Encapsulating Protocol Tunnel for Secure Data Transfer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for transferring authenticators and session state data between software programs on the same end-user device are insecure and prone to interoperability and security issues, such as CORS violations and certificate management problems, leading to potential malicious flagging and browser restrictions.
Innovation Solution
A method where the first program establishes a secure connection with a server and sends encrypted data elements, which are intercepted and tunneled by a second program using an encapsulating protocol, allowing the server to decapsulate and share the data securely between the programs, ensuring co-location proofing and secure data transfer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the agent over localhost method is used to transfer data between programs, then data transfer capability is achieved, but security issues arise including CORS violations, cleartext traffic exposure, and certificate management problems
Solution Approach 1:
The patent introduces a server as an intermediary between the first program and second program. The first program sends data to the server, which then forwards it to the second program. This mediator architecture eliminates the need for direct localhost communication, thereby avoiding CORS violations and certificate management issues while maintaining secure data transfer capability.
Solution Approach 2:
The patent extracts the data transfer function from the local program-to-program communication and relocates it to a remote server. By taking out the transfer logic from the localhost environment, the system eliminates security vulnerabilities associated with local network communication while preserving the essential data transfer functionality.
2Reliability
If HTTPS is used for secure communication between programs on localhost, then data encryption is achieved, but certificate management complexity increases
Solution Approach 1:
By introducing a server as an intermediary, the patent centralizes the HTTPS termination and certificate management at the server level rather than requiring certificate management on each client program. The server handles all SSL/TLS certificate operations, simplifying the client-side implementation while maintaining encrypted communication.
Solution Approach 2:
The server performs self-service for certificate management, handling all SSL/TLS operations autonomously. The client programs do not need to manage certificates themselves; instead, they communicate securely with the server which manages its own certificates, thereby eliminating certificate management complexity from the client programs.
3Object-affected harmful factors
If anti-virus software flags the localhost method as malicious, then security detection sensitivity is improved, but legitimate data transfer is restricted
Solution Approach 1:
The patent extracts the data transfer operation from the localhost environment and relocates it to a remote server communication model. By taking out the transfer function from the local network context, the system eliminates the trigger for anti-virus false positives while maintaining the ability to transfer data between programs, thereby resolving the conflict between security detection and legitimate operation.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
It is often necessary to securely transfer data, such as authenticators or authorization tokens, between programs running on the same end-user device. The teachings hereof enable the pairing of two programs executing on a given end-user device and then the transfer of data from one program to the other. In an embodiment, a first program connects to a server and sends encrypted data elements. A second program intercepts the connection and/or the encrypted data elements. The second program tunnels the encrypted data elements (which remain opaque to the second program at this point) to a server, using an encapsulating protocol. This enables the server to receive the data elements sent by the first program, decrypt them, and provide them to the second program via return message using control fields of the encapsulating protocol. Once set up, the tunneling arrangement enables bidirectional data transfer.