Client-Server Certificate Update via Secure Update Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The process of updating server certificates in client applications is complex and requires synchronized deployment across all devices, especially when the certificates need to be renewed regularly for security reasons, which is inefficient and time-consuming.
Innovation Solution
A method for updating server certificates through a secure communication with an update server, allowing asynchronous and decentralized certificate updates without requiring a full application re-download, by using a compliance check mechanism to ensure the updated certificates are used for secure communication establishment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the reference certificate is updated by reconfiguring all client applications, then the certificate security is improved, but the deployment complexity and time required for updating all devices increases
Solution Approach 1:
The patent extracts the certificate update functionality from the application configuration process. Instead of updating the reference certificate within the application itself (which would require reconfiguration), the solution separates the certificate storage from the application by introducing a dedicated certificate storage module that can be updated independently through server communication.
Solution Approach 2:
The patent introduces an intermediary mechanism - a certificate storage module that acts as a mediator between the application and the reference certificate. This module can be updated asynchronously through communication with an update server, eliminating the need for synchronized reconfiguration of all client applications while maintaining security.
2Reliability
If the reference certificate is updated by reconfiguring all client applications, then the certificate validity is improved, but the time required for updating all devices increases
Solution Approach 1:
The patent prepares the certificate update in advance by having the update server make the new reference certificate available before it is actually needed. When the application needs to update its certificate, it can quickly retrieve the pre-prepared update from the server without waiting for centralized deployment, significantly reducing update time.
Solution Approach 2:
The patent enables each client application to perform its own certificate update autonomously by communicating with the update server. Instead of requiring centralized reconfiguration of all applications, each device can independently retrieve and apply certificate updates when needed, eliminating the time required for synchronized deployment across all devices.
3Reliability
If certificate pinning is implemented to authenticate the server, then the security against man in the middle attacks is improved, but the complexity of certificate management increases
Solution Approach 1:
The patent segments the certificate management system into distinct components: the application with its compliance check, the reference certificate stored in a separate module, and an update server for maintenance. This segmentation allows certificate pinning to maintain security while simplifying management, as updates can be performed on the certificate storage module independently without affecting the application structure.
Data Source
Figure 1~2
Figure 3
AI summary
The invention relates to a method for communication between an application implementing a service run on a user device (10) and a main server (20). When an attempt is made to establish a first secure communication, the compliance of a public key certificate sent by the main server is checked against a reference certificate for the main server, the establishment of secure communication being conditional upon said compliance check. If the public key certificate sent by the main server is not compliant, a second secure communication is established with an update server (21), and a public key certificate sent by the update server is checked for compliance against a reference certificate for said update server. Once the second secure communication has been established, an updated reference certificate for the main server is received, said updated certificate being intended to be used by the client application the next time secure communication is established with the main server.