Cryptographic services for browser applications

Abstract

This disclosure relates to the provision of cryptographic services to web browsers, and more specifically, to systems and methods for providing cryptographic results to a browser from a cryptographic device over a persistent peer-to-peer connection. A method for obtaining cryptographic services for a browser executing a webpage comprising the steps of establishing a persistent peer-to-peer connection over a wireless Internet Protocol communication network between the browser and a cryptographic device, in response to receiving user input to the webpage, transmitting, by the browser, data indicated by the user input over the persistent peer-to-peer connection to the cryptographic device, for cryptographic processing of the data by the cryptographic device using a cryptographic key stored on the cryptographic device to produce a cryptographic result, and receiving, by the browser, the cryptographic result over the persistent peer-to-peer connection from the cryptographic device, and providing the cryptographic result to the webpage.

Description

[0087] The method of the device then returns to step 604, whereby the device waits for further request messages from the browser to be received over the persistent peer-to-peer connection.. Notably and advantageously, the peer-to-peer connection which was established in step 602 is persistent, which means that it remains established through multiple iterations of steps 604, 606 and 608. Transport layer encryption

[0088] To ensure transmissions between the browser and the cryptographic device are secure, a transport layer encryption protocol may be applied to messages transmitted over the persistent peer-to-peer connection. An exemplary transport layer encryption protocol is Datagram Transport Layer Security (DTLS), which is designed to protect data privacy and prevent eavesdropping and tampering. It will be appreciated, however, that many other transport layer encryption protocols that are compatible with the Internet Protocol may be used.

[0089] Transport layer encryption may be applied to request messages transmitted by the browser to the cryptographic device. Furthermore, transport layer encryption may be applied to response messages transmitted by the cryptographic device to the browser. Accordingly, the cryptographic result embedded in the response message, may be further encrypted due to the application of transport layer encryption. Persistent peer-to-peer connection

[0090] Fig. 7 is a message flow diagram 700 which illustrates request and response messages being transmitted between the browser 105 and the cryptographic device 106, over an established peer-to-peer connection 108, in accordance with an aspect of this disclosure. At the establishment of the persistent peer-to-peer connection 108, there may be a series of messages 705 transmitted between the browser and the cryptographic device which negotiate the parameters of the communication session.

[0091] Messages 706 and 708 are a request and response pair, in which the browser has requested cryptographic processing from the device, and has received a cryptographic response from the cryptographic device. Similarly, messages 710 and 712 are another request and 2020353720   06 Aug 2026 response pair, in which the browser has requested further cryptographic processing from the device, and has received a further cryptographic response from the cryptographic device.

[0092] Advantageously, multiple request and response pairs may be transmitted over the persistent peer-to-peer connection while established, as illustrated by request and response messages 714 and 716. Advantageously, the browser need not establish a connection each time cryptographic processing is required.

[0093] Eventually, the browser may determine that the services of the cryptographic device are no longer required, for example, if the user logs out of the webpage, or takes action to sever the persistent peer-to-peer connection. The browser may then take steps to close the persistent peer-to-peer connection, thus freeing up resources associated with the connection. If the peer-to-peer connection is a WebRTC connection, the connection maybe closed by invoking the RTCPeerConnection.close() method, which terminates agents associated with the WebRTC connection. A close message 718 may be transmitted, which triggers the cryptographic device to close the connection, and to cease listening for further request messages via the connection.

[0094] It is understood that a peer-to-peer connection may close unexpectedly, due to a fault at the browser or at the cryptographic device, or a network fault. To ameliorate the effect of a closure of the connection, and to enable fast reestablishment of a connection, the browser may store the connection details (e.g. IP address and port) of the cryptographic device so that the connection may be reactivated through the renegotiation of session parameters. Embodiment - Browser connecting

[0095] An embodiment of the methods as described in Figures 5 and 6, will now be illustrated with reference to Figs. 8a-f.

[0096] Figs. 8a-f illustrates a browser 802 displaying webpages 803a-f.. Webpages 803a-f are illustrative of one or more webpages of a website in which users can post messages to a message board. Various forms of message boards exist, including those within social media platforms. Message boards enable users to post content, which is attributed to the user and viewable or accessible by other parties.

[0097] The browser task bar 804 is located at the top of the browser and provides navigational control to the user of the browser. Located in the middle of the webpage 803a is a web form 2020353720   06 Aug 2026 element 806a in the form of a text box. The user may enter data into this text box in the usual manner.

[0098] To the right of the webpage 803a, is an interface 808a which indicates whether the browser is connected to a cryptographic device via a persistent peer-to-peer connection. As indicated by the unlocked padlock icon 809, the browser illustrated in Fig. 8 is not currently connected to a cryptographic device via a persistent peer-to-peer connection. A Connect button 810, is provided under the padlock icon 809. A user may click the Connect button 810 to trigger the browser to initiate the establishment of a persistent peer-to-peer connection to a cryptographic device.

[0099] Fig 8b illustrates the browser 802 displaying a modified version 803b of webpage 803a, as a result of the user clicking the Connect button 810 on webpage 803a. In the example illustrated in Fig 8b, the browser 802 displays a Scan to Connect box 812 in the middle of webpage 803b. This box contains a QR code 814 which encodes signalling information sufficient to initiate the establishment of a persistent peer-to-peer connection between the browser 802 and a cryptographic device.

[0100] The further steps taken by the browser and the cryptographic device to establish the persistent peer-to-peer connection have been described with regards to Figures 3 and 4. Embodiment - Signing

[0101] Fig 8c illustrates the webpage 803c, executing in browser 802, upon establishment of the persistent peer-to-peer connection between the browser 802 and the cryptographic device. The locked padlock icon 809c provides a visual representation to the user that the peer-to-peer connection is currently established.

[0102] It can be seen that the user has entered the text “Hello world” 807 into web form element 806c. To post the message directly to the message board, so that other users may see the message, the user may click on the Post button 819c. However, the user may want to provide assurance that the message 807 to be posted to the message board originated from that user, and that the message has not been altered before being posted to the message board. Accordingly, the user may elect to sign the message by calculating a signature over the message contents. To achieve this, the user clicks on the Sign button 818, as indicated by the shading pattern of button 818. In response, the browser packages the user’s message 807 into a request for cryptographic 2020353720   06 Aug 2026 processing by signing, and transmits the request to the cryptographic device over the peer-to-peer connection. The cryptographic device applies a digital signature to the user’s message 807, for example, by applying a one-way hash of the user’s message using a public / private key pair stored in memory storage 212, in accordance with the steps 604 to 608 of Fig. 6, and transmits the digital signature to the browser in a response message.

[0103] The browser receives the digital signature and, in accordance with the example illustrated in Fig. 8d, provides the signature to the web page. The webpage displays the digital signature 817 below the user’s message 807 in the web form element 806d. Alternatively, a browser in accordance with this disclosure, may not display the digital signature within the browser, but may embed the digital signature information within data associated with the webpage. The browser may visually depict that the user’s message 807 has been signed through the use of different colouring, shading, location upon the webpage, indicative icons or the like.

[0104] It is noted that, the browser may initiate the message signing process upon posting the message, as a matter of course, or as dependent upon the configuration of the webpage or the user. Furthermore, a browser in accordance with this disclosure, may initiate the posting of the user’s message 807 upon signing the message, as a matter of course, or as dependent upon the configuration of the webpage or the user.

[0105] Fig. 8e illustrates the browser 802 with the user’s message 821 and its associated signature 822 posted to the message board. Embodiment - Encrypting

[0106] In addition to the option of signing the message, as provided by the Sign button 818, the user has the option of encrypting the message 807 for decryption by communication partner 120. Such message encryption, as performed by Author C, is illustrated in relation to message 826.

[0107] To encrypt the message 807, the user clicks on the Encrypt button 820. In response, the browser packages the user’s message 807 into a request for cryptographic processing by encryption, and transmits the request to the cryptographic device over the persistent peer-to-peer connection. The cryptographic device encrypts the user’s message 807 using the communication partner’s public key stored on the cryptographic device, for example in accordance with the steps 604 to 608 of Fig. 6, and transmits the encrypted message to the browser, as a cryptographic result, in a response message. 2020353720   06 Aug 2026

[0108] The browser receives the encrypted message and provides the cryptographic result to the webpage. As exemplified by message 826, the webpage may display the encrypted message in association with the user’s identity. Embodiment - Verifying

[0109] Figures 8c-e also illustrate message verification functionality, according a further aspect of the present disclosure. As indicated by status box 808c-e in Figs. 8c-e, a peer-to-peer connection remains established between the browser and a cryptographic device. A Verify button 827 is collocated with a message 824 posted by exemplary author, Author B. Message 824 is also collocated with digital signature 825, which provides prime facia indication that message 824 has been signed by Author B.

[0110] A user of browser 802 may use the cryptographic device to verify that the digital signature 825 associated with message 824 has been produced by Author B. In the exemplary scenario as illustrated in Fig 8a-e, the user of browser 802 and the cryptographic device is a communication partner of Author B, and has exchanged public keys with Author B via the Public Key Infrastructure. Accordingly, the cryptographic device 106 stores two keys associated with Author B: a public key to be used when transmitting information to Author B; and a private key to be used when receiving information from Author B. The public key which is complementary to the stored private key has been provided to Author B, and is used by Author B to calculate a signature 825 of message 824.

[0111] Accordingly, when the user clicks on the Verify button 827 collocated with message 824 and digital signature 825, the browser forms a request message containing message 824, digital signature 825, information identifying Author B (such as a username), and an indication that the request pertains to a verification function. The browser transmits this request message to the cryptographic device via the established peer-to-peer connection.

[0112] Upon receipt of the request message, the cryptographic device determines the private key associated with Author B, and uses the private key to determine whether the digital signature 825 transmitted in the request message, has been produced over message 824 and Author B’s private key. The cryptographic device then forms a response message, to be transmitted to the browser over the peer-to-peer connection, including a cryptographic result which either verifies the validity of digital signature 825, or refutes the validity of digital signature 825, in accordance with the cryptographic device’s determination. 2020353720   06 Aug 2026

[0113] The browser provides the cryptographic result to the webpage. Depending upon the functionality coded in the webpage, the webpage may indicate a verified signature through a change in colour, shading, collocated icons or otherwise. Similarly, a webpage may indicate a refuted signature by changing the appearance of the message 824 and digital signature 825, or by removal of the same. Embodiment - Decrypting

[0114] Figures 8c-e also illustrate message decryption functionality, according a further aspect of the present disclosure. As indicated by status box 808c-e in Figs. 8c-e, a persistent peer-to-peer connection remains established between the browser and a cryptographic device. A Decrypt button 828 is collocated with a message 826 posted by exemplary author, Author C.

[0115] Message 826 has been encrypted using asymmetric encryption prior to posting by Author C, using a public cryptographic key associated with the user. In order for the user of the browser 802 to view the unencrypted contents of message 826, it will be necessary to decrypt message 826 using the user’s private cryptographic key.

[0116] In the exemplary scenario as illustrated in Fig 8c-e, the user of browser 802 and the cryptographic device is a communication partner of Author C, and has exchanged public keys with Author C via the Public Key Infrastructure. Accordingly, the cryptographic device currently stores a public key associated with Author C, and a private key for communication with Author C. The public key which is complementary to the private key for communication with Author C has been provided to Author C, and is used by Author C to produce encrypted message 826.

[0117] Accordingly, when the user clicks on the Decrypt button 828 collocated with encrypted message 826, the browser forms a request message containing encrypted message 826, information identifying Author C (such as a username), and an indication that the request pertains to a decryption function. The browser transmits this request message to the cryptographic device via the established peer-to-peer connection.

[0118] Upon receipt of the request message, the cryptographic device retrieves from the memory source 812 a public cryptographic key associated with Author C and suitable to decrypt encrypted message 826. The cryptographic device then decrypts encrypted message 826 by applying the public cryptographic key, and returns the decrypted message, as a cryptographic result, to the browser, in a response message, via the persistent peer-to-peer connection 108. 2020353720   06 Aug 2026

[0119] The browser provides the cryptographic result to the webpage. Depending upon the functionality coded in the webpage, the webpage may display the decrypted message from Author C in place of the encrypted message 826. The cryptographic result may remain local to the webpage, and not transmitted to the webserver or other applications. Signing, Verifying and Decrypting Files and other data

[0120] In relation to Fig 8a-e, there has been described methods of signing text based data (i.e. messages posted to a message board), verifying signatures associated with text based data, encrypting and decrypting text based message; however, the above described techniques may also have application in signing, verifying, encrypting and decrypting data other than text messages posted to a message board.

[0121] In particular, the methods and devices described herein may be applied to applications such as the signing of documents of certificate, transcripts, medical prescriptions, photographs and any data to which encryption and / or signatures may be applied using a cryptographic key. Embodiment - Uploading Files

[0122] A cryptographic device in accordance with another aspect of the present disclosure, may be configured to transmit confidential information from the cryptographic device to the browser securely. For example, Fig. 8f illustrates browser 802 displaying a further version of webpage 803f, which enables the uploading of encrypted or signed files. The locked padlock icon 809f indicates that a peer-to-peer connection has been established between the browser and a cryptographic device associated with Author A. The “Upload signed file” button 830 provides the user of the browser with the functionality to provide a file signature for a file, whereby the file signature may be verified by the user’s communication partner 120. This functionality includes applying a cryptographic key to the file, and uploading the file and its associated signature from the cryptographic device to the browser via the persistent peer-to-peer connection.

[0123] To enable this functionality, the following steps may be taken. The user 802, as Author A, selects a file to be uploaded and clicks on the “Upload signed file” button 830. The browser transmits a request message, which includes a file reference and a request for the creation of a file signature, to the cryptographic device 106 via the peer-to-peer connection 108. The cryptographic device 108 locates and retrieves the file from memory source 212, and applies the 2020353720   06 Aug 2026 public key of communication partner 120 to the file contents to calculate a file signature. The cryptographic device transmits the file and its associated signature, as a cryptographic result, to the browser, in a response message, via the peer-to-peer connection.

[0124] The browser then provides the cryptographic result to the webpage. Depending upon the configuration of the webpage, the browser may then upload the file and its associated signature to a web server, and may provide an indication of the uploaded file upon the webpage. For example, text 834 indicates the previous upload of a file entitled ‘Academic transcript (Author A).pdf”. A file signature has been created by the cryptographic device for this file 834, as indicated by the tick icon 838.

[0125] The provision of file signatures with uploaded files enables a communication partner of the uploading user to be able to verify that the file originated from the uploading user, and has not been altered since uploading. The communication partner 120 applies the communication partner’s private key to the file to determine whether the associated signature verifies the file.

[0126] Furthermore, file encryption functionality can be provided in much the same way as the generation of file signatures as described above. The user 102, as Author A, selects a file to be uploaded and clicks on the “Upload encrypted file” button 832. The browser transmits a request message, which includes a file reference and a request for an encryption of the file, to the cryptographic device 106 via the peer-to-peer connection 108. The cryptographic device 108 locates and retrieves the file from memory source 212, and applies the communication partner’s public cryptographic key to the file contents to encrypt the file. The cryptographic device transmits the encrypted file to the browser, as a cryptographic result, in a response message, via the persistent peer-to-peer connection.

[0127] The browser provides the cryptographic result to the webpage. Depending upon the configuration of the webpage, the browser may then upload the encrypted file to a web server, and may provide an indication of the uploaded encrypted file upon the webpage. For example, text 836 indicates the previous upload of an encrypted file entitled ‘Curriculum Vitae (Author A).pdf”. This file has been encrypted by the cryptographic device, as indicated by the padlock icon 840.

[0128] The communication partner 120 may apply the communication partner’s private key to the file to decrypt the file. 2020353720   06 Aug 2026

[0129] It will be appreciated by persons skilled in the art that numerous variations and / or modifications may be made to the above-described embodiments, without departing from the broad general scope of the present disclosure. The present embodiments are, therefore, to be considered in all respects as illustrative and not restrictive.

[0130] Throughout this specification the word "comprise", or variations such as "comprises" or "comprising", will be understood to imply the inclusion of a stated element, integer or step, or group of elements, integers or steps, but not the exclusion of any other element, integer or step, or group of elements, integers or steps.

Claims

1. A method for obtaining cryptographic services for a browser executing a webpage on auser device, the method comprising:establishing a persistent peer-to-peer connection over a wireless Internet Protocol communication network between the browser and a cryptographic device, the cryptographic device comprising a private authentication key and a cryptographic key stored thereon;in response to receiving user input to the webpage, transmitting, by the browser, data indicated by the user input over the persistent peer-to-peer connection to the cryptographic device, for cryptographic processing of the data by the cryptographic device, wherein cryptographic processing comprises applying the cryptographic key to the data to produce a cryptographic result; andreceiving, by the browser, the cryptographic result over the persistent peer-to-peer connection from the cryptographic device, and providing the cryptographic result to a server hosting the webpage,wherein establishing the persistent peer-to-peer connection comprises:,displaying, by the browser, signalling information including: challenge information and user device identification information,receiving, by the browser, response information from the cryptographic device, the response information including:a challenge response cryptographically determined by applying the private authentication key to the challenge information, andcryptographic device identification information; andin response to verifying the challenge response using a public authentication key associated with the private authentication key, establishing the persistent peer-to-peer connection,wherein the persistent peer-to-peer connection comprises a communication channel between two internet connected applications,wherein the response information indicates the cryptographic device as one of the two internet connected applications, andwherein the signalling information is signalled via a communication channel other than the persistent peer-to-peer connection, and signalling the signalling information comprises displaying a Quick Response (QR) code which encodes the signalling information.2020353720   06 Aug 20262.      The method of claim 1, further comprising:receiving, by the cryptographic device, from the browser, data via the persistent peer-to-peer connection between the browser and the cryptographic device;performing, by the cryptographic device, a cryptographic function on the data using the cryptographic key stored on the cryptographic device, to produce the cryptographic result; and transmitting, by the cryptographic device, the cryptographic result to the browser, over the persistent peer-to-peer connection.

3. The method of claim 1 or 2, wherein the persistent peer-to-peer connection remainsestablished over multiple iterations of the steps of:transmitting, by the browser, the data over the persistent peer-to-peer connection to the cryptographic device; andreceiving, by the browser, the cryptographic result over the persistent peer-to-peer connection from the cryptographic device.

4. The method of claim 1, further comprising sending confidential data stored on thecryptographic device, from the cryptographic device to the browser.

5. The method of any of claims 1 to 4, wherein the cryptographic processing of the data bythe cryptographic device comprises signing or encrypting the data with the cryptographic key to produce the cryptographic result.

6. The method of any of claims 1 to 5, wherein the browser embeds the cryptographicresult in the webpage.

7. The method of claim 1, wherein the browser receives an updated webpage from theserver hosting the webpage, in response to providing the cryptographic result to the server.

8. The method of any of claims 1 to 7, wherein the method further comprises injecting, bythe browser, software that defines the method into the webpage.

9. The method of claim 1, wherein the cryptographic device signs the challengeinformation by applying an authentication key to the challenge information to produce the challenge response.2020353720   06 Aug 202610.     The method of any of claims 1 to 9, wherein the data is indicative of data entered by auser of the browser into an input field of the webpage.

11. The method of any of claims 1 to 10, wherein establishing a persistent peer-to-peerconnection between the browser and the cryptographic device occurs in response to receiving establishment input from a user of the user device.

12. A system comprising:at least one processor; anda computer-readable medium storing instructions that, when executed by the at least one processor, cause the system to:execute, by a browser, a webpage;establish a persistent peer-to-peer connection over a wireless Internet Protocol communication network between the browser and a cryptographic device, the cryptographic device comprising a private authentication key and a cryptographic key stored thereon;in response to receiving user input to the webpage, transmit, by the browser, data indicated by the user input over the persistent peer-to-peer connection to the cryptographic device, for cryptographic processing of the data by the cryptographic device, wherein cryptographic processing comprises applying the cryptographic key to the data to produce a cryptographic result; andreceive, by the browser, the cryptographic result over the persistent peer-to-peer connection from the cryptographic device, and providing the cryptographic result to a server hosting the webpage,wherein to establish the persistent peer-to-peer connection the instructions when executed by at least one processor further cause the system to:display, by the browser, signalling information including: challenge information; and user device identification information;receive, by the browser, response information from the cryptographic device, the response information including:a challenge response cryptographically determined by applying the private authentication key to the challenge information; andcryptographic device identification information; and2020353720   06 Aug 2026in response to verification of the challenge response using a public authentication key associated with the private authentication key, establish the persistent peer-to-peer connection,wherein the persistent peer-to-peer connection comprises a communication channel between two internet connected applications,wherein the response information indicates the cryptographic device as one of the two internet connected applications, andwherein the instructions when executed by at least one processor further cause the system to signal signalling information via a communication channel other than the persistent peer-to-peer connection, and to display a Quick Response (QR) code which encodes the signalling information.

13. The system of claim 12, further comprising the cryptographic device, the cryptographic device configured to:receive, from the browser, data via the persistent peer-to-peer connection between the browser and the cryptographic device;perform, a cryptographic function on the data using the cryptographic key stored on the cryptographic device, to produce the cryptographic result; andtransmit the cryptographic result to the browser, over the persistent peer-to-peer connection.

14. The system of claim 13, wherein the instructions, when executed by the at least one processor, further cause the system to send confidential data stored on the cryptographic device, from the cryptographic device to the browser.

15. The system of any of claims 12 to 14, wherein the instructions, when executed by the at least one processor, further cause the persistent peer-to-peer connection to remain established over multiple iterations of:transmission, by the browser, the data over the persistent peer-to-peer connection to the cryptographic device; andreception, by the browser, the cryptographic result over the persistent peer-to-peer connection from the cryptographic device.2020353720   06 Aug 202616. The system of any of claims 12 to 15, wherein the instructions, when executed by the at least one processor, further cause the data to be cryptographically processed by the cryptographic device by a signing or encryption of the data with the cryptographic key to produce the cryptographic result.

17. The system of any of claims 12 to 16, wherein the instructions, when executed by the at least one processor, cause the browser to embed the cryptographic result in the webpage.

18. The system of any of claims 12 to 17, wherein the instructions, when executed by the at least one processor, cause the browser to receive an updated webpage from the server hosting the webpage, in response to providing the cryptographic result to the server.

19. The system of any of claims 12 to 18, wherein the data is indicative of data entered by a user of the browser into an input field of the webpage.

20. A computer readable storage medium having stored thereon executable program instructions that, when executed by a computer, cause the computer to perform operations including:executing, by a browser, a webpage;establishing a persistent peer-to-peer connection over a wireless Internet Protocol communication network between the browser and a cryptographic device, the cryptographic device comprising a private authentication key and a cryptographic key stored thereon;in response to receiving user input to the webpage, transmitting, by the browser, data indicated by the user input over the persistent peer-to-peer connection to the cryptographic device, for cryptographic processing of the data by the cryptographic device, wherein cryptographic processing comprises applying the cryptographic key to the data to produce a cryptographic result; andreceiving, by the browser, the cryptographic result over the persistent peer-to-peer connection from the cryptographic device, and providing the cryptographic result to a server hosting the webpage,wherein establishing the persistent peer-to-peer connection comprises:displaying, by the browser, signalling information including: challenge information; and user device identification information;2020353720   06 Aug 2026receiving, by the browser, response information from the cryptographic device, the response information including:a challenge response cryptographically determined by applying the private authentication key to the challenge information; andcryptographic device identification information; andin response to verifying the challenge response using a public authentication key associated with the private authentication key,establishing the persistent peer-to-peer connection,wherein the persistent peer-to-peer connection comprises a communication channel between two internet connected applications,wherein the response information indicates the cryptographic device as one of the two internet connected applications, andwherein the signalling information is signalled via a communication channel other than the persistent peer-to-peer connection, and signalling the signalling information comprises displaying a Quick Response (QR) code which encodes the signalling information.

Images