Runtime Credential Isolation via Dynamic Configuration Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for sharing private data between remote parties often rely on insecure mechanisms such as OAuth2.0, API keys, and screen scraping, which can lead to token leakage, unauthorized access, and unfettered access to user accounts.
Innovation Solution
A system that uses a client application to share private data without revealing the credentials controlling access, employing configuration files to configure the network API at runtime, allowing secure data sharing without recompiling source code, and ensuring credentials remain on the user device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional mechanisms like OAuth2.0, API keys, or screen scraping are used to share private data between remote parties, then data sharing capability is enabled, but security risks increase due to token leakage, unauthorized access, and credential exposure
Solution Approach 1:
The patent extracts credentials from the data sharing process entirely. Instead of sharing credentials to access data, the system allows data to be shared without exposing credentials. The credential remains exclusively on the user device and never leaves the device, while still enabling remote parties to access the data through a secure mechanism that does not require credential transmission.
Solution Approach 2:
The patent introduces an intermediary configuration file that mediates between the credential and the data sharing process. The configuration file contains instructions for accessing the data without containing the credential itself. This intermediary enables the credential to remain secure on the user device while still allowing authorized data access by remote parties through the configuration instructions.
2Adaptability or versatility
If configuration files are used to configure network API at runtime, then adaptability to different network systems is improved, but system complexity increases
Solution Approach 1:
The patent makes the configuration dynamic by loading configuration files at runtime rather than hardcoding network API specifications. The configuration file can be updated without recompiling the application, allowing the system to adapt to different network systems dynamically. This dynamic approach enables flexibility while keeping the core application code simple and unchanged.
Solution Approach 2:
The patent segments the configuration data from the application code. The configuration file is a separate, standalone component that contains network-specific instructions, while the application code remains generic and unchanged. This segmentation allows the configuration to be modified independently without affecting the application code, reducing overall system complexity while maintaining high adaptability.
3Ease of operation
If credentials are transmitted to enable data access, then remote parties can access private data, but attack surface increases for service providers
Solution Approach 1:
The patent extracts the credential from the data transmission process. Instead of transmitting credentials along with data or access tokens, the system keeps the credential exclusively on the user device. Remote parties access data through configuration instructions that do not involve credential transmission, thereby eliminating this security vulnerability while maintaining data accessibility.
4Adaptability or versatility
If source code is recompiled to support new network systems, then functionality is updated, but development time and resources increase
Solution Approach 1:
The patent makes the system dynamic by enabling configuration changes at runtime without recompilation. New network systems can be supported by simply updating the configuration file with appropriate API specifications and endpoints, rather than requiring source code modification and recompilation. This dynamic configuration approach dramatically reduces the time and resources needed to add support for new network systems.
Solution Approach 2:
The patent segments network-specific configuration from the application code. The configuration file is a separate, modifiable component that can be updated independently of the compiled application. This segmentation allows rapid adaptation to new network systems through configuration changes alone, eliminating the need for time-consuming recompilation cycles while maintaining full functionality.
Data Source
AI summary
In some embodiments, methods and systems use a client application that resides on a client device (e.g., comprising private and secure access credentials). Using the client application, a user may authorize and/or accept a plurality of configuration files. Upon acceptance, the client application is capable of connecting to any interface predefined in the plurality of configuration files (e.g., corresponding to a predetermined list of network systems). The configuration files is downloaded from a package repository or included during software installation.