Web Page Non-Editable Field Encryption and Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web pages with non-editable fields are vulnerable to malicious user exploits, as updates to these fields can be altered by users, leading to potential data integrity issues and security breaches, while existing solutions either fail to persist updates effectively or incur memory and performance costs.
Innovation Solution
Implementing a system where non-editable fields are encrypted with a unique one-way encryption key, stored on the server, and verified upon submission, ensuring that only server-generated values are persisted, thus preventing unauthorized alterations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If non-editable fields are updated by the server without encryption, then the web page can dynamically display updated values, but malicious users can exploit and alter these values leading to data integrity issues
Solution Approach 1:
An encryption key is introduced as an intermediary element between the server and the non-editable field. The server encrypts the field value before displaying it, and the encrypted value is verified upon form submission. This intermediary encryption mechanism prevents malicious users from directly altering the field values while maintaining the dynamic update capability.
2Reliability
If encryption keys are stored on the server for all sessions, then data integrity can be maintained, but memory consumption increases
Solution Approach 1:
Instead of storing encryption keys globally for all sessions, the system stores encryption keys locally within individual session objects. Each session object that requires encrypted non-editable fields has its own encryption key stored in its associated session object, rather than maintaining a centralized key store. This localized approach reduces overall memory consumption while maintaining security.
3Reliability
If all field updates are persisted to database, then data is preserved, but performance and memory are consumed
Solution Approach 1:
The system applies partial persistence by only persisting updates to non-editable fields that have been encrypted and verified, rather than persisting all field updates. The verification process checks whether a non-editable field has been modified before attempting to persist it, avoiding unnecessary database operations for fields that maintain their original server-generated values, thus improving processing efficiency.
Data Source
AI summary
A method of processing non-editable fields in a web page is provided herein. The method includes receiving a request comprising a submitted form of the web page. The request may include a target field value generated by a web server. The target field value may be non-editable on the web page. The method further includes determining that the web page comprises a hidden key associated with the target field value. Additionally, the method includes encrypting the target field value using an encryption key and a one-way encryption algorithm. The method also includes determining that the encrypted target field value matches the hidden key. Further, the method includes persisting the target field value.