Managing Access to Security Hardware in PC Browsers

Web applications that require higher levels of security have various security options that can be deployed on the server. However providing security on the client consuming the service remains a challenge especially when the application runs in a web browser. While various types of security hardware can work with the user's computer, there is no convenient way for web applications to access such hardware from the web browser. To fill this gap, we develop a software tool called SEAM, which is a SEcure Add-on Management framework built on top of the web browser native extension framework. Through SEAM, web applications can access secure hardware in a controlled manner. SEAM was devised with usability and security at the core. It is flexible and convenient to use, easy to deploy, and works across major PC platforms and web browsers. This paper describes the rationale and design of SEAM, and illustrates its applications.