Secure Peer-to-Peer Connection via Certificate Fingerprint Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

WebRTC peer-to-peer connections are vulnerable to man-in-the-middle attacks due to code injection risks in web browsers, where malicious scripts can manipulate signaling messages, compromising the security of real-time media and data transport.

Innovation Solution

A method and server system that securely establish peer-to-peer connections by exchanging and verifying certificate fingerprints using Content Security Policies (CSP) and Datagram Transport Layer Security (DTLS) certificates, preventing unauthorized peers from establishing connections by validating hash values of certificates through a centralized server.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If centralized servers are used for signaling information exchange, then peer-to-peer connection establishment is enabled, but vulnerability to code injection and man-in-the-middle attacks increases

Engineering Contradiction:

Improvepeer-to-peer connection establishmentVSAvoidcode injection vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The server performs preliminary verification of certificate fingerprints before allowing signaling information exchange. The client submits its certificate fingerprint to the server in advance, and the server stores this fingerprint for later validation. This preliminary action ensures that even if code injection occurs during signaling, the attacker cannot establish a connection without the correct pre-verified fingerprint, thus preventing man-in-the-middle attacks while maintaining ease of operation.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If certificate fingerprint verification is implemented, then security against man-in-the-middle attacks is improved, but system complexity increases

Engineering Contradiction:

Improvesecurity against man-in-the-middle attacksVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The server acts as an intermediary that handles the complex certificate fingerprint verification process. Instead of implementing complex verification logic in each client, the client simply submits its fingerprint to the server, and the server performs the verification and validation. This intermediary approach maintains high security while keeping client-side complexity low, as the server centralizes the complex verification operations.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If JavaScript code is executed in web browser sandbox, then web application functionality is enabled, but risk of code injection and security breaches increases

Engineering Contradiction:

Improveweb application functionalityVSAvoidcode injection risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent extracts the security-critical certificate fingerprint verification process from the JavaScript code execution environment in the browser sandbox. By requiring clients to submit their certificate fingerprints to the server and validating them there, the system removes the most critical security verification step from the vulnerable JavaScript environment. This extraction maintains web application functionality while mitigating code injection risks, as the attacker cannot compromise the server-side fingerprint validation even if they inject malicious JavaScript.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentEP3323232B1Enabling setting up a secure peer-to-peer connection

Publication Date: 2023.02.22 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

Figure 1~2
Figure 3
Figure 4

AI summary

It is presented a method for a server for enabling setting up a secure peer-to-peer connection between a first peer and a second peer. The method comprises the steps of: receiving a request for a web application from the first peer; sending a directive to the first peer requesting a fingerprint of a certificate of the first peer; receiving a first fingerprint from the first peer; and sending the first fingerprint to the second peer.