Secure DOM Elements for Client-Side Encryption

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing web browsers face challenges in securing data within web applications, as client-side encryption may not protect against malicious code accessing clear data values, allowing potential data leaks even when encrypted data is stored remotely.

Innovation Solution

Implementing secure data elements in the Document Object Model (DOM) that include both clear and encrypted values, where the web browser permits access only to the encrypted values for web applications, while other components can access the clear values, ensuring that web applications cannot access the clear data directly.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If client-side encryption is implemented in web browsers, then data security during storage is improved, but web applications can still access clear data values through malicious code, leading to data leaks

Engineering Contradiction:
Improvedata security during storageVSAvoiddata access by malicious web applications
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces secure elements as an intermediary component between the web application and the data storage system. These secure elements act as a mediator that receives data from web applications, encrypts it using cryptographic tools, and stores it in secure storage. The secure elements prevent direct access to clear data by malicious web applications while still allowing authorized access through cryptographic mechanisms.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the data storage system into multiple components: regular storage for unencrypted data, secure storage for encrypted data, and secure elements that manage the encryption process. This segmentation isolates sensitive data in a protected environment, preventing web applications from directly accessing clear data values while maintaining the functionality of web applications through controlled data retrieval.

Inventive Principle:
Principle #1Segmentation

2Ease of operation

If clear data values are stored in the DOM for web application access, then web application functionality is improved, but data security is compromised as malicious code can access and leak sensitive information

Engineering Contradiction:
Improveweb application data accessVSAvoiddata security against malicious code
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The secure elements serve as an intermediary layer between the DOM and web applications. Instead of storing clear data values directly in the DOM where malicious code can access them, the system stores encrypted values in the DOM and uses secure elements as intermediaries to decrypt and provide data to authorized web applications through controlled interfaces.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent applies different security qualities to different parts of the data storage system. Regular DOM elements maintain their traditional accessibility for non-sensitive data, while secure elements implement specialized encryption and access control mechanisms for sensitive data. This local differentiation allows web applications to access necessary data while preventing unauthorized access to sensitive information.

Inventive Principle:
Principle #3Local quality

Data Source

PatentUS11537760B2Web application execution with secure elements
Publication Date: 2022.12.27 SAP SE
  • US11537760B2 patent drawing
  • US11537760B2 patent drawing
  • US11537760B2 patent drawing

AI summary

Various examples are directed to systems and methods for executing a web application with client-side encryption. A web application may execute in a web browser at a client computing device. The web browser may generate a document comprising a secure display element. The web browser may request to render the document at the client computing device. A cryptographic tool of the web browser may decrypt the first encrypted value to generate a first clear value. The web browser may render the document at an output device of the client computing device using the clear value. The web browser may also be programmed to prevent the web application from accessing the first clear value.