Securing Native App to Hybrid Component Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to securely establish communication between native applications and embedded hybrid components on electronic devices, particularly during digital account opening processes, which can lead to vulnerabilities such as man-in-the-middle attacks and replay attacks.
Innovation Solution
A method and system that utilize an authorization platform and authentication framework to securely transfer an encrypted payload containing an authentication code, bundle identifier, and device identifier, ensuring confidentiality and integrity through RSA public key encryption and AES encryption, with a short-lived authentication code and session identifier generation, to verify user credentials and establish device trust.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted payload with authentication code is transmitted between native application and hybrid browser component, then security against man-in-the-middle attacks is improved, but system complexity increases due to multiple frameworks and platforms
Solution Approach 1:
The system divides the authentication process into distinct segments: the authorization platform generates the encrypted payload, the authentication framework validates it, and the native application and hybrid browser component each perform specific verification steps. This segmentation allows each component to have a focused security function, improving overall reliability while managing complexity through clear division of responsibilities.
Solution Approach 2:
The patent introduces an authorization platform and authentication framework as intermediary components between the native application and hybrid browser component. These intermediaries manage the complex encryption and validation logic, shielding the core application components from direct exposure to complex security mechanisms while maintaining strong security guarantees.
2Reliability
If authentication code with expiration is implemented, then protection against replay attacks is improved, but additional validation steps increase processing time
Solution Approach 1:
The authorization platform pre-generates an encrypted payload containing an authentication code with an expiration timestamp before transmitting it to the hybrid browser component. This preliminary action ensures that the authentication code is already validated and time-limited before the actual authentication process begins, preventing replay attacks without adding significant processing time during the critical authentication moment.
Solution Approach 2:
The patent replaces complex mechanical validation mechanisms with cryptographic verification. The expiration check is performed through simple comparison of timestamps in the encrypted payload rather than through complex procedural validation, reducing processing time while maintaining strong protection against replay attacks.
3Reliability
If multiple encryption methods (RSA and AES) are used for payload encryption, then confidentiality and integrity are improved, but computational overhead increases
Solution Approach 1:
The patent combines RSA and AES encryption methods in a hybrid approach: RSA is used to securely exchange or protect the authentication code and key material, while AES provides efficient bulk encryption of the payload. This merging of cryptographic methods achieves strong confidentiality and integrity guarantees while optimizing the balance between security strength and computational efficiency.
Data Source
AI summary
A method for securing communication may include: (1) receiving, at the authorization platform and from a hybrid browser component of a computer application, an encrypted payload comprising an authentication code, a bundle identifier, and an application unique identifier; (2) registering, by the authorization platform, a username for a user; (3) receiving, at the authentication framework and from the computer application, the username and the encrypted payload; (4) receiving, at the authentication framework, user login credentials from the user; (5) validating, by the authentication framework, the user login credentials; (6) passing, by the authentication framework to the authorization platform, the encrypted payload; (6) comparing, by the authorization platform the encrypted payload received from the computer application to the encrypted payload received from the authentication framework; and (8) accepting, by the authentication framework, the encrypted payload and tying the process to the computer application.