Intermediary Certificate Mapping for Mutual TLS Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The presence of an intermediary device between a client device and a server system hinders the establishment of secure connections through certificate-based authentication, as it prevents the exchange of encrypted messages using the correct certificates, leading to failed authentication and inability to access services.
Innovation Solution
An intermediary device acts as both a server and a client, using its own public and private keys to facilitate mutual authentication with the client and server systems, enabling secure connections by decrypting and encrypting messages with the appropriate keys, and maintaining mapping information to correlate public and private keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an intermediary device is placed between client device and server system, then security and access control are improved, but certificate-based authentication fails and secure connection establishment is hindered
Solution Approach 1:
The intermediary device acts as a mediator by implementing a certificate translation mechanism that converts certificates between different trust domains. The device maintains mapping information correlating client certificates with server certificates, enabling it to translate authentication credentials seamlessly. This allows the intermediary to facilitate secure connections without breaking the certificate-based authentication flow, resolving the contradiction by making the authentication process work despite the presence of the intermediary.
Solution Approach 2:
The intermediary device creates and uses translated copies of certificates to enable authentication. It generates translated server certificates based on the original server certificate and mapping information, allowing the client to authenticate successfully. The intermediary also creates translated client certificates for server verification. This copying approach maintains security while enabling the authentication process to complete successfully through the intermediary.
2Reliability
If certificate translation is performed by intermediary device, then secure connections are enabled, but device complexity increases
Solution Approach 1:
The intermediary device performs preliminary actions by pre-establishing trust relationships and maintaining mapping information between different certificate authorities. It stores correlation data that maps client certificates to server certificates before authentication occurs. This preliminary setup enables the translation process to proceed efficiently during authentication without requiring complex real-time computations, thus enabling secure connections while managing device complexity through advance preparation.
Data Source
AI summary
In some examples, an intermediary device includes a memory to store mapping information correlating an intermediary server public key to an intermediary server private key of the intermediary device, and correlating an intermediary client public key to an intermediary client private key of the intermediary device. The intermediary device establishes a first secure connection between the intermediary device and the client device using the intermediary server public key and the intermediary server private key, where the establishing of the first secure connection comprises a mutual authentication between the intermediary device and the client device. The intermediary device establishes a second secure connection between the intermediary device and the server system using the intermediary client public key and the intermediary client private key, where the establishing of the second secure connection comprises a mutual authentication between the intermediary device and the server system.