Service Worker Diffie-Hellman Key Exchange for Web Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional web technologies struggle to reliably and securely differentiate between good and bad clients, making them susceptible to attacks like Man-in-the-middle, Man-in-the-browser, and Cross-site Scripting attacks, especially with long-lived tokens and cookie sessions being vulnerable.
Innovation Solution
The system employs a service worker to establish a secure communication channel with a server through a Diffie-Hellman key exchange, using a shared-secret generated from service worker and server public keys, which helps validate the client and prevent attacks by ensuring only authorized clients can access data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional web technology is used for client identification, then the system is simple to operate, but the system cannot reliably differentiate between good and bad clients, making it susceptible to attacks
Solution Approach 1:
The service worker establishes a secure communication channel with the server before processing any web traffic. This preliminary action includes performing Diffie-Hellman key exchange and storing the shared secret in secure storage, enabling the system to reliably identify and authenticate clients before any potential attacks can occur.
Solution Approach 2:
The service worker acts as an intermediary component between the browser and the server. It intercepts and inspects web traffic, performs security validations using the pre-established secure channel, and decides whether to allow requests to proceed. This intermediary role enables reliable client identification without requiring complex changes to the existing server architecture.
2Ease of operation
If long-lived tokens and cookie sessions are provided for one-click checkout experience, then the ease of operation is improved, but the vulnerability to manipulation and attacks by bad clients increases
Solution Approach 1:
The service worker continuously monitors and inspects web traffic passing through it, providing real-time feedback on the authenticity of requests. By validating each request against the pre-established secure channel credentials, the system can detect and block malicious attempts to manipulate long-lived tokens or cookie sessions, even while maintaining the convenience of one-click checkout functionality.
3Reliability
If two-step authentication is implemented, then some security is improved, but it is still insufficient to avoid attacks by bad clients
Solution Approach 1:
Instead of relying on two-step authentication during the login process, the system performs the authentication action in advance by establishing a secure communication channel before the user even logs in. The service worker and server perform Diffie-Hellman key exchange and store credentials in secure storage, creating a trusted foundation that automatically validates all subsequent traffic without requiring additional user interaction or complex authentication steps.
Data Source
AI summary
Disclosed are methods, systems, and non-transitory computer-readable medium for enhancing web security. For instance, the method may include transmitting a request to a server, the request including a payload and a service worker public key, the service worker public key corresponding to a service worker private key. The method may also include receiving a push from the server, the push including a server public key that corresponds to a server private key, and receiving a response to the request from the server. The method may also include constructing a shared-secret based on the service worker private key and the server public key, and decrypting the response using the shared-secret.