Secondary Data Encryption Via Browser Extension

Patent metadata

Field	Value
Publication number	US-2025323944-A1
Application number	US-202519250594-A
Country	US
Kind code	A1
Filing date	Jun 26, 2025
Priority date	Jul 19, 2023
Publication date	Oct 16, 2025
Grant date	—

Abstract

Methods, systems, and apparatuses are described herein for protecting sensitive data even when Transport Layer Security (TLS) communication sessions are compromised. A computing device may send, via a web browser plugin of a web browser application executing on the computing device and to one or more remote servers, a request for a server secret that comprises a device fingerprint, an identification of the web browser application, and an identification of the web browser plugin. The computing device may receive the server secret and a public certificate associated with the remote server. The computing device may establish, via the web browser application, a TLS session with the one or more remote servers. The computing device may generate a session key. The computing device may receive data comprising unencrypted data and encrypted data. The computing device may decrypt the encrypted data based on the session key.

First claim

What is claimed is:

1 . A computing device configured to protect sensitive data, the computing device comprising:
one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the computing device to:
send, to one or more remote servers, a request for a server secret that comprises:
a device fingerprint of the computing device, and
an identification of an application executing on the computing device;

receive, from the one or more remote servers and in response to the request for the server secret, the server secret;
establish a session with the one or more remote servers;
generate a session key based on:
the server secret,
the device fingerprint of the computing device, and
the identification of the application;

receive, from the remote server and via the session, data comprising unencrypted data and encrypted data; and
decrypt the encrypted data based on the session key.

2 . The computing device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the computing device to generate the session key based on a nonce string generated on a periodic basis.

3 . The computing device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
generate a first public-private key pair; sign, using a first public-private key pair, the server secret; and store the signed server secret.

4 . The computing device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
store the session key in temporary storage, wherein the temporary storage is configured to be deleted based on one or more of:
closing of the application; or
expiration of a period of time.

5 . The computing device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
generate the device fingerprint of the computing device by executing code received from the one or more remote servers.

6 . The computing device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
send, to the remote server, a request for sensitive data, wherein the encrypted data comprises the sensitive data.

7 . The computing device of claim 1 , wherein the device fingerprint identifies one or more of:
hardware components of the computing device, or a name of a network used by the computing device.

8 . A method for protecting protect sensitive data, the method comprising:
sending, by a computing device and to one or more remote servers, a request for a server secret that comprises:
a device fingerprint of the computing device, and
an identification of an application executing on the computing device;
receiving, from the one or more remote servers and in response to the request for the server secret, the server secret; establishing a session with the one or more remote servers; generating a session key based on:
the server secret,
the device fingerprint of the computing device, and
the identification of the application;
receiving, from the remote server and via the session, data comprising unencrypted data and encrypted data; and decrypting the encrypted data based on the session key.

9 . The method of claim 8 , wherein the generating the session key is based on a nonce string generated on a periodic basis.

10 . The method of claim 8 , further comprising:
generating a first public-private key pair; signing, using a first public-private key pair, the server secret; and storing the signed server secret.

11 . The method of claim 8 , further comprising:
storing the session key in temporary storage, wherein the temporary storage is configured to be deleted based on one or more of:
closing of the application; or
expiration of a period of time.

12 . The method of claim 8 , further comprising:
generating the device fingerprint of the computing device by executing code received from the one or more remote servers.

13 . The method of claim 8 , further comprising:
sending, to the remote server, a request for sensitive data, wherein the encrypted data comprises the sensitive data.

14 . The method of claim 8 , wherein the device fingerprint identifies one or more of:
hardware components of the computing device, or a name of a network used by the computing device.

15 . One or more non-transitory computer-readable media storing instructions configured to protect sensitive data, wherein the instructions, when executed by one or more processors of a computing device, cause the computing device to:
send, to one or more remote servers, a request for a server secret that comprises:
a device fingerprint of the computing device, and
an identification of an application executing on the computing device;
receive, from the one or more remote servers and in response to the request for the server secret, the server secret; establish a session with the one or more remote servers; generate a session key based on:
the server secret,
the device fingerprint of the computing device, and
the identification of the application;
receive, from the remote server and via the session, data comprising unencrypted data and encrypted data; and decrypt the encrypted data based on the session key.

16 . The one or more non-transitory computer-readable media of claim 15 , wherein the instructions, when executed by the one or more processors, cause the computing device to generate the session key based on a nonce string generated on a periodic basis.

17 . The one or more non-transitory computer-readable media of claim 15 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
generate a first public-private key pair; sign, using a first public-private key pair, the server secret; and store the signed server secret.

18 . The one or more non-transitory computer-readable media of claim 15 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
store the session key in temporary storage, wherein the temporary storage is configured to be deleted based on one or more of:
closing of the application; or
expiration of a period of time.

19 . The one or more non-transitory computer-readable media of claim 15 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
generate the device fingerprint of the computing device by executing code received from the one or more remote servers.

20 . The one or more non-transitory computer-readable media of claim 15 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
send, to the remote server, a request for sensitive data, wherein the encrypted data comprises the sensitive data.

Assignees

• Capital One Services Llc

Inventors

• Glynn Anthony
• Bhattacharya Soumendra
• Berman Collin

Classifications

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04W12/69

  Identity-dependent · CPC title

• H04W12/03

  Protecting confidentiality, e.g. by encryption · CPC title