Browser-Level Homomorphic Encryption for WAF Data Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Web Application Firewall (WAF) deployments expose sensitive data to third-party providers due to decryption processes, risking data breaches and performance degradation from repeated homomorphic encryption.
Innovation Solution
Implement homomorphic encryption at the browser level to encrypt sensitive data before transmission, using a plugin system to aggregate and encrypt data with a public key, allowing WAF to analyze encrypted data without decryption, thus preventing exposure and maintaining performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional WAF decryption processing is used, then security scanning capability is improved, but data exposure risk increases and performance degrades
Solution Approach 1:
The patent introduces homomorphic encryption as an intermediary mechanism that allows the WAF to process encrypted data without decryption. The encryption layer acts as a mediator between the data and the scanning function, enabling security analysis while maintaining data confidentiality and preventing exposure to third-party WAF providers.
Solution Approach 2:
The patent replaces the traditional mechanical decryption process with homomorphic encryption technology. Instead of decrypting data to scan it (which exposes data to the WAF provider), the system uses homomorphic encryption to perform scanning operations on encrypted data directly, substituting the conventional approach with a cryptographic-based solution that eliminates data exposure risk.
2Object-affected harmful factors
If homomorphic encryption is applied repeatedly, then data security is improved, but computational overhead increases
Solution Approach 1:
The patent applies homomorphic encryption at the browser level before data transmission, performing the encryption action in advance. This preliminary encryption at the client side reduces the computational burden on the server and WAF, as the data is already encrypted before reaching the processing systems, thereby minimizing repeated computational overhead while maintaining security.
3Object-affected harmful factors
If data is encrypted before transmission, then data exposure to third parties is prevented, but processing speed decreases
Solution Approach 1:
The patent performs encryption as a preliminary action at the browser level before data transmission to the WAF. By encrypting data at the client side in advance, the system prevents data exposure to third-party WAF providers while the encryption operation is completed before the data needs to be processed, minimizing the impact on processing speed.
Solution Approach 2:
Homomorphic encryption serves as an intermediary that enables data to remain encrypted throughout the transmission and processing pipeline. This intermediary cryptographic layer allows data to be processed without decryption, maintaining both security against third-party exposure and acceptable processing performance by eliminating the need for decryption operations at the WAF.
Data Source
AI summary
A method and apparatus for avoiding exposure of data that was entered into a web application in the context of having that data scanned by a third-party web application firewall (WAF). The apparatus receives, in response to forwarding a request to a web application, a response from the web application that includes a web form. The apparatus forwards the response to a browser and in response receives a second request that includes a version of the web form modified by the browser such that data entered into a plurality of fields of the web form was extracted, aggregated, and homomorphically encrypted. The apparatus causes the second request to be scanned by the third party WAF using one or more homomorphic encryption signatures, and in response to the scanning determines whether to forward the second request to the web application or take corrective action.