Remote Application Rendering Server with Encrypted Channels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current applications lack sufficient security as user-operated devices can be manipulated by malicious code, and data transmission between clients and servers is vulnerable to interception and unauthorized access, leading to security threats.
Innovation Solution
A server-based system that uses separate encrypted input and output channels for communication with clients, where input data is encrypted and processed on the server, and output data is rendered and streamed back to the client, ensuring that sensitive operations and data remain secure and isolated from the client device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If applications are executed on the client device, then ease of operation is improved, but security is worsened due to manipulation by malicious code
Solution Approach 1:
The patent extracts the application execution environment from the client device and relocates it to a secure server environment. The application code and sensitive operations are removed from the untrusted client and executed remotely, while only the user interface is presented to the client. This extraction eliminates the security vulnerability of having applications run directly on potentially compromised client devices.
Solution Approach 2:
The patent introduces a server as an intermediary between the user and the application. The server acts as a trusted mediator that hosts the application in a secure environment, processes all sensitive operations, and communicates only encrypted output and input data with the client. This intermediary architecture prevents direct access to application logic and data on the client side.
2Adaptability or versatility
If data is transmitted between client and server, then functionality is improved, but security is worsened due to interception and unauthorized access
Solution Approach 1:
The patent applies encryption to transform the state of transmitted data from plaintext to ciphertext. By changing the parameter of data representation through cryptographic encoding, the patent ensures that intercepted data becomes unintelligible without the decryption key, thus protecting against unauthorized access while maintaining full data transmission functionality.
3Adaptability or versatility
If applications access sensitive data on the server, then functionality is improved, but security is worsened due to unauthorized access and manipulation
Solution Approach 1:
The patent extracts sensitive data access operations from the client-side application and concentrates them in a secure server environment. The application code that accesses sensitive data is removed from the client and executed exclusively on the server, where it can be protected by operating system permissions, access control lists, and secure enclaves. This extraction ensures that even if the client is compromised, attackers cannot directly access or manipulate sensitive data on the server.
Solution Approach 2:
The patent introduces the server as a trusted intermediary that mediates all access to sensitive data. The server validates authentication credentials, enforces access control policies, and manages data encryption/decryption operations. This intermediary architecture ensures that only authorized operations can access sensitive data, and all access is logged and monitored for security auditing.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to providing remote access to applications with an increased level of security. A server for providing access to applications is provided, as well as a method therefor, comprising an input channel and an output channel to connect a client with said server, an interface coupled to said input channel and an application, said interface to receive input data from said client via said input channel and to communicate said received input data to the application, and a renderer coupled to said output channel and said application, said renderer to render the output of said application into a data stream to be transferred via the output channel to the client, wherein the input data and the data stream are both encrypted. The inventive server and the method for providing remote access to applications greatly improve the security level and integrity of both the accessed application and also the access to the remote application.