Mobile Authentication Isolation via Segmented Sandboxes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure authentication methods for mobile banking applications are vulnerable to attacks if an attacker discovers a vulnerability in either the authentication SDK or the banking application, as they typically run in the same sandbox, potentially allowing compromise of the entire system.
Innovation Solution
Implementing an authentication application separate from the banking application, with its own sandbox and private key, that communicates securely with a remote secure server using a unique identifier and encrypted transactions, ensuring that vulnerabilities in one application do not breach the entire system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the authentication SDK and banking application run in the same sandbox, then the system complexity is reduced and ease of operation is improved, but security reliability deteriorates because a vulnerability in either component could compromise the entire system
Solution Approach 1:
The system divides the authentication functionality into a separate authentication application that runs in its own sandbox, distinct from the banking application's sandbox. This segmentation ensures that even if the banking application is compromised, the authentication credentials remain protected in the isolated authentication sandbox, directly resolving the security vulnerability of shared sandbox execution
Solution Approach 2:
The authentication SDK is extracted from the banking application and implemented as a standalone authentication application with its own sandbox environment. This extraction removes the security risk where vulnerabilities in the banking application could affect the authentication mechanism, as they now operate in completely separate protected memory spaces
2Ease of manufacture
If the authentication SDK runs in the same sandbox as the banking application, then implementation ease is improved, but security vulnerability increases as attackers could compromise either component to breach the system
Solution Approach 1:
The authentication functionality is segmented into a separate application with its own sandbox, creating an isolated execution environment that prevents attackers from compromising the authentication mechanism through vulnerabilities in the banking application, while still maintaining relatively straightforward implementation through standardized inter-application communication protocols
3Reliability
If a single sandbox is used for both banking and authentication applications, then resource utilization is optimized, but security isolation is reduced allowing potential compromise of the entire system
Solution Approach 1:
The system implements separate sandboxes for banking and authentication applications, creating distinct protected memory spaces that provide robust security isolation. While this requires additional system resources compared to a shared sandbox, it ensures that compromises in one application cannot affect the other, prioritizing security over resource optimization
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A system and method for secure authentication performed on a mobile communication device. The method includes an authentication application carrying out the steps of: receiving a unique identifier for a transaction from a first application provided on the same mobile communication device as the authentication application; receiving an encrypted transaction from a remote secure server; decrypting or obtaining decryption of the transaction with a private key of the authentication application; signing or obtaining signing of the transaction with the private key; signing the transaction with the unique identifier; and transmitting the signed transaction back to the remote secure server.