Web Browser Unique Identifiers Using Hardware-Backed Enclaves
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern web browsers prioritize user privacy and anonymity, making it difficult for service providers to uniquely identify client devices and users, which enables fraudulent activities such as fake account creation, account takeover, and malicious bot deployment.
Innovation Solution
Utilizing trusted isolated execution environments (TEE) in modern computer processors to enable web applications to cryptographically identify client devices through unique hardware-tied cryptographic keys, protecting secrets and computations from the rest of the client system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If browsers implement privacy protection features (limit access to system hardware information, automatically clear cookies), then user privacy and anonymity are improved, but device identification and user tracking capabilities deteriorate
Solution Approach 1:
The patent introduces a Trusted Isolated Execution Environment (TEE) as an intermediary between the browser and the device identification system. The TEE acts as a secure enclave that can generate and store device identifiers without exposing them to the main browser process or other system components, thus maintaining privacy while enabling reliable identification.
Solution Approach 2:
The patent replaces traditional mechanical/browser-based identification methods with cryptographic hardware-based solutions. Instead of relying on browser cookies or localStorage that can be cleared, the system uses hardware-rooted cryptographic keys stored in secure enclaves to generate persistent device identifiers.
2Ease of operation
If browsers allow users to easily switch between identities and accounts, then user convenience and privacy are improved, but fraud detection capability deteriorates
Solution Approach 1:
The patent implements a feedback mechanism where the TEE continuously monitors and reports device identifier consistency to the authentication system. When a user switches accounts or devices, the system receives feedback about the new device's cryptographic identifier and can compare it against known patterns to detect fraudulent behavior.
Solution Approach 2:
The system performs preliminary action by establishing a baseline of legitimate device identifiers during the account creation phase. These baselines are stored securely and used for future authentication decisions, allowing the system to proactively detect when a device deviates from expected behavior patterns.
Data Source
AI summary
A method may include transmitting, from a browser application of a client system, a request for a webpage to a server system using a general execution environment of the client system; receiving the webpage, the webpage including a secure execution request to execute a computation in a trusted isolated execution environment of the client system; in response to the secure execution request, establishing a secure enclave within the trusted isolated execution environment with respect to the browser application; receiving, within the trusted isolated execution environment, an attestation request from the server system for an attestation associated with the secure enclave; transmitting, from the trusted isolated execution environment, an attestation response based on a physical property of a processing unit in the client system; subsequent to transmitting the attestation response, receiving, from the server system, a data file; and storing the data file in the secure enclave.