SSL Modulator for Secure Online Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Online commercial activities are vulnerable to phishing and Man-In-The-Middle (MITM) attacks due to the inability of users to verify the authenticity of communication recipients, especially when replies from servers are not secured, allowing attackers to access user accounts during sessions.
Innovation Solution
A client computer-based method for secure electronic transactions using SSL communications that verifies the domain name of a transaction site with its SSL public key and adds the user's password to the HTML header of messages, ensuring only authorized recipients can read the information, leveraging asymmetric cryptographic algorithms like RSA for encryption and utilizing a secure transaction module to intercept and verify communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL encryption is used to secure outgoing messages, then message confidentiality is improved, but vulnerability to MITM attacks increases when replies are not secured
Solution Approach 1:
The patent applies local quality by differentiating security treatment between outgoing and incoming messages. Outgoing messages are encrypted with the recipient's public key for confidentiality, while incoming messages have their source verified through digital signatures and certificates. This asymmetric approach addresses the contradiction by providing appropriate security measures for each message direction without requiring mutual encryption for both directions.
Solution Approach 2:
The patent uses a Certificate Authority (CA) as an intermediary to verify the identity of message recipients. The CA issues digital certificates that bind public keys to entity identities, enabling the client to verify that messages are indeed from the intended recipient without requiring the recipient to encrypt their replies. This intermediary verification mechanism resolves the MITM vulnerability while maintaining the asymmetric security model.
2Ease of operation
If direct user control over security settings is enabled, then user autonomy is improved, but system complexity increases
Solution Approach 1:
The patent implements self-service by enabling users to directly specify which recipients are trusted for receiving encrypted messages. Users can configure their security preferences by selecting trusted entities, and the system automatically uses these preferences to guide encryption decisions. This user-driven configuration approach provides strong security control without requiring complex automated decision-making algorithms.
Solution Approach 2:
The patent applies preliminary action by requiring users to pre-configure their trusted recipient list and security preferences before actual communication occurs. The security module uses these pre-established settings to automatically verify certificates and encrypt messages without requiring real-time user intervention or complex runtime decision logic, thus simplifying the operational complexity.
3Reliability
If password verification is added to HTML headers, then authentication security is improved, but message size increases
Solution Approach 1:
The patent applies partial action by including only the necessary authentication information (password verification token) in the HTML header rather than transmitting the entire password or excessive data. The verification token is a condensed representation that provides authentication security while minimizing the amount of data transmitted in the message header.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
Prevents MITM attacks by ensuring only authorized recipients can access encrypted messages, protecting user accounts from unauthorized access and providing users with control over secure communication settings, while maintaining the security of outgoing messages.
Implementation Method 1
This control can be provided through a software module running on the consumer's PC that ensures that messages sent to the user's intended recipient is encrypted with the public-key associated with that recipient
Implementation Method 2
The verification of these public-keys is performed through a separate connection with a trusted Certification Authority
Data Source
AI summary
A software system and method for executing secure commercial transactions online is disclosed. A user's password is received to initiate secure socket layer (SSL) communications with a transaction site on a server. A web session associated with the SSL communications is encrypted by associating a domain name of the transaction site with its SSL public key. Then, the user's password is added to a hypertext markup language (HTML) header of a message within the web session. When added, the password is invisible to a hypothetical man-in-the-middle (MITM) attacker, who cannot read the encrypted message nor mimic the user. The MITM is thus unable to compromise the user's account as the MITM is unable to provide the correct password into any fraudulent message.