Real-Time Keystroke Encryption in Web Browsers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web-based applications face security risks due to sensitive data being stored in unencrypted form within the browser's process memory, making it vulnerable to exposure through memory scraping tools, potentially leading to privacy and compliance violations.
Innovation Solution
Implementing real-time encryption of sensitive data input into web-based applications by tagging sensitive data fields, fetching a public key from a remote server, and encrypting keystroke entries before storage, ensuring data is never stored unencrypted in the browser's memory, and transmitting encrypted entries to the remote server for decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in browser process memory before encryption, then data processing is simple and fast, but sensitive data is exposed in unencrypted form creating security risks
Solution Approach 1:
The patent applies preliminary action by encrypting data at the point of entry (keystroke level) before it can be stored in browser memory. The encryption script is injected and activated before data input, ensuring data is encrypted immediately upon entry rather than after storage, thus preventing exposure while maintaining processing efficiency
Solution Approach 2:
The patent uses an intermediary approach by introducing an encryption script as a mediator between the user input and browser memory storage. This script acts as a buffer that intercepts data at keystroke level, encrypts it, and stores only encrypted form in memory, thus resolving the conflict between security and simplicity
2Reliability
If data is encrypted before storage, then sensitive data security is improved, but processing time and computational resources increase
Solution Approach 1:
Encryption is performed as a preliminary action at keystroke level, converting data to encrypted form immediately upon entry. This upfront encryption prevents later decryption needs and reduces overall processing time by eliminating post-storage encryption steps
Solution Approach 2:
The encryption system operates autonomously through injected scripts that automatically encrypt data at the source without requiring additional processing steps. The browser's native capabilities are leveraged to perform encryption efficiently, reducing external computational overhead
3Reliability
If additional encryption software or hardware is deployed, then data protection capability is enhanced, but system cost and complexity increase
Solution Approach 1:
The system uses self-service by leveraging the browser's native JavaScript capabilities and built-in cryptographic functions to perform encryption. No external encryption software or specialized hardware is required, as the browser environment itself provides the necessary cryptographic primitives
Solution Approach 2:
The encryption solution is universal in that it works within any standard web browser environment without requiring additional software installations or specialized hardware. The approach uses widely-supported cryptographic libraries that are already present in modern browsers, making it applicable across different platforms and systems
Data Source
AI summary
Techniques and systems for protecting data input to a web-based application are provided herein. A method may include executing, within a web browser being executed by a computer system, a web-based application. Execution of the web-based application may include tagging one or more data fields as sensitive and fetching a public key from a remote server system. The method may include identifying, by the web-based application, a keystroke entry being input into the one or more data fields tagged as sensitive within the web-based application. Prior to storing the keystroke entry in memory mapped to the web browser, the method may include encrypting by the web-based application, the keystroke entry using the fetched public key to generate an encrypted entry. The web browser may store the encrypted entry to memory. Importantly, the keystroke entry may never be stored to the memory of the web browser in an unencrypted form.