Real-time Certificate Pinning List for Secure Cryptographic Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Certificate pinning in client systems poses security risks due to implicit trust in untrustworthy intermediate and issuing CAs, and managing a large number of End Entity (EE) certificates is inefficient, especially when their lifecycle does not match the client application's lifecycle, leading to inefficient re-pinning and potential malicious certificate introduction during remote re-pinning.
Innovation Solution
A method for managing certificate pinning involves an authoritative server providing a real-time Certificate Pinning List (CPL) to the client system, which includes a list of pinned certificates associated with various host systems, allowing the client to use these certificates in cryptographic processes, reducing the need for the client to maintain an up-to-date list and eliminating the need for frequent re-pinning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the client system pins the root CA certificate, then the client system can trust any intermediate CA under that root CA, but untrustworthy intermediate CAs can be trusted, creating a security risk
Solution Approach 1:
The patent segments the certificate pinning approach by introducing an intermediate pinning level between root CA and issuing CAs. Instead of pinning only root CA (which trusts all intermediates) or individual EE certificates (which requires managing many certificates), the system pins intermediate CA certificates to create a middle ground that limits trust scope while maintaining manageability.
Solution Approach 2:
The patent introduces an intermediary pinning mechanism where the client system pins intermediate CA certificates as a mediator between root CA pinning and individual EE certificate pinning. This intermediary level allows the system to control which issuing CAs are trusted without having to manage individual EE certificates or trust all intermediates under a root CA.
2Reliability
If the client system pins the intermediate CA certificate, then the scope of trust is narrowed, but untrustworthy issuing CAs can still be trusted, posing a security risk
Solution Approach 1:
The patent makes the intermediate CA certificate serve multiple functions: it acts as a trust anchor for multiple issuing CAs under its policy domain, and serves as a manageable pinning target that balances security and complexity. By pinning the intermediate CA, the system universally trusts all issuing CAs under that intermediate CA without having to individually pin each EE certificate.
3Ease of operation
If the client system pins the issuing CA certificate, then the client system accepts any certificate from that issuing CA, but untrustworthy certificates can still be issued, creating a security risk
Solution Approach 1:
The patent applies preliminary action by pinning the intermediate CA certificate in advance before individual EE certificates are issued. This preliminary pinning establishes a trust boundary that prevents future untrustworthy certificates from being accepted, as the system validates EE certificates against the pinned intermediate CA rather than blindly trusting all issuing CAs.
4Reliability
If the client system pins the EE certificate, then the security risk is minimized, but managing a large number of EE certificates becomes difficult and inefficient
Solution Approach 1:
The patent changes the dimension of certificate management by introducing a hierarchical pinning approach. Instead of managing individual EE certificates in a flat structure, the system moves to a hierarchical dimension where intermediate CA certificates serve as parent nodes that group multiple EE certificates. This dimensional change allows the system to pin one intermediate CA to manage multiple EE certificates efficiently.
5Productivity
If the EE certificate lifecycle does not match the client application lifecycle, then frequent re-pinning is needed, but remote re-pinning introduces security risks
Solution Approach 1:
The patent introduces dynamics by making the certificate pinning structure adaptable to lifecycle mismatches. The intermediate CA pinning mechanism allows the system to dynamically adjust trust relationships without requiring application releases or complex remote re-pinning processes. When EE certificates expire or are renewed, the pinned intermediate CA continues to provide trust validation.
Data Source
AI summary
Examples described herein relate to systems, apparatuses, methods, and non-transitory computer-readable medium for maintaining, by an authoritative server, a plurality of pinned certificates. The authoritative server sends a certificate pinning list (CPL) to a client system. The CPL is a list of the plurality of pinned certificates each of the plurality of pinned certificates is associated with a corresponding one of host systems different from the authoritative server. The client system uses the plurality of pinned certificates in cryptographic processes involving the host systems.