Security Module Key Negotiation for Direct Browser Data Transmission
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for secure data communication between a web browser on a mobile device and a server using a security module, such as a SIM card, face limitations due to slow data transmission rates and inadequate security, particularly with malicious code compromising the browser's ability to maintain secure connections.
Innovation Solution
A method where the security module negotiates a secret key with the server, derives encryption and decryption keys, and transmits one key to the web browser, allowing direct data transmission in one direction while ensuring security by maintaining control over data through the security module, even if the end device is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data transmission is routed through the security module for encryption/decryption, then security is improved, but data transmission speed deteriorates
Solution Approach 1:
The data transmission path is segmented into two directions: one direction (browser to server) routes through the security module for encryption, while the other direction (server to browser) transmits directly without security module intervention. This segmentation allows security-critical traffic to be protected while bulk data transmission occurs at full speed.
Solution Approach 2:
The security module acts as an intermediary only for key management and one-directional encryption, while the web browser itself performs encryption/decryption for the other direction using keys obtained from the security module. This reduces the security module's bottleneck effect while maintaining security.
2Reliability
If the security module processes all data for encryption/decryption, then security is improved, but device complexity increases
Solution Approach 1:
The heavy data processing function is extracted from the security module and transferred to the web browser. The security module retains only key generation, key storage, and one-directional encryption functions, while the browser handles the bulk of encryption/decryption operations using its own processor.
3Speed
If the security module is removed from the data path, then data transmission speed is improved, but security deteriorates
Solution Approach 1:
Different security measures are applied to different directions of data transmission. The direction from browser to server uses full security module protection, while the direction from server to browser uses browser-based encryption with keys from the security module. This local differentiation optimizes both speed and security for each transmission direction.
4Speed
If the browser handles encryption/decryption directly, then data transmission speed is improved, but security against malicious code deteriorates
Solution Approach 1:
The security module performs preliminary action by generating and securely storing encryption keys before data transmission begins. The browser then uses these pre-established keys for encryption/decryption operations, combining the security of pre-established key management with the speed of browser-based processing.
Solution Approach 2:
The security module serves as an intermediary for key management and authentication, while the browser handles actual data encryption/decryption. This intermediary relationship allows the browser to perform fast processing while the security module maintains control over cryptographic credentials.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The method involves negotiating a secret date between a safety module (30) and a server (40) and deriving a code from the secret date through the safety module. The derived code is transmitted to the web browser (20). The secured data communication is carried out between the server and the web browser such that the data communication takes place in a transmission direction by using the derived code without interconnection of the safety module.