Browser Certificate Authentication for End-to-End TLS Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing TLS protocols face challenges in ensuring secure communication between a browser and a server due to intermediate endpoints that can expose sensitive data to internal and external threats, as conventional certificate validation is not accessible or reliable in all deployment scenarios, particularly when multiple TLS paths are involved.
Innovation Solution
A method where a browser receives a server's certificate and random numbers, generates and compares hash values, and encrypts data using a derived encryption key, while the server authenticates using its private key, ensuring end-to-end protection of sensitive data without relying solely on point-to-point security protocols like TLS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If TLS connection terminates at intermediate endpoints (load balancer, infrastructure device), then data can be decrypted for inspection and control, but sensitive data is exposed to internal and external threats
Solution Approach 1:
The patent segments the authentication process into two independent parts: TLS protocol authentication (for encrypted communication) and certificate hash authentication (for server identity verification). This segmentation allows data to remain encrypted end-to-end while still enabling inspection of authentication credentials at intermediate endpoints, thus maintaining security while allowing operational control.
Solution Approach 2:
The patent introduces certificate hash values as an intermediary authentication mechanism. Instead of exposing sensitive data for inspection, the system inspects only the certificate hash and random numbers, which serve as mediators that verify server identity without revealing the actual sensitive communication content.
2Reliability
If conventional TLS certificate validation is used, then point-to-point security is established, but it is not accessible or reliable in all deployment scenarios with multiple TLS paths
Solution Approach 1:
The patent creates a copy of the certificate verification process that can be performed by the browser independently of the server's TLS implementation. By computing and comparing certificate hashes locally, the browser can verify server identity without relying on the server's certificate validation capabilities, making the system adaptable to various deployment scenarios including those with multiple TLS paths or untrusted intermediates.
3Object-affected harmful factors
If end-to-end encryption is implemented, then sensitive data is protected from intermediate endpoints, but certificate validation must be performed by the browser without server assistance
Solution Approach 1:
The patent extracts the essential verification element (certificate hash) from the complex TLS certificate validation process. By taking out only the critical authentication data needed for verification and comparing it with the server-provided hash, the browser can perform end-to-end encryption verification without implementing the entire TLS certificate validation stack, thus reducing complexity while maintaining security.
Data Source
AI summary
The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for determining, by a browser, data cipher by encrypting data using a first encryption key, the first encryption key is generated using a first random number, a second random number, and a third random number. The browser sends to a server, the data cipher. The browser determines a key cipher by encrypting the third random number using a certificate of the server. The browser sends to the server the key cipher.