Certificate Mirroring for Secure Mutual Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Man-in-the-middle (MITM) applications face difficulties in implementing mutual authentication between a client and a server when handling client certificates or keys, especially when the server accepts multiple client certificates or keys, as this may expose private keys, making it challenging to secure communication.
Innovation Solution
A computing system performs certificate mirroring by generating new public and private key pairs for the client and server, allowing for mutual authentication without exposing private keys, and acts as an intermediary to decrypt and re-encrypt traffic using these new keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the MITM application handles client certificates or keys directly for mutual authentication, then authentication functionality is achieved, but private keys are exposed creating security vulnerabilities
Solution Approach 1:
The patent introduces a certificate authority (CA) as an intermediary that issues certificates containing public keys. The MITM application authenticates clients using these certificates rather than handling private keys directly. The CA acts as a trusted mediator that enables authentication while keeping private keys secure on client devices.
Solution Approach 2:
The patent extracts the private key handling responsibility from the MITM application and places it solely on the client device. The MITM application only handles public keys and certificates, while the private key remains isolated on the client device, eliminating the security vulnerability of private key exposure.
2Adaptability or versatility
If the server accepts multiple client certificates or keys for flexibility, then client compatibility is improved, but the complexity of secure key management increases
Solution Approach 1:
The patent implements a universal certificate format issued by a trusted CA that can be used by multiple clients. The server accepts any certificate signed by the trusted CA, providing multi-functionality and broad compatibility without requiring the server to manage multiple different key types or authentication methods.
Solution Approach 2:
The patent uses certificate copies distributed by the trusted CA to multiple clients. Each client receives a copy of the public key in certificate form, allowing the server to authenticate multiple clients using the same verification process against the trusted CA's signature, simplifying key management while maintaining versatility.
Data Source
AI summary
A method includes retrieving a server certificate from a server in response to a request from a client to negotiate a connection between the client and the server and generating a new server public key and a new client public key in response to the request. The method also includes generating a new server certificate using information in the server certificate. The method further includes signing the new server certificate to produce a new signed server certificate, communicating the new signed server certificate, which includes the new server public key, to the client, and generating a new client certificate using information in a client certificate received from the client. The method also includes signing the new client certificate to produce a new signed client certificate and communicating the new signed client certificate, which includes the new client public key, to the server to establish the connection.