Certificate Pinning Security in Reduced Trust Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In reduced trust networks, ensuring the authenticity and security of data origin from an origin server to clients is challenging, especially when intermediary networks are involved, as it requires sharing the origin server's private key, which increases security risks and compromises authentication.
Innovation Solution
Implementing certificate pinning to establish a secured communication channel between the client and the origin server, where the client verifies the intermediary network's certificate against a pinned thumbprint, ensuring the authenticity of the origin server's content without requiring the origin server to share its private key with the intermediary network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the origin server shares its private key with the intermediary network to enable content distribution, then content distribution capability is improved, but security and authentication reliability deteriorate
Solution Approach 1:
The patent introduces a certificate pinning mechanism as an intermediary layer between the origin server and client. The client stores pinned certificate thumbprints that verify the authenticity of the origin server without requiring private key sharing. This mediator approach allows secure content distribution through intermediaries while maintaining authentication reliability through cryptographic verification of the origin server's identity.
2Reliability
If certificate pinning is implemented to verify the origin server's certificate, then authentication reliability is improved, but device complexity and operational overhead increase
Solution Approach 1:
The patent applies preliminary action by pre-storing certificate thumbprints in the client before actual content distribution occurs. The client retrieves the origin server's certificate during the TLS handshake and extracts its thumbprint, then stores this pinned value for future verification. This preliminary preparation simplifies subsequent authentication operations by avoiding complex real-time verification procedures.
Solution Approach 2:
The patent uses copying by working with certificate thumbprints (fingerprints) rather than the full certificates or private keys. The thumbprint is a condensed cryptographic representation that can be stored and compared efficiently. This copying approach reduces the complexity of certificate verification while maintaining authentication reliability, as the thumbprint verification is a simpler operation than full certificate chain validation.
Data Source
AI summary
Achieving certificate pinning security in reduced trust networks. A client receives a second certificate from a server over a first secured communications channel. The first secured communications channel is established based at least upon a first digital certificate associated with the first secured communications channel being certified by a pinned certificate. The client sends a request towards the server via a second communications channel with an untrusted computer system, and the request is received by the server. The server generates a response comprising a timestamp, a URI portion, and a signature that is generated using the second certificate. The server sends the response via the second communications channel. The client receives the response, and uses the second certificate to verify that the response is authentic and that the timestamp and URI portion are valid. The client then processes the payload.