IP Library › Granted Patent US 12675269

Granted Patent B2

US 12675269 · App. 18/467,502 · Granted Jul 7, 2026

Containerized, decentralized, and distributed web applications with end-to-end encryption

Inventor: Zbigniew Józef Zemła (Katowice, PL)

Assignee: Shore Labs Zbigniew ZEMŁA

G06F8/63 G06F8/62 H04L67/141

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12675269
App. No.: 18/467,502
Granted: Jul 7, 2026
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A method performed by a relay server for facilitating communications between a web application executing in a web browser and one or more client computing devices. The method includes receiving a selected domain name under which the web application is to be registered, verifying that the web application is allowed to be registered under the selected domain name based on accessing a record associated with the selected domain name in a domain name system (DNS) database, registering the web application under the selected domain name, relaying messages associated with the selected domain name that are received from the one or more client computing devices to the web application over a first bidirectional communication connection established between the web application and the relay server, and relaying messages received from the web application over the first bidirectional communication connection to respective ones of the one or more client computing devices.

Claims (76)

1 . A method performed by a relay server for facilitating communications between a web application executing in a web browser of a source computing device and one or more client computing devices, the method comprising:

receiving a selected domain name under which the web application executing in the web browser is to be registered and an identity string that is claimed by the web application, wherein the web application is executed entirely in the web browser;

verifying that the web application is allowed to be registered under the selected domain name based on accessing a record associated with the selected domain name in a domain name system (DNS) database and verifying that the record associated with the selected domain name references the identity string, wherein the identity string is separate from a network address associated with the web application;

registering the web application under the selected domain name in response to verifying that the web application is allowed to be registered under the selected domain name;

relaying messages associated with the selected domain name that are received from the one or more client computing devices to the web application over a first bidirectional communication connection established between the web application and the relay server;

relaying second messages received from the web application over the first bidirectional communication connection to respective ones of the one or more client computing devices;

receiving a request from the web application over the first bidirectional communication connection to execute a particular code provided by the web application when the relay server receives requests at the selected domain name; and

registering a handler for executing the particular code provided by the web application without involving the web application when the relay server receives the requests at the selected domain name.

2 . The method of claim 1 , further comprising:

receiving a bootloader code associated with the web application from the web application over the first bidirectional communication connection; and

sending the bootloader code to a first web browser executed by one of the one or more client computing devices over a second bidirectional communication connection established between the relay server and the first web browser, wherein the bootloader code is to be executed by the first web browser and includes code to communicate with the web application via the relay server over the first bidirectional communication connection and the second bidirectional communication connection.

3 . The method of claim 2 , wherein the bootloader code further includes code to load resources associated with the web application.

4 . The method of claim 1 , further comprising:

receiving a request from the web application over the first bidirectional communication connection to relay Hypertext Transfer Protocol (HTTP) requests received at the selected domain name to the web application; and

registering a handler for relaying HTTP requests received at the selected domain name to the web application over the first bidirectional communication connection.

5 . The method of claim 1 , further comprising:

receiving a request from the web application over the first bidirectional communication connection to relay email messages received at the selected domain name to the web application; and

registering a handler for relaying contents of email messages received from mail transfer agents at the selected domain name to the web application over the first bidirectional communication connection.

6 . The method of claim 1 , further comprising:

receiving a request from the web application over the first bidirectional communication connection to serve static content when the relay server receives requests at a specified path of the selected domain name; and

registering a handler for serving the static content without involving the web application when the relay server receives the requests at the specified path of the selected domain name.

7 . The method of claim 1 , further comprising:

receiving a token that is signed using an encryption key associated with an identity provider domain;

accessing a record associated with the identity provider domain in the DNS database;

obtaining a verification key associated with the identity provider domain from the record associated with the identity provider domain;

using the verification key associated with the identity provider domain to determine whether the token is valid; and

verifying the identity string based on a result of the determination of whether the token is valid.

8 . The method of claim 1 , wherein the record associated with the selected domain name references the identity string using a wildcard.

9 . The method of claim 1 , wherein the web application and a first web browser executed by one of the one or more client computing devices communicate with each other via the relay server using end-to-end encryption that is opaque to the relay server, wherein the end-to-end encryption is achieved through a key exchange and validation mechanism that involves accessing records in the DNS database.

10 . The method of claim 1 , further comprising:

receiving a message from the web application over the first bidirectional communication connection; and

sending the message to one or more other web applications that are also registered under the selected domain name over respective bidirectional communications established with the one or more other web applications.

11 . The method of claim 1 , wherein the web browser stores a collection of files associated with the web application in a non-volatile storage location managed by the web browser that is scoped to a domain name that is the same as the selected domain name or different from the selected domain name, wherein the web browser has a mechanism registered therein that serves one or more files from the collection of files associated with the web application upon request.

12 . A network device configured to implement a relay server for facilitating communication between a web application executing in a web browser of a source computing device and one or more client computing devices, the network device comprising:

one or more processors; and

a non-transitory machine-readable storage medium storing instructions that, when executed by the one or more processors, causes the relay server to:

receive a selected domain name under which the web application executing in the web browser is to be registered and an identity string that is claimed by the web application, wherein the web application is executed entirely in the web browser,

verify that the web application is allowed to be registered under the selected domain name based on accessing a record associated with the selected domain name in a domain name system (DNS) database and verifying that the record associated with the selected domain name references the identity string, wherein the identity string is separate from a network address associated with the web application,

register the web application under the selected domain name in response to verifying that the web application is allowed to be registered under the selected domain name,

relay messages associated with the selected domain name that are received from the one or more client computing devices to the web application over a first bidirectional communication connection established between the web application and the relay server,

relay second messages received from the web application over the first bidirectional communication connection to respective ones of the one or more client computing devices,

receive a request from the web application over the first bidirectional communication connection to execute a particular code provided by the web application when the relay server receives requests at the selected domain name, and

register a handler for executing the particular code provided by the web application without involving the web application when the relay server receives the requests at the selected domain name.

13 . The network device of claim 12 , wherein the instructions, when executed by the one or more processors, further causes the relay server to:

receive a bootloader code associated with the web application from the web application over the first bidirectional communication connection; and

send the bootloader code to a first web browser executed by one of the one or more client computing devices over a second bidirectional communication connection established between the relay server and the first web browser, wherein the bootloader code is to be executed by the first web browser and includes code to communicate with the web application via the relay server over the first bidirectional communication connection and the second bidirectional communication connection.

14 . The network device of claim 13 , wherein the bootloader code further includes code to load resources associated with the web application.

15 . The network device of claim 12 , wherein the instructions, when executed by the one or more processors, further causes the relay server to:

receive a request from the web application over the first bidirectional communication connection to relay Hypertext Transfer Protocol (HTTP) requests received at the selected domain name to the web application and

register a handler for relaying HTTP requests received at the selected domain name to the web application over the first bidirectional communication connection.

16 . The network device of claim 12 , wherein the instructions, when executed by the one or more processors, further causes the relay server to:

receive a request from the web application over the first bidirectional communication connection to relay email messages received at the selected domain name to the web application and

register a handler for relaying contents of email messages received from mail transfer agents at the selected domain name to the web application over the first bidirectional communication connection.

17 . The network device of claim 12 , wherein the instructions, when executed by the one or more processors, further causes the relay server to:

receive a token that is signed using an encryption key associated with an identity provider domain;

access a record associated with the identity provider domain in the DNS database;

obtain a verification key associated with the identity provider domain from the record associated with the identity provider domain;

use the verification key associated with the identity provider domain to determine whether the token is valid; and

verify the identity string based on a result of the determination of whether the token is valid.

18 . A non-transitory machine-readable storage medium storing instructions that, when executed by a network device implementing a relay server, causes the relay server to perform operations for facilitating communication between a web application executing in a web browser of a source computing device and one or more client computing devices, the operations comprising: