Decoupling Pinned Certificates on Mobile Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure communication systems over unsecured networks, such as those using SSL/TLS protocols, are vulnerable to man-in-the-middle attacks and require manual updates of pinned certificates, which can lead to downtime and security risks.
Innovation Solution
A system and method for decoupling and updating pinned certificates on mobile devices, allowing for automated verification and updating of certificates without requiring a full application or browser update, using a certificate repository and secure storage to maintain integrity and authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate pinning is implemented to secure communications, then security against man-in-the-middle attacks is improved, but the system requires manual updates and full application re-publishing when certificates expire or are updated
Solution Approach 1:
The patent segments the certificate management process by separating the certificate storage from the application binary. The pinned certificate is extracted and stored separately in a certificate repository on the user device, while the application contains only a reference to it. This allows independent updating of certificates without requiring full application updates.
Solution Approach 2:
The patent introduces a certificate repository as an intermediary layer between the application and the certificate authority. This repository stores the actual certificate data and can be updated independently, acting as a mediator that decouples the application from direct certificate management and enables automated updates.
2Reliability
If certificates are hardcoded into applications to ensure security, then authentication reliability is improved, but updates require full application development, coding, and publishing which causes downtime
Solution Approach 1:
The patent divides the authentication system into separate components: the application binary (containing only a reference) and the certificate data (stored separately in a repository). This segmentation allows the certificate to be updated independently without requiring application re-compilation or re-publishing, eliminating downtime.
Solution Approach 2:
The patent implements preliminary action by having the application download and store the certificate in the repository before it is needed for authentication. This allows the certificate to be ready and available when required, and enables updates to be performed in advance without disrupting service.
3Reliability
If full application updates are published to update certificates, then certificate validity is maintained, but user convenience deteriorates as users are forced to update and/or reinstall applications
Solution Approach 1:
The patent extracts the certificate data from the application binary and places it in a separate certificate repository on the user device. This extraction allows certificates to be updated independently through a simple repository update mechanism, eliminating the need for users to download, update, or reinstall entire applications.
4Reliability
If pinned certificates are hardcoded in applications, then security validation is improved, but energy consumption increases due to full application updates and reinstalls
Solution Approach 1:
The patent segments the update process by separating certificate updates from application updates. Only the small certificate data in the repository needs to be updated, not the entire application. This significantly reduces the energy consumption associated with downloads, installations, and system reinstalls, thereby improving battery life.
Data Source
AI summary
Systems for decoupling and updating pinned certificates on a user device are disclosed. A mobile application having a hardcoded pinned certificate may be installed on a user device. The pinned certificate may be decoupled from the mobile application and stored on the user device. In response to the mobile application attempting to establish a secure connection with a server, the system may check whether the decoupled pinned certificate is current by querying a certificate repository. In response to determining that the pinned certificate is out of date, the system may transmit the current certificate to the user device to update the decoupled pinned certificate.