xArmor: Split-Channel HTTPS Proxy

The Problem

HTTPS protects data in transit, but the destination server sees everything in plaintext. A compromised server endpoint, rogue admin, or insider threat exposes all request data -- credentials, payment info, medical records.

Modern APIs handle billions of sensitive requests daily. Each request terminates TLS at the server, exposing the full payload to the application layer. Server-side breaches, supply chain attacks, and insider threats mean that transit encryption alone is insufficient.

API keys stored in configuration files create a single authentication point. If the config is compromised, the attacker has full API access. There is no threshold authentication, no split-channel protection, and no way to limit what any single server instance can see.

The Old Way

The PRIVATE.ME Solution

xArmor sits as a transparent reverse proxy that intercepts HTTP request bodies, splits them via XorIDA into N shares, and sends each share over an independent HTTPS connection to a separate upstream instance. DID-based mutual authentication ensures only verified instances participate.

No single upstream server ever sees the complete request payload. Even if one server is fully compromised, the attacker obtains only one share -- which reveals zero information about the original data without K-1 additional shares.

DID mutual authentication replaces static API keys with cryptographic identity. Each proxy instance has an Ed25519 DID. Requests are signed and verified. No shared secrets, no config files to steal, no key rotation ceremonies.

The New Way

How It Works

Transparent HTTP proxy layer: client sends a normal request, xArmor intercepts, splits the body, fans out to upstream instances, and the reassembly proxy reconstructs the original payload before forwarding to the application.

Use Cases

Integration

import { createProxy, configureRoutes } from '@private.me/xarmor';

// Create split-channel proxy with 3 upstreams
const proxy = await createProxy({
  n: 3,
  k: 2,
  upstreams: [
    'https://us-east.api.example.com',
    'https://eu-west.api.example.com',
    'https://ap-south.api.example.com',
  ],
});

// Configure which routes to split
configureRoutes(proxy, {
  split: ['/api/payments', '/api/patients'],
  passthrough: ['/api/health'],
});

Security Properties

Benchmarks

Performance characteristics measured on Node.js 22, Apple M2. xArmor adds minimal latency while eliminating plaintext exposure at the proxy layer.

Comparison: Traditional Proxy vs xArmor

Ship Proofs, Not Source

xArmor generates cryptographic proofs of correct execution without exposing proprietary algorithms. Verify integrity using zero-knowledge proofs — no source code required.

Use Cases

Honest Limitations

Five known limitations documented transparently. xArmor’s security guarantees come with measurable trade-offs.

Verifiable Data Protection

Every operation in this ACI produces a verifiable audit trail via xProve. HMAC-chained integrity proofs let auditors confirm that data was split, stored, and reconstructed correctly — without accessing the data itself.

Ready to deploy xArmor?

Talk to Ren, our AI sales engineer, or book a live demo with our team.