Cross-Origin Client-Side Encryption for DOM Access Control

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing online applications that encrypt data face issues with scripts from the same origin accessing encrypted content due to document object model access, compromising data security.

Innovation Solution

Implementing a second application from a different origin, such as an inline frame, to handle sensitive data encryption and decryption, preventing the first application from accessing the encrypted data by acting as a sandboxed intermediary.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Device complexity

If a single application handles both data processing and encryption, then device complexity is reduced, but data security is compromised due to script access to DOM

Engineering Contradiction:
Improveapplication structureVSAvoiddata security
Core Design Contradiction:
Device complexityVSReliability

Solution Approach 1:

The system divides the application into two separate applications hosted from different origins: a first application for data processing and a second application for encryption/decryption. This segmentation prevents the first application's scripts from accessing encrypted data through DOM manipulation, as cross-origin isolation blocks such access.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The second application acts as an intermediary between the client application and the encryption process. It receives data from the first application, performs encryption or decryption operations, and returns the result, while maintaining security boundaries that prevent unauthorized access to sensitive information.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Ease of operation

If scripts from the same origin access the DOM, then ease of operation is improved, but data security deteriorates due to unauthorized access to encrypted content

Engineering Contradiction:
Improvescript accessVSAvoiddata security
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

By hosting the encryption functionality in a separate application from a different origin, the system creates security boundaries that prevent scripts from the first application from accessing encrypted data through DOM manipulation, while still allowing controlled communication between the two applications.

Inventive Principle:
Principle #1Segmentation

3Device complexity

If encrypted data is stored in the same application context, then device complexity is reduced, but access control precision deteriorates allowing unauthorized scripts to read data

Engineering Contradiction:
Improveapplication structureVSAvoidaccess control
Core Design Contradiction:
Device complexityVSMeasurement precision

Solution Approach 1:

The system separates data storage and encryption functions into different application contexts with different origins. This enables precise access control where the first application can store and process data, but only the second application can access and decrypt the encrypted content, preventing unauthorized scripts from reading sensitive information.

Inventive Principle:
Principle #1Segmentation

Data Source

PatentEP4083835B1Systems and methods for controlling data access in client-side encryption
Publication Date: 2025.09.17 GOOGLE LLC
  • EP4083835B1 patent drawingFigure 1
  • EP4083835B1 patent drawingFigure 2A~2B
  • EP4083835B1 patent drawingFigure 3

AI summary

Systems and methods for controlling access to data in applications using client-side encryption. In that regard, in some examples, a first application (e.g., an email application, calendar application, messaging application, word processing application, file storage application, etc.) hosted from a particular web domain may be configured to invoke a second application hosted from a different origin (e.g., a different web domain or subdomain) to handle receiving and encrypting any sensitive information from a client entered through a client application (e.g., a web browser), and to handle decrypting information to be provided to the client through the client application. This second application may be loaded in an inline frame or similar subwindow or subroutine configured to prevent or limit the first application from having access to sensitive information in the second application.