Client-Side Browser Encryption Using Rolling Salt Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure communication methods, such as SSL, incur performance overhead, require additional hardware and skilled administration, and are not suitable for all applications, especially those using the HTTP protocol where encryption keys are sent to clients, making them vulnerable to decryption by middlemen.
Innovation Solution
A modified public-key encryption system using a rolling salt key derived from a session-based string, which changes with each user session, ensuring unique encryption for each character and only decryptable with a private key stored on the server, eliminating the need for full SSL configuration and reducing server load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL encryption is used to secure communications, then security is improved, but performance overhead increases and additional hardware and administrative expertise are required
Solution Approach 1:
The patent extracts the encryption operation from the server and places it in the client browser using JavaScript. The server only generates and transmits the encryption key, while the client performs the actual encryption of data before transmission. This eliminates the performance overhead of server-side SSL processing while maintaining security.
Solution Approach 2:
The client browser performs self-encryption using JavaScript before data is transmitted to the server. This self-service approach eliminates the need for server resources to be dedicated to encryption operations, thereby improving server performance while maintaining communication security.
2Reliability
If SSL encryption is implemented, then communication security is improved, but device complexity and administrative requirements increase
Solution Approach 1:
The encryption functionality is embedded directly in the client browser as JavaScript code. Users automatically benefit from encryption without needing to configure anything on their end. The server simply needs to generate and transmit the encryption key, eliminating complex SSL configuration requirements.
Solution Approach 2:
The patent replaces the mechanical SSL/TLS protocol stack with a simpler JavaScript-based encryption system. Instead of requiring server configuration, certificate validation, and complex handshakes, the system uses straightforward client-side encryption with keys transmitted through the existing HTTP protocol.
3Ease of operation
If public key encryption keys are sent to clients, then ease of operation is improved, but security deteriorates due to vulnerability to middleman decryption
Solution Approach 1:
The encryption key is segmented into two parts: a public component that is transmitted to the client and a private component that remains on the server. The client receives only the public key and uses it to encrypt data, while the server retains the private key for decryption. This segmentation prevents middlemen from accessing the complete key pair.
Solution Approach 2:
The patent introduces a salt value as an intermediary element that is combined with the public key during encryption. The salt acts as an additional layer of security that prevents middlemen from simply using the transmitted public key for decryption, while still allowing easy key distribution to clients.
Data Source
AI summary
A system and method for a web browser to convert an unencrypted character string into a cipher-text string combines a public-key encryption algorithm with a unique and constantly changing salt key. A private “server-key”, a public “client-key” and a server session ID are generated by the server, and the client-key and the session ID are sent to the browser with the code used to encrypt the message. The session-based string can be a randomly generated set of characters which changes between established user sessions and the salt key can be formed from the server session ID string. The server contains the matching code necessary to decrypt the stream using the private key.