Peer-to-Peer Device Trust via Digital Certificate Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise organizations face challenges in establishing trust between devices for secure peer-to-peer communication without relying on a Unified Endpoint Management (UEM) server, as existing encryption methods cannot verify the trustworthiness of devices directly with each other.
Innovation Solution
User devices possess encryption key pairs and a hashing function from a trusted source, allowing them to exchange public keys, hash and encrypt an encryption key, and verify each other's digital signatures to establish trust through a process of key exchange and hashing verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption methods are used for data transmission, then data security during transmission is improved, but device trust verification capability deteriorates
Solution Approach 1:
The patent introduces a certificate authority (CA) as an intermediary that issues digital certificates to both devices. These certificates serve as trusted mediators that enable devices to verify each other's identity without requiring direct access to a UEM server. The CA-signed certificates act as the intermediary trust mechanism that resolves the contradiction between maintaining encryption security and enabling device verification.
Solution Approach 2:
The patent implements preliminary trust establishment by having devices obtain and verify digital certificates from a certificate authority before engaging in peer-to-peer communication. This preliminary verification action ensures that both devices are authorized and trusted before data exchange begins, eliminating the need for continuous server involvement and enabling offline trust verification.
2Reliability
If a UEM server is used to verify device security, then device trust verification is improved, but system availability and independence deteriorate
Solution Approach 1:
The patent extracts the trust verification function from the centralized UEM server and embeds it directly into the devices through digital certificates. By taking out the verification capability from the server and placing it in the devices themselves, the system achieves offline verification capability and eliminates the single point of failure, thereby improving availability while maintaining verification reliability.
Solution Approach 2:
The patent enables devices to perform self-verification of trust by using their own stored certificates and the certificates of other devices. Devices can independently verify each other's identity without requiring external server assistance, implementing self-service trust verification that works offline and eliminates dependency on continuous server availability.
3Productivity
If peer-to-peer communication is enabled without UEM server, then system independence and resource efficiency are improved, but device trust verification capability deteriorates
Solution Approach 1:
The patent uses digital certificates as copies of trust credentials that are distributed to devices from the certificate authority. These certificate copies contain the necessary verification information, allowing devices to verify each other's identity locally without needing to contact the original issuing authority or UEM server, thus maintaining verification capability while enabling independent P2P communication.
Data Source
AI summary
Systems and methods are described for establishing trust between two devices for secure peer-to-peer communication. In an example, a first and a second device can each possess a digital signature issued by the same certificate authority and a hash function issued by the same trusted entity. The devices can exchange public keys that include their respective digital signatures. The second device can verify the first device's digital signature, encrypt an encryption key with the second device's public key, hash the encryption key using its hash function, and encrypt the hash using its private key. The second device can send the encrypted hash and encryption key to the first device. The first device can verify the second device's digital signature, decrypt the encryption key, and decrypt the encrypted hash. The first device can hash the encryption key using its hashing function and compare the two hashes to verify the second device.