Towards Enabling Secure Web-Based Cloud Services using Client-Side Encryption

Abstract

The recent years have brought an in ux of privacy conscious applications, that enable strong security guarantees for end-users via end-to-end or client-side encryption. Unfortunately, this application paradigm is not easily transferable to web-based cloud applications. The reason for this lies within adversary's enhanced control over client-side computing through application provided JavaScript. In this paper, we propose C M-a set of native client-side components that allow the development of web applications which provide a robust isolation layer between the client-side encrypted user data and the potentially untrusted JavaScript, while maintaining full interoperability with current client-side development practices. In addition, to enable a realistic transition phase, we show how C M can be realized for currently existing web browsers via a standard browser extension. CCS CONCEPTS • Security and privacy → Web application security; Browser security.

Review of the security challenges in web-based systems

“…Security in web applications and web systems is an overlooked part in enterprises and it is essential that it be prioritized across all organizations [18], [19], [20]. Hackers have increased efforts and enhanced their concentration on services provided across web systems [21], [22], [23].…”