Named Pipe IPC Security via Random Endpoint and PKI Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing inter-process communication systems via named pipes are vulnerable to malicious applications spoofing, allowing unauthorized access by eavesdropping or misrepresentation of Public Key Infrastructure (PKI) certificates, which can lead to data security breaches.
Innovation Solution
A local inter-process communication securing system that verifies authenticated client applications with trusted PKI certificates and uses randomly generated one-time use tokens to ensure only authorized applications access sensitive information, preventing spoofing by requiring re-verification for each communication session and authenticating server applications through digital signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If named pipe inter-process communication is used without additional security measures, then communication efficiency is improved, but security against malicious applications deteriorates
Solution Approach 1:
The system performs preliminary authentication of client applications against a blacklist before allowing them to establish named pipe connections. This preliminary action prevents malicious applications from ever gaining access, while legitimate applications can proceed to communicate efficiently without repeated verification delays.
Solution Approach 2:
The system introduces an intermediary authentication layer between the client application and the named pipe communication channel. This intermediary verifies client credentials and maintains a blacklist, acting as a mediator that allows efficient communication for trusted clients while blocking malicious ones, thus resolving the security-efficiency tradeoff.
2Reliability
If PKI certificate verification is performed for each communication session, then security against spoofing is improved, but authentication time increases
Solution Approach 1:
The system performs PKI certificate verification and blacklist checking as a preliminary action before the actual communication session begins. By completing this authentication upfront, the system ensures security without adding time delays during the data transmission phase, as the verification is done once at connection establishment.
Solution Approach 2:
The system maintains continuous security monitoring through ongoing heartbeat verification during the communication session. This continuous action ensures that no spoofing occurs during data transfer without requiring repeated full PKI verification, thus maintaining security while minimizing time loss through efficient continuous validation rather than repeated comprehensive verification.
Data Source
AI summary
An information handling system operating a local inter-process communication securing system may comprise a memory and a processor executing machine readable code instructions of the local inter-process communication securing system performing a verification process of a candidate client application to instruct the candidate client application and a server application for which the local inter-process communication securing system acts as an API to establish a first named pipe having an endpoint address randomly generated by the local inter-process communication securing system, to receive a candidate client identification and a randomly generated string of alpha-numeric characters from the server application, and to instruct the server application to establish a first communication session, via the first named pipe, with the candidate client application upon determining the candidate client identification matches an authenticated client identification and that the randomly generated string of alpha-numeric characters is associated with the authenticated client identification, as stored at the local inter-process communication securing system, to verify that the candidate client application is the authenticated client application. Additionally, the authenticated client application may similarly verify a server application by only entering into the first communication session with the server application after receiving verification from a PKI that the server application is associated with a verified PKI certificate having an authentic signature.