Web Browser Push Notification Security via SDK Key Store
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems providing push notifications for multi-factor authentication through web-browser applications lack secure storage for encryption keys and data, posing a security threat due to the use of local storage in plain text.
Innovation Solution
The implementation of a web-client SDK that enables secure storage of encryption keys and factor information using a secure key store, such as indexedDB, and encrypts factor information before storing it, ensuring secure handling and access during authentication requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If web-browser applications use local storage to store authentication data, then ease of operation is improved, but security is worsened due to plain text storage
Solution Approach 1:
The patent introduces a secure key store as an intermediary layer between the web-browser application and local storage. This mediator encrypts authentication data before storage and manages key access, allowing the system to maintain ease of operation while significantly improving security. The secure key store acts as a buffer that protects sensitive data without complicating the user interface or interaction flow.
2Reliability
If secure native applications are used for push notifications, then security is improved through secure storage, but adaptability is worsened as web-browser applications cannot utilize this functionality
Solution Approach 1:
The patent creates a universal secure key store that can be accessed by multiple types of applications including web-browser applications, native applications, and hybrid applications. This multi-functional storage solution allows push notification security to be implemented across different platforms and application types, eliminating the limitation where only secure native applications could utilize encrypted storage.
3Device complexity
If encryption keys are stored in local storage, then device complexity is reduced, but harmful factors increase due to unauthorized access risk
Solution Approach 1:
The patent extracts the security-critical key management functionality from the general local storage system and places it in a dedicated secure key store. This separation removes the harmful factor of plain text storage while maintaining relatively simple device architecture. The secure key store handles encryption and decryption operations, allowing keys to be stored securely without significantly increasing overall device complexity.
Data Source
AI summary
Disclosed are systems, methods, and non-transitory computer-readable media for verification push notifications provided through a web-browser application. An authentication system provides a web-client Software Development Kit (SDK) to enable verification push notifications through a client-side application. Some client-side applications, such as web-browser applications (e.g., Chrome, Firefox, etc.) may not support certain features to provide for secure storage of data and encryption keys that are used to provide for verification push notifications. For example, some client-side applications may utilize a local storage that stores data in plain text that can be easily accessed and read, thereby presenting a security threat. The web-client SDK provided by the authentication system provides for secure storage of data and encryption keys to enable a client-side application to securely provide verification push notifications.