Browser Certificate Authentication for End-to-End Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing TLS protocols face challenges in ensuring secure communication between browsers and servers due to intermediate endpoints that can expose sensitive data to internal and external threats, as conventional certificate validation is not accessible or reliable in all deployment scenarios, particularly for browsers lacking script capabilities.
Innovation Solution
A method where a browser receives a server's certificate and random numbers, generates and verifies hash values, and encrypts data using a derived encryption key, while the server decrypts using its private key, ensuring end-to-end protection of sensitive data through a browser-server communication process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If TLS connection terminates at intermediate endpoints (DMZ or infrastructure devices), then data can be decrypted for inspection and control, but sensitive data is exposed to internal and external threats
Solution Approach 1:
The patent segments the TLS connection into multiple independent paths: one for control/signaling (through intermediate devices) and one for data transfer (direct browser-to-server). This allows inspection of control traffic while keeping sensitive data encrypted end-to-end, resolving the contradiction between inspection capability and data security.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism where the browser validates the server's certificate and establishes trust independently of intermediate devices. This mediator (certificate validation) enables controlled data flow through intermediates while maintaining end-to-end encryption, allowing inspection without exposing sensitive data.
2Reliability
If conventional certificate validation is used in browsers, then server authentication is achieved, but it is not accessible or reliable in all deployment scenarios
Solution Approach 1:
The patent changes the authentication parameters from relying on browser-based certificate validation to using server-provided authentication data (public key, certificate, random numbers) that the browser processes locally. This parameter change makes authentication reliable across diverse deployment scenarios including those with restricted browser capabilities or custom TLS implementations.
3Object-affected harmful factors
If end-to-end encryption is implemented between browser and server, then data protection from intermediate threats is achieved, but intermediate devices cannot inspect or control the data
Solution Approach 1:
The patent segments traffic into control plane (inspected by intermediates) and data plane (encrypted end-to-end). Control signaling including authentication and key exchange occurs through intermediates for inspection, while actual data transfer uses direct encrypted channels, enabling both protection and inspection simultaneously.
Solution Approach 2:
The patent uses intermediates as mediators for authentication and key establishment only, not for data inspection. The intermediate devices verify server certificates and facilitate secure connection setup, then step out of the data path, allowing end-to-end encryption while maintaining intermediate control over connection legitimacy.
Data Source
AI summary
The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for determining, by a browser, data cipher by encrypting data using a first encryption key, the first encryption key is generated using a first random number, a second random number, and a third random number. The browser sends to a server, the data cipher. The browser determines a key cipher by encrypting the third random number using a certificate of the server. The browser sends to the server the key cipher.