
The patent enables the endpoint device to self-configure the secure browser environment by automatically downloading and executing the gateway code in the local browser. The system self-manages the secure execution environment without requiring manual installation or configuration by the user, improving usability while maintaining security.
Data Source
AI summary
A method of accessing, at a client endpoint device running a first web browser, a web application running in a remote data centre is provided. The method includes sending a request to access the web application to a gateway at the remote data centre; receiving hypervisor script code from the gateway; executing the received hypervisor script code at the client endpoint device using the first web browser; displaying, on a screen of the client endpoint device, a graphical image of a user interface screen of the web application running at the remote data centre. In response to such received user interaction events, a second web browser fetches components of the web application over the secure application access tunnel connection and renders the graphical image of the user interface screen of the web application by invoking an HTML canvas function of the first web browser.