OAuth Client Secret Encryption for Browser Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing OAUTH client-secrets in browser/native mobile applications are convoluted and do not scale well, particularly when redirecting between different domains or browser instances, leading to potential security risks and data exposure.
Innovation Solution
A method is introduced to generate an 'Extended Client-Secret' using the SHA256Hash of Client-ID and Client-Secret XORed with a nonce, which is used to encrypt and decrypt data across browser sessions, ensuring secure data transfer without relying on new pre-shared secrets and maintaining randomness through nonce rotation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SAML or JWT is used to secure data during redirects, then data security is improved, but system complexity increases and scalability deteriorates
Solution Approach 1:
The patent extracts the security function from complex frameworks like SAML and JWT, isolating the core requirement to secure data during redirects. It then implements a minimal solution using only the existing OAUTH client-secret and nonce, eliminating unnecessary cryptographic overhead while maintaining security.
Solution Approach 2:
Instead of using pre-established secure channels or complex token frameworks, the patent inverts the approach by deriving encryption keys dynamically from the OAUTH client-secret and nonce that are already being exchanged. This reverses the traditional paradigm of establishing security before data transfer.
2Reliability
If pre-shared secrets are used for encryption, then data protection is improved, but security deteriorates due to potential exposure in browser context
Solution Approach 1:
The patent performs preliminary action by deriving the encryption key before data transfer using the client-secret and nonce that are already obtained during OAUTH registration. This ensures the key is established securely before any sensitive data is transmitted, preventing exposure during the transfer process.
Solution Approach 2:
The patent introduces dynamics by making the encryption key derivation process adaptive and context-dependent. The key is not a static pre-shared secret but is dynamically generated from the OAUTH client-secret and nonce, which changes with each authentication session, thereby preventing key exposure and replay attacks.
3Reliability
If client-secret is persisted securely in backend, then security is improved, but usability deteriorates for mobile application context
Solution Approach 1:
The patent enables self-service by allowing the mobile application to derive the encryption key using its own OAUTH client-secret and the nonce provided during authentication. This eliminates the need for the application to store or receive the actual client-secret, making the system secure while maintaining ease of operation in mobile contexts.
Solution Approach 2:
The patent introduces the nonce as an intermediary element that facilitates secure key derivation. The nonce acts as a mediator between the OAUTH authentication process and the encryption requirement, enabling the application to securely obtain encryption keys without direct exposure of the client-secret.
Data Source
AI summary
Systems and methods for using an OAUTH client-secret to encrypt data sent to browser are disclosed. In one embodiment, in an issuer authorization services processing apparatus comprising at least one computer processor, a method for using an OAUTH client-secret to encrypt data may include: (1) receiving, from a client, a registration request; (2) returning, to the client, a client identifier, a client secret, and a nonce; (3) generating an extended client secret using a combination of the client identifier, the client secret, and the nonce; (4) storing the extended client secret; (5) receiving, from the client, encrypted plaintext data; (6) decrypting the encrypted plaintext data using the extended client secret; and (7) providing an encrypted response to the plaintext data, the encrypted response encrypted using the extended client secret.