Trusted Device Encryption for Untrusted Web Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face a high security risk when inputting sensitive information, such as usernames and passwords, on untrusted devices, as malicious codes can capture this information, and existing solutions like USB authentication devices are inconvenient and require separate hardware for each web application.
Innovation Solution
A method and system that uses a trusted device to input and encrypt sensitive information, which is then transmitted to a server through an untrusted device, ensuring the untrusted device does not have the secret key to decrypt the information, thus protecting it from malicious capture and applicable across various web applications without additional hardware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users input sensitive information on an untrusted device, then they can access web applications conveniently, but the sensitive information may be captured by malicious code
Solution Approach 1:
The system segments the authentication process into two parts: sensitive information input on a trusted device and information transmission through the untrusted device. The client device is divided into a trusted component (for input) and an untrusted component (for transmission), allowing users to access web applications on untrusted devices while inputting sensitive information on trusted devices where malicious code cannot capture it
Solution Approach 2:
The patent introduces an intermediary mechanism where the trusted device acts as a mediator between the user and the untrusted device. The trusted device generates encrypted authentication information and transmits it through the untrusted device to the server, preventing malicious code on the untrusted device from capturing sensitive information while still enabling access to web applications
2Reliability
If USB authentication devices are used to prevent password leakage, then security is improved, but hardware complexity and inconvenience increase
Solution Approach 1:
The patent makes the trusted device universal by enabling it to protect sensitive information across multiple web applications simultaneously. Instead of requiring separate USB keys for each application, a single trusted device can generate and manage authentication information for multiple web applications, reducing hardware complexity while maintaining security
Solution Approach 2:
The patent replaces the mechanical USB authentication device with a software-based trusted device mechanism. The trusted device uses cryptographic algorithms to generate and encrypt authentication information, substituting physical hardware with a software solution that achieves the same security goal without requiring additional physical devices
Data Source
AI summary
The invention relates to information processing field, and discloses a method for protecting sensitive information, comprising: determining that the sensitive information is required by a server; transmitting first information to a trusted device connected to the untrusted device, where the first information enables the sensitive information to be transmitted from the trusted device to the server, wherein the sensitive information is input on the trusted device; receiving second information transmitted by the trusted device, the second information is generated based on the first information and includes the sensitive information encrypted with a first secret key, wherein the first secret key meets one of the following: the untrusted device does not know the first secret key; the untrusted device knows the first secret key but is unable to use the first secret key to decrypt the encrypted sensitive information; forwarding the second information to the server.