Cross-Origin Encryption Frames to Isolate Sensitive Web Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing online applications that encrypt data face issues with scripts from the same origin accessing encrypted content due to document object model access, compromising data security.
Innovation Solution
Implementing a second application from a different origin, such as an inline frame, to handle sensitive data encryption and decryption, ensuring the first application remains inaccessible to the encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If scripts are hosted from the same origin as the parent application, then they can access the document object model and interact with the application, but they can also access encrypted content in unencrypted form, compromising data security
Solution Approach 1:
The patent introduces a second application hosted from a different origin that acts as an intermediary between the client application and the encryption system. This intermediary handles the encryption and decryption operations while being inaccessible to the first application's scripts, thus preventing unauthorized access to unencrypted data while still enabling encryption functionality.
Solution Approach 2:
The patent divides the application into two separate applications hosted from different origins. The first application handles the user interface and business logic, while the second application handles encryption operations. This segmentation prevents scripts from the first application from accessing the DOM and unencrypted data in the second application.
2Object-affected harmful factors
If a second application from a different origin is used to handle encryption, then data security is improved, but the system complexity increases
Solution Approach 1:
The second application serves as a sandboxed intermediary that handles encryption operations. By isolating encryption functionality in a separate application from a different origin, the system achieves better security without requiring complex internal access control mechanisms within the first application.
Solution Approach 2:
The second application independently handles encryption and decryption operations using its own DOM and cryptographic engine, without requiring direct access to or manipulation of the first application's internal structures. This self-service approach simplifies the overall system architecture by making the encryption component autonomous.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
Systems and methods for controlling access to data in applications using client-side encryption. In that regard, in some examples, a first application (e.g., an email application, calendar application, messaging application, word processing application, file storage application, etc.) hosted from a particular web domain may be configured to invoke a second application hosted from a different origin (e.g., a different web domain or subdomain) to handle receiving and encrypting any sensitive information from a client entered through a client application (e.g., a web browser), and to handle decrypting information to be provided to the client through the client application. This second application may be loaded in an inline frame or similar subwindow or subroutine configured to prevent or limit the first application from having access to sensitive information in the second application.