Embedded Browser Security via Method Interceptor

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Embedded browsers are vulnerable to malicious online activities, such as unauthorized access to sensitive information, due to exposed data channels and lack of secure domain control.

Innovation Solution

Implementing a method interceptor within the embedded browser to intercept API calls, compare the domain specified in the URL to a list of allowed domains, and block unauthorized API calls, thereby securing data access and preventing malicious access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If an embedded browser is used to access network resources, then the application can interact with external web content, but the system becomes vulnerable to malicious online activities and unauthorized access to sensitive information

Engineering Contradiction:

Improveability to access network resourcesVSAvoidvulnerability to malicious activities

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

A method interceptor is introduced as an intermediary component between the embedded browser's API and the application. The interceptor captures API calls, inspects URLs against a whitelist of allowed domains, and blocks unauthorized access attempts. This mediator enables network resource access while filtering out malicious content, resolving the contradiction between versatility and security vulnerability.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary security validation by maintaining a whitelist of approved domains and checking URLs before allowing API calls to proceed. By pre-establishing security rules and validating requests in advance, the system prevents malicious activities before they can compromise sensitive information, enabling safe network interaction.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If domain validation is implemented to prevent unauthorized access, then security is improved, but the complexity of the browser system increases

Engineering Contradiction:

Improvesecurity against unauthorized accessVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The security functionality is segmented into a separate method interceptor module rather than being integrated throughout the entire browser system. This modular approach isolates the validation logic, making the system more manageable and easier to maintain while providing robust security. The interceptor handles domain validation independently, reducing overall system complexity.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12333034B2Secure embedded web browser

Publication Date: 2025.06.17 INTUIT INC

AI summary

A method including receiving, at an embedded browser embedded in an application, a request to access data designated by a uniform resource locator (URL) specified by the request. The method also includes intercepting, by a method interceptor, an application programming interface (API) call to access the data designated by the URL. Intercepting is performed prior to execution of the API call. The API call is performable by an API of the embedded browser. The method also includes comparing, by the method interceptor, a domain specified by the URL to an list of allowed domains. The method also includes blocking, by the method interceptor and responsive to the domain failing to be a member of the list of allowed domains, the API call. Blocking is performed by the method interceptor preventing the API call from passing to the API.