Trusted Computing Base Password Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password management solutions in Web browsers are vulnerable to malware, phishing, and screen scraping, allowing unauthorized access to sensitive information due to insecure handling and processing of passwords.
Innovation Solution
A secure connection is established between the client and server using a trusted computing base (TCB), where the password is encrypted and injected directly into the connection, bypassing insecure Web browsers and applications, ensuring it remains unavailable in clear text.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a Web browser is used to access Web sites and handle passwords, then ease of operation is improved, but security is worsened because the browser is susceptible to malware, phishing, and screen scraping attacks
Solution Approach 1:
The system segments the password management functionality by separating the password storage (in TCB) from the application layer (Web browser). The browser handles user interaction while the TCB component securely manages password encryption and injection, preventing the browser from accessing clear text passwords.
Solution Approach 2:
A TCB-based intermediary component is introduced between the Web browser and the secure connection. This intermediary encrypts passwords and injects them directly into the secure connection, acting as a mediator that prevents the browser and potential malware from accessing clear text passwords while maintaining ease of use through the browser interface.
2Ease of operation
If form filler solutions are used to manage passwords in Web browsers, then ease of operation is improved, but security is worsened because these solutions allow unsecure processes to access passwords in clear text
Solution Approach 1:
The patent extracts the clear text password from the browser environment entirely. Instead of storing or processing passwords in clear text within the browser, the system retrieves encrypted passwords from TCB storage and maintains them in encrypted form throughout the authentication process, removing the security vulnerability.
Solution Approach 2:
The TCB-based intermediary component replaces traditional form filler solutions. This intermediary encrypts passwords before they enter the browser process and injects them directly into the secure connection, preventing unsecure processes from accessing clear text passwords while maintaining automatic password filling functionality.
3Reliability
If passwords are transmitted over secure connections, then security is improved, but the application still requires access to clear text passwords which creates security risks
Solution Approach 1:
The TCB-based intermediary encrypts passwords before transmission and injects them directly into the secure connection. This intermediary ensures that even though the application needs to send passwords over the network, the clear text password never resides in the application's memory or process space, preventing exposure to malware or unauthorized access.
Solution Approach 2:
The system segments password handling into two distinct parts: encrypted password storage and management in the TCB component, and secure transmission over the network. This segmentation allows the application to transmit passwords securely without ever having access to or exposure to clear text passwords in its address space.
Data Source
AI summary
A secure (e.g., HTTPS) connection is established between a client and a server. Communication over the connection may utilize an application (e.g., a Web browser) that is not part of the client's trusted computing base. A password is sent from the client to the server over the connection such that the clear text password is unavailable to the application. For example, the password can be encrypted and inserted directly into the HTTPS stream from the client's trusted computing base.