Certificate Mapping for Software Deployment in Segregated Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Developing software applications for segregated networks is challenging due to the lack of direct access to digital secrets, such as digital certificates and cryptography keys, as these networks are isolated from external environments, preventing direct hardcoding of such secrets in source code.
Innovation Solution
Decouple the acquisition of digital secrets from referencing them in source code by using reference objects, which are placeholders, and utilize an administrative server to manage and provision digital secrets within the segregated network, generating a mapping table that maps reference objects to actual secrets, allowing seamless deployment and updates without modifying the source code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If air gapping is implemented to isolate the segregated network from external networks, then network security is improved, but the ability to acquire and manage digital secrets (certificates, keys) deteriorates
Solution Approach 1:
The system segments the digital secret management process into two independent parts: (1) reference object generation that occurs within the segregated network using only local resources, and (2) digital secret acquisition that occurs externally and is imported back into the segregated network through secure unidirectional connections. This segmentation allows the network to maintain isolation while still obtaining necessary cryptographic materials.
Solution Approach 2:
Reference objects serve as intermediaries between the software application and actual digital secrets. The reference objects are generated locally within the segregated network and act as placeholders that can be resolved to actual certificates and keys obtained through external certificate authorities. This intermediary mechanism decouples the application from direct external dependencies while maintaining security isolation.
2Ease of manufacture
If digital secrets are hardcoded in source code for external networks, then software deployment is simplified, but data security and network isolation deteriorate
Solution Approach 1:
The system performs preliminary generation of reference objects within the segregated network before the software application is deployed. These reference objects contain all necessary structural information and identifiers, allowing the application to be deployed with complete functionality while the actual digital secrets are acquired separately through secure external connections. This preliminary action eliminates the need to hardcode secrets while maintaining deployment simplicity.
3Reliability
If unidirectional network connections are used to transfer data into the segregated network, then network security is improved, but bidirectional communication and updates deteriorate
Solution Approach 1:
The system uses periodic action through unidirectional data diodes that allow controlled data transfer at specific times and directions. Reference objects are transferred into the segregated network through these unidirectional connections, and subsequently, resolved digital secrets can be transferred back out in a controlled manner. This periodic, directional data flow maintains security while enabling necessary communication patterns.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
Techniques for managing certificates in segregated networks are disclosed. One example technique includes upon receiving executable instructions of a software application and a reference table containing entries of reference objects in the software application, identifying a digital certificate independently obtained by the segregated network for each of the reference objects. The method also includes generating a mapping table having entries individually identifying the reference objects and data representing the digital certificates. The method further includes deploying for execution to one or more of the servers in the segregated network, the software application along with the generated mapping table. During execution, the software application can dereference one of the reference objects to locate one of the digital certificates in the generated mapping table corresponding to one of the reference objects.