Smartcard SSL Extension for Rogue Process Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current internet transaction methods lack secure authentication of both the user and device, leaving them vulnerable to attacks from rogue processes and fake websites, and are cumbersome for users to navigate, especially for e-commerce transactions.
Innovation Solution
A smartcard with an application that extends the SSL connection from an SSL-protected server into the card, providing cryptographic services such as generating symmetric keys, verifying server certificates, and encrypting account details, while using a browser plug-in to establish a secure end-to-end connection, thereby protecting against unauthorized access and simplifying the transaction process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL protocol is used to encrypt communications between customer and web-server, then security against eavesdropping is improved, but security against rogue processes on customer's device is not sufficiently improved
Solution Approach 1:
A code module is introduced as an intermediary component installed on the customer's device that acts as a secure gateway. This module intercepts and controls all communications between the web browser and the web server, encrypting data before it leaves the device and decrypting incoming data. This intermediary layer prevents rogue processes from accessing sensitive information while maintaining SSL encryption for network transmission security.
Solution Approach 2:
The code module performs preliminary authentication and encryption actions before data transmission occurs. It pre-establishes secure communication channels, validates server certificates, and encrypts sensitive data in advance before it can be intercepted by rogue processes. This preliminary security measure ensures that even if rogue processes are present, they cannot access unencrypted data or manipulate communications.
2Ease of operation
If account details are transmitted in unencrypted form, then ease of processing is improved, but security is deteriorated
Solution Approach 1:
The code module extracts and isolates sensitive account details from the general data stream. It identifies specific sensitive elements such as credit card numbers and authentication credentials, separates them from other transaction data, and applies specialized encryption only to these extracted sensitive portions. This allows the rest of the transaction data to be processed more easily while maintaining security for critical information.
3Reliability
If firewall software is installed to monitor outgoing traffic, then security against rogue processes is improved, but device complexity is increased
Solution Approach 1:
The code module implements self-service security mechanisms by automatically managing encryption keys, certificate validation, and secure communication protocols without requiring user intervention or complex firewall configurations. The module autonomously monitors and controls data flows, performing security functions that would otherwise require sophisticated firewall software, thereby reducing overall system complexity while maintaining high security standards.
Data Source
Figure 1~2
Figure 3~4
AI summary
This invention provides for a transaction card for use at a terminal and for initiating an internet transaction with a SSL protected server, wherein the card comprises a smartcard including an application arranged for extending an SSL connection from the said protected server into the smartcard and, further, the invention can provide for a related terminal, server and related transaction initiation and establishment methods, for extending the said SSL connection as noted above.