Mobile-ID Quantum Safe
Open Demo Lab

PRODUCT MANUAL

QuantumSafe Data Shield
Technical usage guide

Protect selected fields, files, messages and API payloads before they cross shared infrastructure, using versioned hybrid/PQC envelope profiles and protected backend key services.

Open demoProduct profile

OVERVIEW

QuantumSafe Data Shield

TLS can terminate at gateways, proxies or service meshes. Sensitive payloads may still be exposed to shared infrastructure, logs, backups or future harvest-now-decrypt-later attacks.

WORKFLOW

  1. 01 Load an approved browser/client protection profile
  2. 02 Select protected fields, files or message content
  3. 03 Establish a short-lived hybrid/PQC content-key session
  4. 04 Encrypt and bind origin, transaction, nonce and policy metadata
  5. 05 Route ciphertext through gateway, email or storage infrastructure
  6. 06 Decrypt only in the authorized backend and erase session keys

COMPONENT REFERENCE

COMPONENT ARCHITECTURE

Keep sensitive payloads encrypted across shared infrastructure and expose plaintext only inside the approved backend boundary.

Client protection, protected envelopes, ciphertext-only routing, HSM-backed decryption and cross-cutting policy are shown as distinct security zones.

SOURCE INPUTS
Sensitive fieldsJSON payloadFiles / messages
CLIENT SECURITY ZONE
01

Browser & Client SDK

Selects protected fields, binds origin and transaction context, and encrypts before the application submits data.

CLIENT ZONE
02

QuantumSafe Envelope

Carries algorithm identifiers, encapsulated key references, AEAD metadata, nonce, transaction ID and policy version.

PROTECTED PAYLOAD
CIPHERTEXT-ONLY ZONE
03

API & Message Gateway Adapter

Authenticates and routes protected envelopes while preventing intermediary logs and middleware from receiving plaintext.

CIPHERTEXT ONLY
PROTECTED BACKEND ZONE
04

HSM-backed Decryption Service

Performs approved decapsulation or unwrap, authenticated decryption and immediate session-key zeroization.

PROTECTED BACKEND
05

Secure Email & File Connector

Packages protected files or message bodies for controlled recipient onboarding, retrieval and enterprise recovery.

CONTROLLED DELIVERY
GOVERNED OUTPUTS
Authorized serviceControlled recipientAudit evidence

INTERFACES

  • JavaScript/WebAssembly SDK
  • REST/OpenAPI
  • Email/file connector
  • HSM/KMS
  • Windows CNG/KSP option
  • Audit/event API

LIMITATIONS & ACCEPTANCE

  • The included browser demo uses Web Crypto AES-GCM to demonstrate the envelope workflow; production PQC KEM integration requires an approved provider/profile.
  • TLS, application authentication, authorization and secure coding remain mandatory.
  • Browser, mobile, payload-size, email-client and recipient-recovery combinations require explicit compatibility testing.