Embedded Browser Virtual Channels for Secure Data Transfer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely accessing and transferring data between network resources and client devices, particularly due to differences in client devices and network access methods, leading to security limitations and user experience issues with HTML-based applications.
Innovation Solution
An HTML-based application within an embedded browser on a client device establishes a secure session and determines if the application is trusted, allowing the creation of virtual channels for secure data transfer between the network application and the client device's operating system, enabling clipboard, file system, and I/O device access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an HTML-based application is accessed via an embedded browser on a client device, then the application can provide access to network resources, but security limitations arise due to differences between client devices and network access methods
Solution Approach 1:
The patent introduces a secure browser server as an intermediary component that mediates between the HTML-based application on the client device and the network resources. The server establishes a secure session (HDX session) that acts as a trusted channel, allowing the application to access network resources while maintaining security boundaries. This intermediary architecture resolves the contradiction by enabling resource access through a controlled, secure pathway rather than direct access.
2Ease of operation
If direct access to file system and clipboard is allowed, then data transfer between network application and OS is enabled, but security risks increase
Solution Approach 1:
The patent implements preliminary security validation by determining whether the HTML-based application is a trusted application before allowing access to the file system or clipboard. The embedded browser evaluates trust criteria and establishes a secure session in advance. Only after this preliminary trust verification does the system enable data transfer operations, thus preventing unauthorized access while maintaining ease of operation for legitimate applications.
Solution Approach 2:
The patent introduces virtual channels as intermediary communication pathways between the HTML-based application and the operating system resources (file system, clipboard, I/O devices). These virtual channels act as controlled interfaces that enable data transfer operations while maintaining security boundaries. The embedded browser manages these channels, allowing trusted applications to access resources through controlled pathways rather than direct access, thus resolving the security risk.
3Reliability
If virtual channels are established for trusted applications, then secure data transfer is achieved, but system complexity increases
Solution Approach 1:
The patent implements a universal secure session mechanism (HDX session) that can be applied across multiple contexts and resource types. The same session establishment and trust determination framework is used whether the application needs to access the file system, clipboard, or I/O devices. This universal approach consolidates the security infrastructure into a reusable pattern, reducing the overall system complexity despite the multiple virtual channels required for different resource types.
Data Source
AI summary
Embodiments described include systems and methods for using an HTML-based application integrated with an embedded browser on a client device, for trusted data transfer for instance. An HTML-based application within an embedded browser of a client device can provide access to a network application and its resources. The HTML-based application can establish a secure session for the network application between a server and the HTML-based application. The embedded browser can determine that the HTML-based application is a trusted application via application of one or more policies. With the secure session established and responsive to determining that the HTML-based application is a trusted application, the embedded browser may establish at least one virtual channel between the embedded browser and the HTML-based application. Using the at least one virtual channels, the embedded browser can transfer data between the secure session of the network application and the operating system (OS) of the client device. The operating system of the client device may include a file system, a clip board, and/or input and output (I/O) devices.