Web View Context Validation for UWP Application Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional authentication mechanisms for server-hosted web applications are inadequate for Universal Windows Platform (UWP) applications, as they do not allow all human end users to interact with the application without requiring human user-specific login credentials, leading to vulnerabilities in sensitive data disclosure and tampering.

Innovation Solution

Implementing a system that authorizes and allows a publicly-hosted cloud website application to render only within a trusted client application context, using front-end web application code and client application code to validate the rendering context, and limiting access based on specific authorized client applications listed in a whitelist or blacklist, independent of the human user's identity.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional authentication mechanisms (username/password, API keys, session tokens) are used for server-hosted web applications, then human users can access the applications, but security vulnerabilities arise from unauthorized access and data tampering

Engineering Contradiction:

ImprovesecurityVSAvoidaccess control

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent introduces a web view component as an intermediary between the UWP application and the server-hosted web application. This web view acts as a controlled environment that mediates all interactions, preventing direct access to the web application from untrusted sources while still allowing authenticated UWP applications to access it. The web view sandbox isolates the web application execution context, providing security without requiring traditional user credential authentication.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

Instead of authenticating human users with credentials to access web applications, the patent inverts the approach by authenticating the UWP application context itself. The system verifies that the web application is being accessed through a trusted UWP application package, using the application's identity and context as the authentication basis rather than user credentials. This reversal eliminates the need for traditional login mechanisms while improving security.

Inventive Principle:

Principle #13The other way round (Inversion)

2Ease of operation

If web applications are made publicly accessible without user-specific authentication, then ease of access is improved, but security vulnerabilities from unauthorized access and data disclosure increase

Engineering Contradiction:

ImproveaccessibilityVSAvoidsecurity vulnerabilities

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent applies different access control qualities to different contexts. Publicly accessible web applications are allowed to be accessed without user credentials, but only within the controlled context of a UWP application web view. The access control policy is localized to the web view environment, providing open access where needed while maintaining security boundaries. This allows the web application to be publicly accessible while preventing unauthorized access vectors.

Inventive Principle:

Principle #3Local quality

3Reliability

If user credentials are required for authentication, then security is improved, but the system becomes incompatible with UWP applications that need to allow all end users access without login

Engineering Contradiction:

ImprovesecurityVSAvoidUWP application compatibility

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent creates a universal authentication mechanism that serves multiple functions: it provides security through UWP application context verification, enables public access without user credentials, and maintains compatibility with all UWP applications. The web view sandbox and context verification system act as a universal layer that replaces the need for traditional credential-based authentication while providing equivalent or superior security and broader compatibility.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Productivity

If web applications are hosted on public servers accessible by any client, then service availability is improved, but control over execution context and security is reduced

Engineering Contradiction:

Improveservice availabilityVSAvoidexecution control

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent implements preliminary authentication of the UWP application context before allowing access to the web application. The system pre-verifies that the requesting application is a trusted UWP application with the appropriate package identity and context. This preliminary action establishes security boundaries before the web application executes, maintaining execution control while allowing the web application to remain hosted on public servers for availability.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11165780B2Systems and methods to secure publicly-hosted cloud applications to run only within the context of a trusted client application

Publication Date: 2021.11.02 DELL PROD LP

AI summary

Systems and methods are provided that may be implemented to secure a publicly-hosted web application so that it will render only within the determined context of a trusted client application. Such an authentication decision may be made, for example, using front-end web application code that is rendered in a client web view together with client application code to authenticate the client application context in which the web page is rendered. In this way, the web application may validate that it is being rendered in the context of a trusted and/or well-known client application rendering engine/environment.