English 
Tiếng ViệtClassify sensitive fields in the client
Browser Web SDK and client-side protection
WEB · DATA PROTECTION SOLUTION PROFILE
QuantumSafe Browser & API Protection
Solution architecture
Protect selected sensitive payloads from browser or client to an approved backend cryptographic boundary.
CUSTOMER PROBLEM
Protect selected sensitive payloads from browser or client to an approved backend cryptographic boundary.
TLS protects the channel, but sensitive fields can still be harvested, logged or exposed at intermediaries. Selected payloads may require protection before leaving the browser or client.
Solution architecture
- Portfolio class
- Data protection solution profile
- Public profile
- 2026.07
- Version rule
- Confirmed in quotation / release record
PRODUCT-SPECIFIC IMPLEMENTATION FLOW
How QuantumSafe Browser & API Protection operates from input to evidence.
Web SDK, API gateway, KMS/HSM, identity and business-service endpoints. Threat model, protocol profile, replay tests, sample integration and privacy review.
Fetch approved server key profile
Field-level and payload-level encryption
Create ephemeral hybrid/PQC session
ML-KEM/hybrid session establishment by approved profile
Encrypt payload and bind transaction metadata
API gateway and backend decryption boundary
Decrypt only inside protected backend boundary
Session binding, replay protection and key rotation
Deliver minimum plaintext and immutable audit
Masking, logging and data-minimization controls
NAMED COMPONENTS AND RESPONSIBILITIES
What QuantumSafe Browser & API Protection contains and what each component does.
The descriptions below state concrete technical behaviour rather than generic support language.
Browser Web SDK and client-side protection
Runs before form submission to select protected fields, validate origin and policy, obtain the approved server key profile and build a versioned encrypted envelope.
Field-level and payload-level encryption
Encrypts individual fields or the full request with authenticated encryption so routing metadata may remain visible while protected values stay opaque.
ML-KEM/hybrid session establishment by approved profile
Uses an approved ML-KEM or hybrid session profile to derive short-lived content-encryption keys and binds the selected algorithm identifiers into the envelope.
API gateway and backend decryption boundary
Allows gateways to authenticate, rate-limit and validate schema without decrypting protected fields; decapsulation and decryption occur only in the approved backend service.
Session binding, replay protection and key rotation
Binds ciphertext to origin, transaction ID, nonce, timestamp and selected business context, then rejects replayed, expired or mismatched requests.
Masking, logging and data-minimization controls
Masks protected values in logs, minimizes plaintext lifetime in memory and records access, decryption result, policy version and key-erasure outcome.
- Field/payload protection
- Session and transaction binding
- Developer integration pattern
Web SDK, API gateway, KMS/HSM, identity and business-service endpoints.
Embedded application integration
Client, format or application components protect data before it reaches shared infrastructure.
Gateway and protected backend
Gateways enforce identity and policy while key use or decryption occurs only inside the approved backend boundary.
Phased enterprise rollout
One data class and transaction path is proven first, then expanded through compatibility and performance gates.
- Threat model, protocol profile, replay tests, sample integration and privacy review.
- Version and configuration manifest for: Web SDK, API gateway, KMS/HSM, identity and business-service endpoints.
- Negative, failure and recovery tests for “Decrypt only inside protected backend boundary” and “Deliver minimum plaintext and immutable audit”.
- Signed acceptance record, accountable owner, published limitations and next review date.
STANDARDS & PROFILES
- Web Cryptography integration patterns
- FIPS 203 ML-KEM profiles when approved
- AES-256 envelope encryption
- API security and replay controls
PRODUCT-SPECIFIC BOUNDARIES
Conditions that must remain true for QuantumSafe Browser & API Protection.
These points come from the product profile, not from a shared disclaimer.
NEXT STEP
Review the solution architecture: QuantumSafe Browser & API Protection
Confirm trust boundaries, interfaces, threat model and productization path.