Browser-Generated Unique Identifiers via Trusted Enclaves for Fraud Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Modern web browsers prioritize user privacy and anonymity, making it difficult for service providers to uniquely identify client devices and users, which enables fraudulent activities such as fake account creation and account takeover.

Innovation Solution

Utilizing trusted isolated execution environments (TEE) in modern computer processors to enable web applications to cryptographically identify client devices by generating unique identifiers using CPU-specific secret keys, and integrating with web technologies like JavaScript without requiring special client software.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If browsers implement privacy protection features (clearing cookies, limiting hardware access), then user privacy and anonymity are improved, but device fingerprinting and user tracking become difficult

Engineering Contradiction:

Improveuser privacy protectionVSAvoiddevice identification capability

Core Design Contradiction:

ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent introduces a Trusted Isolated Execution Environment (TEE) as an intermediary between the browser and the device identification process. The TEE provides a secure enclave that can access hardware identifiers without exposing them to the main browser process or external observers, thus enabling device fingerprinting while maintaining user privacy protections implemented by modern browsers

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces traditional mechanical/browser-based identification methods with cryptographic hardware-based solutions. Instead of relying on browser cookies or software-based fingerprinting that can be easily cleared or manipulated, the system uses hardware-rooted cryptographic keys stored in secure enclaves to generate unique device identifiers

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If browsers limit access to system hardware information, then user anonymity is improved, but fraudulent actors can more easily create fake accounts and evade detection

Engineering Contradiction:

Improveuser anonymityVSAvoidfraudulent account creation

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The TEE acts as a trusted intermediary that bridges the gap between hardware identification and web application logic. It allows hardware identifiers to be accessed for fraud detection purposes while maintaining the privacy protections that prevent direct browser access to hardware, thus not compromising user anonymity

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary authentication using hardware-rooted cryptographic keys before allowing account creation or login operations. This preliminary check using unique device identifiers in the TEE prevents fraudulent actors from creating fake accounts or logging in from multiple devices, as each device has a unique cryptographic proof of identity

Inventive Principle:

Principle #9Preliminary anti-action

3Difficulty of detecting and measuring

If traditional device fingerprinting methods are used, then user identification is possible, but the methods are easily manipulated and unreliable

Engineering Contradiction:

Improveuser identification capabilityVSAvoididentification accuracy

Core Design Contradiction:

Difficulty of detecting and measuringVSReliability

Solution Approach 1:

The patent replaces software-based fingerprinting mechanisms with hardware-based cryptographic identification. Instead of using browser cookies, localStorage, or software-generated fingerprints that can be manipulated, the system uses hardware-rooted cryptographic keys stored in secure enclaves that are physically difficult to replicate or manipulate

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system generates new unique identifiers each time a user authenticates or creates an account, rather than relying on persistent cookies or stored fingerprints. These temporary but unique identifiers are generated fresh for each operation, making them impossible to reuse or manipulate, while the underlying hardware key remains secure and permanent

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS12381740B2Web browser generation of unique identifiers

Publication Date: 2025.08.05 WELLS FARGO BANK NA

AI summary

A method may include transmitting, from a browser application of a client system, a request for a webpage to a server system using a general execution environment of the client system; receiving the webpage, the webpage including a secure execution request to execute a computation in a trusted isolated execution environment of the client system; in response to the secure execution request, establishing a secure enclave within the trusted isolated execution environment with respect to the browser application; receiving, within the trusted isolated execution environment, an attestation request from the server system for an attestation associated with the secure enclave; transmitting, from the trusted isolated execution environment, an attestation response based on a physical property of a processing unit in the client system; subsequent to transmitting the attestation response, receiving, from the server system, a data file; and storing the data file in the secure enclave.