DHCP Server Certificate Pinning for Secure Network Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In highly secure network environments, existing certificate pinning technologies face challenges when user devices cannot access external directory services for obtaining public key certificates, making them vulnerable to man-in-the-middle attacks, especially during sensitive operations like MDM system enrollment.
Innovation Solution
A method where a user device obtains a set of public key certificates from a DHCP server within the secure environment, which are then compared to the current public key certificate from the secure server, allowing secure communication only when there is a match, thus preventing man-in-the-middle attacks without relying on external directory services or potentially fraudulent root certificates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate pinning is performed using external directory services, then certificate validation reliability is improved, but network accessibility and security isolation requirements conflict
Solution Approach 1:
The patent introduces a DHCP server as an intermediary component within the secure network that stores and provides public key certificates. This mediator enables certificate pinning functionality without requiring external directory service access, resolving the conflict between reliability and network environment adaptability by placing the certificate authority function inside the isolated network perimeter
Solution Approach 2:
The patent shifts the certificate distribution mechanism from the traditional external directory service dimension to an integrated DHCP service dimension. By embedding certificate provision capabilities within the existing DHCP infrastructure that is already present in secure networks, the solution enables certificate pinning through a different operational dimension that doesn't require external network access
2Object-affected harmful factors
If external directory services are blocked for security reasons, then security isolation is improved, but certificate pinning capability deteriorates
Solution Approach 1:
The DHCP server acts as an internal intermediary that provides certificate distribution functionality without requiring external directory service connections. This mediator maintains security isolation by keeping all certificate operations within the secure network boundary while still enabling certificate pinning capability
Solution Approach 2:
The secure network becomes self-sufficient by hosting its own certificate distribution infrastructure through the DHCP server. The network no longer needs to service external directory requests, maintaining security isolation while providing self-contained certificate pinning functionality through the integrated DHCP service
3Productivity
If DHCP server is used for certificate distribution, then network resource utilization is improved, but protocol function extension increases complexity
Solution Approach 1:
The DHCP server is extended to perform multiple functions: traditional IP address assignment and configuration parameter distribution, plus certificate storage and distribution. This multi-functionality improves network resource utilization by using existing infrastructure while the extension complexity is managed by building upon the well-understood DHCP protocol framework
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Technology for providing secure communications between a user device and a secure server, in which a user device performs a certificate pinning operation by requesting and receiving a set of public key certificates for the secure server from a dynamic host configuration protocol (DHCP) server. The user device requests and receives a current public key certificate of the secure server from the secure server. The current public key certificate of the secure server is compared with the set of public key certificates for the secure server received from the DHCP server. In response to the current public key certificate of the secure server matching one of the public key certificates in the set of public key certificates for the secure server received from the DHCP server, the authenticity of the secure server is confirmed and communications are permitted between the user device and the secure server.