SDK Wrapper Handshake for Dynamic Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SDK integrity checks, such as those using W3C Subresource Integrity, require frequent updates when the SDK core changes, leaving merchant websites vulnerable to man-in-the-middle attacks if the integrity check hash is removed to avoid updates.
Innovation Solution
Implementing a software development kit (SDK) wrapper that dynamically ensures integrity by performing a handshake with the SDK core and overloading real functions, allowing for continuous integrity checks without requiring webpage updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a W3C Subresource Integrity check hash is added to the merchant webpage to verify SDK integrity, then security against man-in-the-middle attacks is improved, but the merchant webpage must be updated repeatedly when the SDK version changes
Solution Approach 1:
The integrity verification mechanism is extracted from the static webpage and relocated to the SDK wrapper itself. The wrapper performs dynamic integrity checks by comparing the loaded SDK core against expected characteristics, removing the need for hardcoded hashes in the webpage.
Solution Approach 2:
The integrity verification transitions from a static, pre-defined hash check to a dynamic verification process. The SDK wrapper dynamically determines integrity by checking whether the loaded SDK core matches the expected version and functional characteristics, allowing automatic adaptation to SDK updates.
2Ease of operation
If the integrity check hash is removed from the merchant webpage to avoid frequent updates, then ease of webpage maintenance is improved, but security against man-in-the-middle attacks deteriorates
Solution Approach 1:
The SDK wrapper acts as an intermediary layer between the merchant webpage and the SDK core. It performs the integrity verification function that would otherwise require webpage involvement, maintaining security while keeping the webpage simple and update-free.
Solution Approach 2:
The SDK wrapper performs self-verification by automatically checking the integrity of the loaded SDK core without requiring external verification mechanisms from the webpage. This self-service approach maintains security while eliminating the need for webpage updates.
3Adaptability or versatility
If the SDK wrapper performs dynamic integrity checks and handshakes, then adaptability to SDK updates is improved, but device complexity increases
Solution Approach 1:
The system is segmented into distinct functional components: the SDK wrapper responsible for loading and verification, and the SDK core responsible for payment processing. This segmentation allows the wrapper to implement complex verification logic without affecting the simplicity of the core payment functionality.
Data Source
AI summary
A method, system, and computer program product for dynamically ensuring SDK integrity load, at a merchant system, a software development kit (SDK) wrapper from a payment gateway system via a merchant webpage associated with the merchant system; execute the SDK wrapper, the SDK wrapper loading an SDK core when executed; determine an integrity of the SDK core; in response to determining the integrity of the SDK core, perform a handshake between the SDK wrapper and the SDK core and overload a real function exported by the SDK wrapper; and provide, from the merchant system via the SDK core, a secure payment container request to a payment gateway system.