Browser Security Key Verification Against Spoofing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Browser-in-browser attacks, where malicious parties mimic legitimate browser windows to extract user information, pose a significant security risk due to the difficulty in distinguishing real from fake log-in prompts, especially with spoofed URLs.
Innovation Solution
Displaying security key information in actual browser windows, stored outside the Document Object Model (DOM), to differentiate legitimate from fake windows by using visual and audio cues that update dynamically, ensuring only legitimate windows can access and display these security indicators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If browser windows display uniform visual elements (URLs, design elements) to maintain consistency and user experience, then ease of operation is improved, but the ability to distinguish legitimate windows from spoofed windows deteriorates
Solution Approach 1:
The patent extracts the security key information from the Document Object Model (DOM) and stores it in a separate, secure location within the browser application. This separation allows the security keys to be protected from manipulation while still being accessible for verification purposes, resolving the contradiction between maintaining visual consistency and enabling authenticity verification.
Solution Approach 2:
The patent introduces security keys as an intermediary mechanism between the browser application and the displayed content. These keys serve as a mediator that verifies the authenticity of browser windows without disrupting the uniform visual presentation, allowing users to distinguish legitimate windows from spoofed ones while maintaining consistent user experience.
2Ease of operation
If security key information is stored within the Document Object Model for easy access, then ease of operation is improved, but security against spoofing attacks deteriorates
Solution Approach 1:
The patent extracts security key information from the Document Object Model and stores it in a separate, secure location within the browser application. This extraction prevents malicious scripts from accessing or manipulating security keys through DOM manipulation, while the browser application can still retrieve these keys for verification purposes through controlled interfaces.
Solution Approach 2:
The patent creates a secure copy of the security key information that is stored separately from the DOM. This copy is protected from direct access by web content but can be accessed by the browser application through controlled mechanisms, enabling security verification without exposing the keys to potential attackers.
3Reliability
If the browser application implements security verification mechanisms, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent merges the security verification functionality into the existing browser application architecture by integrating it with the window management and rendering systems. This approach allows the browser to verify window authenticity using existing security infrastructure without requiring separate, complex verification systems, thus improving reliability while minimizing additional complexity.
Data Source
AI summary
Protections against browser-in-browser attacks are provided by in response to opening a first browser window and a second browser window, retrieving security key information stored by a browser application that are held outside of a document object model accessible by documents through the browser application; displaying a first instance of the security key information in the first browser window; and displaying, contemporaneously with display of the first instance of the security key information, a second instance of the security key information in the second browser window.