Custom Browser Isolation for Secure Online Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing online transaction security measures are inadequate in protecting sensitive consumer information from hackers, as conventional techniques like sandbox environments are vulnerable to attacks such as Cross-Site Request Forgery (CSRF) and lack robust protection against unauthorized access.
Innovation Solution
A system and method that employs a custom browser operating within a virtualized environment, allowing connections only to pre-approved merchants, blocking unauthorized communication, and not supporting scripting languages, cookies, or browser cache, while storing payment device information securely outside the virtualized environment to ensure secure online transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a sandboxed environment is used for conducting on-line transactions, then security against unauthorized access is improved, but vulnerability to CSRF attacks increases
Solution Approach 1:
The patent extracts and eliminates the problematic trust mechanism that enables CSRF attacks. By using a custom browser that does not support cookies, browser cache, or other trust-based mechanisms, the system removes the foundation upon which CSRF attacks operate, while maintaining security through alternative authentication methods
Solution Approach 2:
The patent segments the browser functionality into a custom secure environment that is isolated from the user's local system. This segmented custom browser operates within a sandboxed virtualized environment, separating security-critical functions from potentially vulnerable user-side components
2Reliability
If a custom browser with restricted functionality is used, then security against attacks is improved, but ease of operation deteriorates
Solution Approach 1:
The patent introduces a payment processing intermediary that bridges the restricted custom browser and the merchant systems. This intermediary handles payment authorizations and transactions without requiring the custom browser to support complex functionalities like scripting languages or cookies, thus maintaining security while simplifying the user experience
3Ease of operation
If payment device information is stored in the virtualized environment, then accessibility is improved, but security against data theft deteriorates
Solution Approach 1:
The patent extracts payment device information storage from the virtualized environment and places it in a secure external location. This separation ensures that even if the virtualized environment is compromised, the payment data remains protected, while the system maintains the ability to access this information when needed for processing transactions
Data Source
AI summary
A system for conducting secure on-line transactions includes a user communication device, a third party server, and one or more merchant servers. The user communication device can communicate with one or more preapproved merchants from within a virtualized environment using a custom browser. The custom browser supports only a single connection at any given time and only if the connection is to one of the preapproved merchants. The merchant website includes a custom markup language that can be parsed by the custom browser to render web pages on the user communication device.