Hi i am working with JSON. I want to protect my JSON . I am getting JSON on the User Interface side by a service call using a Jquery. Is there some mechanism by which the JSON which i am returning from my service is encrypted JSON and when i am receiving that JSON using JQuery i can decrypt it. But at the time of decryption i dont want to expose the Key or certificate for decryption to the Frontend. How can i protect my JSON.
Some answers mention here SSL/TLS. SSL/TLS is used to encrypt the whole data between two communicating parties, typically client and server (also called point-to-point encryption). This standard however does not always cover all the security needs, e.g.:
- if the user wants to encrypt only part of his data.
- if the user wants to transfer his data over several machines (web services) and does not want the machines see the data, he needs end-to-end security. (In case of TLS, each intermediary machine can decrypt the data, see the content, encrypt it again and forward it to further machine.)
- if the user wants to store the data encrypted on the server, which receives it.
You did not describe your scenario very well, but I assume you would like to encrypt your json data because of one the above points. If this is the case, you can use the newly standardized JSON Web Encryption Standard (http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption), which gives you possibilities to encrypt json data. Even though it is still a draft, there are already some implementations. If you are implementing a Web site, you can take a look at Web Crypto API (http://www.w3.org/TR/WebCryptoAPI/).