Secure Data Transmission via Third-Party Webpages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web-based transaction systems face challenges in securely transmitting sensitive data through untrusted third-party webpages, as they are vulnerable to man-in-the-middle attacks and data compromise.
Innovation Solution
A computer-implemented method and system that securely transmit data via a third-party webpage by using configuration data digitally signed with a private key, which is verified by the user device to ensure only trusted scripts and frames are executed, thereby preventing data interception and tampering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is transmitted through a third-party webpage, then accessibility and ease of operation are improved, but security and reliability deteriorate due to vulnerability to man-in-the-middle attacks
Solution Approach 1:
The patent introduces a trusted service as an intermediary between the user device and the third-party webpage. This trusted service acts as a mediator that verifies the authenticity of the webpage and establishes secure communication channels, allowing data transmission through third-party pages while maintaining security through the intermediary's verification processes
Solution Approach 2:
The patent performs preliminary verification actions before data transmission occurs. The trusted service verifies the authenticity of the third-party webpage and establishes security protocols in advance, so that when data is transmitted through the webpage, the security framework is already in place to prevent man-in-the-middle attacks
2Reliability
If trusted service elements are integrated into third-party websites, then security is improved, but device complexity increases due to verification processes
Solution Approach 1:
The patent implements self-service mechanisms where the trusted service elements autonomously verify their own authenticity and establish security protocols without requiring complex user intervention. The verification processes operate automatically in the background, reducing the perceived complexity for users while maintaining robust security
Solution Approach 2:
The patent segments the verification process into distinct modular components that can be independently managed and executed. By dividing the security verification into separate trusted service elements, the system reduces overall complexity while maintaining comprehensive security coverage through specialized verification modules
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Provided is a computer-implemented method for securely receiving data via a third-party webpage, including: generating configuration data in response to a request from a first system, the configuration data including a public key of a first key pair; digitally signing the configuration data based on a private key of a second key pair; transmitting the configuration data to the first system, the configuration data including code configured to facilitate the first system to embed a plurality of frames in a webpage, wherein the plurality of frames loads content from a domain that is independent from a domain that hosts the webpage; and verifying the configuration data based on a public key of the second key pair. The computer-implemented method may also include receiving, from a master frame of the plurality of frames, encrypted data. Systems and computer program products are also provided.