Certificate Rotation Server for Dynamic Mobile App Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile applications require significant advance planning and redistribution to update certificates, leading to overlap periods where multiple certificates must be valid, as certificates are statically incorporated and cannot be updated without redistributing the application.
Innovation Solution
A certificate rotation server system that allows applications to dynamically obtain and validate lists of trusted certificates upon launch, using asymmetric keypairs for encryption and signature verification, enabling certificate updates without redistributing the application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificates are statically incorporated into the mobile application, then security is maintained through fixed certificate validation, but certificate updates require application redistribution which increases complexity and time overhead
Solution Approach 1:
The patent separates certificates from the application binary, storing them in a separate accessible location (such as a file or database) that can be updated independently. The application contains only the logic to load and validate certificates, while the actual certificate data resides externally, allowing updates without redistributing the entire application.
Solution Approach 2:
The patent introduces a certificate management system that acts as an intermediary between the application and the certificates. This system handles certificate loading, validation, and updates, allowing the application to interact with certificates through a standardized interface while the actual certificate storage and update mechanisms remain separate and more flexible.
2Ease of operation
If certificates are statically incorporated into the mobile application, then certificate validation is straightforward, but update periods require overlap of multiple certificates increasing validation complexity
Solution Approach 1:
The patent implements dynamic certificate loading where the application can load different certificates at different times based on current needs. Instead of having fixed certificates compiled into the application, the system dynamically retrieves certificates from external storage or remote sources, allowing seamless transitions between certificate versions without requiring overlapping validity periods.
Solution Approach 2:
The patent enables preliminary loading of new certificates before they are needed for validation. The certificate management system can pre-fetch and validate new certificates in advance, so when an update is required, the new certificates are already ready and verified, eliminating the need for overlap periods and reducing update time.
3Ease of manufacture
If certificates are embedded in the application, then distribution is simplified, but any certificate change requires significant advance planning and redistribution
Solution Approach 1:
The patent divides the application into two independent components: the application binary containing validation logic, and separate certificate data stored externally. This segmentation allows the application to be distributed once while certificates can be updated independently without requiring re-distribution of the application itself.
Solution Approach 2:
The patent creates a universal certificate management mechanism that can work with multiple certificate formats, sources, and update strategies. The application uses a standardized interface to interact with certificates regardless of their origin or format, enabling flexible adaptation to different certificate update scenarios without changing the application code.
Data Source
AI summary
The present disclosure provides computing systems and techniques for providing a certificate to sue to securely connect to a server. More particularly, the present disclosure provides a computing device certificate rotation server arranged to provide certificates to the computing device for use by an application executing on the computing device to securely connect to a server.