Browser Storage Isolation for Secure Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional browser storage systems are vulnerable to attacks such as cross-site request forgery (CSRF) and cache timing attacks due to the mixing of secure and non-secure data in the same storage area, compromising the security of sensitive operations.
Innovation Solution
Implementing a method and apparatus for network secure storage that allocates separate storage areas for secure and non-secure windows within a browser, ensuring that sensitive data is stored in secure areas inaccessible to non-secure rendering processes, thereby isolating secure storage from non-secure storage areas.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If all rendering processes share the same storage area, then storage management is simplified, but security is compromised due to potential attacks using stored data
Solution Approach 1:
The patent divides the storage area into multiple isolated storage spaces, each corresponding to a specific rendering process. This segmentation prevents one rendering process from accessing another's stored data, thereby blocking attacks like CSRF and cache timing attacks while maintaining simplified storage management through automated process-based allocation.
2Reliability
If separate storage areas are allocated for each rendering process, then security is improved by isolating data access, but storage management complexity increases
Solution Approach 1:
The patent implements automatic storage area allocation where each rendering process automatically receives its dedicated storage space upon creation, and the system automatically manages the correspondence between processes and storage areas. This self-service mechanism eliminates manual configuration complexity while maintaining security through isolation.
Data Source
AI summary
This application discloses a method for network secure storage. The method includes: receiving a client request to create a window; creating a window in response to the client request; allocating a storage area for the window; allocating a rendering process to the window; and providing, to the rendering process, a storage service using the storage area.