Automated Client Device Certificate Validation in Managed Networks

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing client-server trust management systems in managed networks face vulnerabilities and inefficiencies due to the manual validation of digital device certificates and public/private keys, which can lead to intercepted or forged keys, DNS hijacking, and resource-intensive updates.

Innovation Solution

An automated validation method where a client device receives a public key from a system server, verifies a certificate list signed by the server's private key, and uses this to validate digital device certificates during a handshake process, enabling secure communication without relying on DNS names and reducing the need for frequent updates.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual validation of digital device certificates and public/private keys is used, then authentication of data sources can be achieved, but security vulnerabilities arise including intercepted or forged keys and DNS hijacking

Engineering Contradiction:

Improveauthentication reliabilityVSAvoidsecurity vulnerabilities

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent extracts the DNS resolution step from the authentication process, allowing direct IP address communication between client devices and data sources. This removes the DNS hijacking vulnerability while maintaining certificate-based authentication through the certificate list validation mechanism.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system performs preliminary validation by maintaining a certificate list that is verified against the system server's public key before communication occurs. This pre-validation prevents authentication of unauthorized sources while avoiding runtime security checks that could be vulnerable to attacks.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If manual validation and review of digital device certificates is performed, then data source verification can be achieved, but the process becomes resource intensive and inefficient

Engineering Contradiction:

Improvedata source verificationVSAvoidvalidation efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

Client devices automatically perform certificate validation against the system server's public key and the distributed certificate list without requiring manual administrator intervention. This automates the verification process while maintaining security, eliminating the resource-intensive manual review step.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent introduces a certificate list as an intermediary between the system server's public key and individual device certificates. This list serves as a pre-validated reference that client devices can efficiently check against, avoiding direct resource-intensive validation of each certificate against the server.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If update and modification of verified data sources involves multiple communications with endpoints, then validation can be maintained, but communication vulnerabilities and resource consumption increase

Engineering Contradiction:

Improvevalidation maintenanceVSAvoidcommunication resources

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The system performs preliminary validation by distributing a certificate list containing pre-verified device certificates to client devices. This allows clients to independently validate data sources without requiring repeated communications with the system server or endpoints, reducing communication overhead and vulnerabilities.

Inventive Principle:

Principle #10Preliminary action

4Ease of operation

If DNS names are used for accessing data sources, then user-friendly access is achieved, but DNS hijacking vulnerabilities arise

Engineering Contradiction:

Improveaccess convenienceVSAvoidDNS hijacking

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent removes DNS resolution from the authentication-critical path by allowing direct IP address-based access to data sources. This extraction eliminates the DNS hijacking vulnerability while preserving access convenience through IP address usage, and maintains security through certificate validation.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS12015690B2Automated validation of data sources in a managed network

Publication Date: 2024.06.18 IVANTI INC

AI summary

An embodiment includes a method of client-server trust management. The method includes receiving, at a client device, a public key of a system server and locally seeding the public key in a secure storage at the client device. The method includes receiving a certificate list signed by a private key of the system server and verifying a source of the certificate list using the seeded public key. The method includes initiating a handshake process with a second device during which a digital device certificate of the second device is received. The method includes halting the handshake process and validating the second device by matching the digital device certificate with a certificate included on the verified certificate list. Based on the validation, the method includes managing a communication session with the second device to enable or prevent data transfer between the client device and the second device.