Cross-Origin Encryption Frames to Isolate Sensitive Web Data

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing online applications that encrypt data face issues with scripts from the same origin accessing encrypted content due to document object model access, compromising data security.

Innovation Solution

Implementing a second application from a different origin, such as an inline frame, to handle sensitive data encryption and decryption, ensuring the first application remains inaccessible to the encrypted data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If scripts are hosted from the same origin as the parent application, then they can access the document object model and interact with the application, but they can also access encrypted content in unencrypted form, compromising data security

Engineering Contradiction:
Improvescript access to DOMVSAvoiddata security
Core Design Contradiction:
Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a second application hosted from a different origin that acts as an intermediary between the client application and the encryption system. This intermediary handles the encryption and decryption operations while being inaccessible to the first application's scripts, thus preventing unauthorized access to unencrypted data while still enabling encryption functionality.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent divides the application into two separate applications hosted from different origins. The first application handles the user interface and business logic, while the second application handles encryption operations. This segmentation prevents scripts from the first application from accessing the DOM and unencrypted data in the second application.

Inventive Principle:
Principle #1Segmentation

2Object-affected harmful factors

If a second application from a different origin is used to handle encryption, then data security is improved, but the system complexity increases

Engineering Contradiction:
Improvedata securityVSAvoidsystem architecture
Core Design Contradiction:
Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The second application serves as a sandboxed intermediary that handles encryption operations. By isolating encryption functionality in a separate application from a different origin, the system achieves better security without requiring complex internal access control mechanisms within the first application.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The second application independently handles encryption and decryption operations using its own DOM and cryptographic engine, without requiring direct access to or manipulation of the first application's internal structures. This self-service approach simplifies the overall system architecture by making the encryption component autonomous.

Inventive Principle:
Principle #25Self-service

Data Source

PatentEP4083836B1Systems and methods for controlling data access in client-side encryption
Publication Date: 2026.01.21 GOOGLE LLC
  • EP4083836B1 patent drawingFigure 1
  • EP4083836B1 patent drawingFigure 2A~2B
  • EP4083836B1 patent drawingFigure 3

AI summary

Systems and methods for controlling access to data in applications using client-side encryption. In that regard, in some examples, a first application (e.g., an email application, calendar application, messaging application, word processing application, file storage application, etc.) hosted from a particular web domain may be configured to invoke a second application hosted from a different origin (e.g., a different web domain or subdomain) to handle receiving and encrypting any sensitive information from a client entered through a client application (e.g., a web browser), and to handle decrypting information to be provided to the client through the client application. This second application may be loaded in an inline frame or similar subwindow or subroutine configured to prevent or limit the first application from having access to sensitive information in the second application.