Secure Cloud App Invocation via Origin Header Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, users face risks of sensitive information disclosure and malicious server connections due to malicious web applications that can spoof origins and access native applications on client devices.
Innovation Solution
A method and system that securely invoke native applications from web browsers by using identity information to validate requests, including an origin header to prevent spoofing, and a global trust service to verify the domain trust, without requiring browser plugins or extensions, ensuring compatibility with various browsers and operating systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If web applications can directly invoke native applications, then ease of operation is improved, but security reliability deteriorates due to spoofing attacks and malicious server connections
Solution Approach 1:
The patent introduces a browser extension as an intermediary component that mediates between web applications and native applications. The extension validates requests, checks origin headers, and verifies server identities before allowing native applications to connect, thus maintaining ease of operation while ensuring security reliability through the intermediary security layer
Solution Approach 2:
The patent implements preliminary anti-action by proactively blocking malicious web applications from invoking native applications through origin header validation and server identity verification. The browser extension preemptively prevents spoofing attacks and unauthorized connections before they can compromise security, while still allowing legitimate invocations to proceed smoothly
2Reliability
If origin header validation is implemented to prevent spoofing, then security reliability is improved, but device complexity increases due to additional validation mechanisms
Solution Approach 1:
The patent applies universality by designing the browser extension to perform multiple functions: origin header validation, server identity verification, and native application invocation management. This multi-functional approach consolidates security mechanisms into a single component, improving security reliability while minimizing the increase in device complexity through functional integration
3Reliability
If browser plugins or extensions are required for secure invocation, then security reliability is improved, but ease of operation deteriorates due to installation requirements and compatibility issues
Solution Approach 1:
The patent implements self-service by enabling the browser extension to automatically manage security validations and native application invocations without requiring user intervention. The extension autonomously verifies origins, checks server identities, and facilitates secure connections, improving security reliability while maintaining ease of operation through automated security management
Data Source
AI summary
Methods and systems for securely using a web application to invoke an application to complete a task are described herein. The application may use identity information provided by the web application to determine whether to comply with requests from the web application. The web application may send the request to the application via a browser. The request may include the origin of the request in an origin header to prevent malicious websites from spoofing the origin of the request. The application may exchange information with a trust service to determine whether the web application domain is trusted and/or belongs to the same organization of the user.