Intercepting External Requests to Prevent Payment Page Tampering

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Payment webpages in online banking transactions are vulnerable to tampering by malicious programs like Trojan programs, which can redirect payments to illegitimate parties, causing economic losses due to the lack of effective security measures in existing Internet technologies.

Innovation Solution

A method and apparatus that intercept external requests made to a webpage modification interface, specifically targeting inter-process requests to the HTML modification interface's write function, preventing unauthorized modifications to the webpage content rendered by the browser, using a modification interface detector and request interceptor to identify and block such requests.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If the webpage modification interface allows external processes to modify webpage content, then the functionality and adaptability of the webpage are improved, but the security and reliability of the payment transaction are worsened due to potential tampering by malicious programs

Engineering Contradiction:
Improvewebpage modification capabilityVSAvoidpayment transaction security
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces an intermediary security mechanism that sits between external processes and the webpage modification interface. This intermediary monitors and controls access to the modification interface, allowing legitimate modifications while blocking malicious ones. The intermediary acts as a gatekeeper that verifies the authenticity of requests before permitting webpage content changes, thus maintaining both adaptability and security.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If the system intercepts all external requests to the webpage modification interface, then the security against tampering is improved, but the normal functionality of legitimate webpage modifications is worsened

Engineering Contradiction:
Improvewebpage protection against tamperingVSAvoidlegitimate webpage modification
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The patent applies local quality by differentiating between different types of external requests. Instead of treating all external requests uniformly, the system applies different handling rules based on the source and nature of each request. Legitimate requests from trusted sources are allowed to pass through to modify webpage content, while suspicious requests from untrusted sources are blocked. This selective approach maintains both security and functionality.

Inventive Principle:
Principle #3Local quality

3Measurement precision

If the system monitors and intercepts inter-process requests to detect tampering, then the detection capability is improved, but the system complexity and processing overhead are worsened

Engineering Contradiction:
Improvetampering detection accuracyVSAvoidrequest interception mechanism
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent implements preliminary action by establishing the request interception and monitoring mechanism in advance, before any tampering attempts occur. The system proactively sets up filters and monitoring rules that automatically evaluate incoming requests. This preliminary preparation allows the system to quickly identify and respond to tampering attempts without adding complex real-time analysis, reducing processing overhead while maintaining high detection accuracy.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP2756441B1Apparatus and methods for preventing payment webpage tampering
Publication Date: 2017.03.01 TENCENT TECHNOLOGY (SHENZHEN) CO LTD
  • EP2756441B1 patent drawing
  • EP2756441B1 patent drawing
  • EP2756441B1 patent drawing

AI summary

Apparatus and method for preventing payment page tampering are described herein that determine whether a request received by a webpage modification interface is an inter-process request made by another process different from a process running the webpage modification interface and that, in response to determining that the first request is an external request, intercepts the first request. Embodiments of the apparatus and method can improve security of Internet payment transactions.