Certificate Authentication via DNS Public Key Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Man-in-the-middle attacks occur when malicious third parties obtain certificates fraudulently, allowing them to impersonate secure servers, compromising communication security between clients and servers.
Innovation Solution
An authentication node compares the certificate presented by a node with the server's actual certificate to verify identity, optionally checking against a list of revoked certificates and maintaining a record of previous queries to detect fraudulent activities and mitigate DNS cache poisoning attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a CA issues certificates based on cursory checks to improve processing speed, then productivity increases, but reliability decreases due to fraudulent certificate issuance
Solution Approach 1:
The system performs preliminary actions by having the client obtain the server's public key directly from the server through a DNS query before the certificate verification process. This preliminary acquisition of the authentic public key allows the client to later verify certificates against a known-good reference, enabling faster certificate processing without sacrificing authenticity verification.
2Ease of operation
If traditional certificate verification is used to authenticate server identity, then ease of operation is maintained, but security is compromised due to man-in-the-middle attacks
Solution Approach 1:
The system introduces an intermediary verification mechanism where the client compares the public key extracted from the server's certificate against a reference public key obtained directly from the server. This intermediary comparison step acts as a mediator that validates the certificate's authenticity without adding significant operational complexity, effectively blocking man-in-the-middle attacks while maintaining ease of use.
3Reliability
If comprehensive identity verification is performed to prevent fraudulent certificates, then reliability improves, but device complexity increases due to additional verification steps
Solution Approach 1:
The system extracts only the essential public key information from the server's certificate and compares it against the reference public key obtained through DNS. By taking out and focusing on this single critical verification element rather than performing comprehensive identity checks, the system achieves reliable verification while keeping the implementation relatively simple and avoiding excessive complexity.
Data Source
AI summary
A method and apparatus for authenticating a first node's identity in a communication network. An authentication node receives from a second node an authentication request. The authentication request includes a first certificate that has previously been presented to the second node by a node purporting to be the first node. The authentication node retrieves a second certificate belonging to the first node from the first node, and compares the first certificate with the second certificate. If the certificates match, then the first node's identity can be authenticated but if the certificates do not match, then the first node's identity cannot be authenticated. The results of the comparison are then sent to the second node for use by the second node to authenticate the first node.