Cross-Origin Client-Side Encryption for DOM Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing online applications that encrypt data face issues with scripts from the same origin accessing encrypted content due to document object model access, compromising data security.
Innovation Solution
Implementing a second application from a different origin, such as an inline frame, to handle sensitive data encryption and decryption, preventing the first application from accessing the encrypted data by acting as a sandboxed intermediary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single application handles both data processing and encryption, then device complexity is reduced, but data security is compromised due to script access to DOM
Solution Approach 1:
The system divides the application into two separate applications hosted from different origins: a first application for data processing and a second application for encryption/decryption. This segmentation prevents the first application's scripts from accessing encrypted data through DOM manipulation, as cross-origin isolation blocks such access.
Solution Approach 2:
The second application acts as an intermediary between the client application and the encryption process. It receives data from the first application, performs encryption or decryption operations, and returns the result, while maintaining security boundaries that prevent unauthorized access to sensitive information.
2Ease of operation
If scripts from the same origin access the DOM, then ease of operation is improved, but data security deteriorates due to unauthorized access to encrypted content
Solution Approach 1:
By hosting the encryption functionality in a separate application from a different origin, the system creates security boundaries that prevent scripts from the first application from accessing encrypted data through DOM manipulation, while still allowing controlled communication between the two applications.
3Device complexity
If encrypted data is stored in the same application context, then device complexity is reduced, but access control precision deteriorates allowing unauthorized scripts to read data
Solution Approach 1:
The system separates data storage and encryption functions into different application contexts with different origins. This enables precise access control where the first application can store and process data, but only the second application can access and decrypt the encrypted content, preventing unauthorized scripts from reading sensitive information.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
Systems and methods for controlling access to data in applications using client-side encryption. In that regard, in some examples, a first application (e.g., an email application, calendar application, messaging application, word processing application, file storage application, etc.) hosted from a particular web domain may be configured to invoke a second application hosted from a different origin (e.g., a different web domain or subdomain) to handle receiving and encrypting any sensitive information from a client entered through a client application (e.g., a web browser), and to handle decrypting information to be provided to the client through the client application. This second application may be loaded in an inline frame or similar subwindow or subroutine configured to prevent or limit the first application from having access to sensitive information in the second application.