Secure Software Client via Proxy Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web applications lack a secure and desktop-like experience within browsers, with inadequate security measures and limited flexibility across different devices and platforms.
Innovation Solution
A secure software client is implemented, comprising a web application and a proxy that communicate via a secure web socket, where the proxy generates a desktop-like interface using HTML5 content, customizable and resizable, and both components are run within secure enclaves to enhance security, with certificate authentication for the web application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If web applications run in standard browsers with full access to system APIs, then ease of operation and platform compatibility are improved, but security is worsened due to unauthorized access risks
Solution Approach 1:
The system is divided into two separate components: a web application running in the browser and a proxy application running natively on the device. The web application handles user interface and communication, while the proxy handles system-level operations. This segmentation allows the web app to maintain platform compatibility through browser execution while the proxy provides secure controlled access to system resources.
Solution Approach 2:
The proxy acts as an intermediary between the web application and the operating system. It receives requests from the web application via secure web socket communication, validates them, and executes appropriate system-level actions. This intermediary approach enables the web app to access system functionality without having direct browser-based API access, thereby maintaining security while providing operational capability.
2Object-affected harmful factors
If a proxy is introduced to mediate between web application and system, then security is improved, but device complexity is worsened
Solution Approach 1:
The proxy is designed as a universal component that handles multiple types of system operations through a unified interface. It can manage file system access, socket connections, drag and drop operations, and other system-level functions through standardized mappings. This multi-functionality reduces the need for multiple separate security components, thereby managing complexity while providing comprehensive security.
3Object-affected harmful factors
If web application is isolated within browser sandbox, then security is improved, but access to system functionality is worsened
Solution Approach 1:
The proxy serves as an intermediary that enables the isolated web application to access system functionality. It maintains the browser sandbox security model while providing controlled access to file system, network sockets, and other system resources through secure communication channels and mapping mechanisms.
Solution Approach 2:
The system implements bidirectional communication between the web application and proxy through secure web sockets. The web app sends requests to the proxy, which executes system operations and returns results. This feedback loop enables versatile system access while maintaining security boundaries, as all access requests are validated and controlled by the proxy.
Data Source
AI summary
A secure software client is provided. A secure software client can be partitioned into a web application that functions as the user interface and a proxy that performs a number of functions to provide a desktop-like experience within the web application. The web application can be isolated within the browser and can communicate with the proxy via a secure communication channel thereby allowing the proxy to be isolated from other types of access. The proxy can generate a desktop in the form of HTML5 content that the web application can render. The proxy can customize the desktop to include representations of applications or other functionality that are available to the user. The web application can detect user interaction with the HTML5 content and relay the interaction to the proxy via the secure communication channel to allow the proxy to perform an appropriate function.