Secure Element Server Authentication via Application Certificate
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure channels between a secure element and an application server lack authentication, making them vulnerable to malicious or compromised servers accessing the secure element without verification.
Innovation Solution
The method involves the secure element authenticating the application server by verifying an application certificate linked to the server's identity, using a shared key exchange protocol like Diffie-Hellman, to establish a secure and authenticated channel.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a secure channel is established between a server and a secure element without authentication, then communication can be set up quickly and easily, but the system becomes vulnerable to malicious or compromised servers accessing the secure element
Solution Approach 1:
The patent applies preliminary action by having the server present its application certificate to the secure element before establishing the secure channel. This advance authentication step allows the secure element to verify the server's identity and trustworthiness before any sensitive communication occurs, preventing malicious servers from accessing the secure element while maintaining ease of operation through automated certificate verification
2Reliability
If the secure element authenticates the application server using certificate verification and key exchange protocols, then the security and reliability of the secure channel is enhanced, but the complexity of the authentication process increases
Solution Approach 1:
The patent uses the application certificate as an intermediary that mediates the authentication between the server and secure element. The certificate contains the server's identity and public key, allowing the secure element to verify the server's authenticity without requiring complex direct authentication protocols. This intermediary approach enhances security while simplifying the overall authentication process by relying on established public key infrastructure
Data Source
Figure 1
Figure 2
AI summary
The invention is a method for managing a secure channel between a server and a secure element embedded in a first device, wherein a user agent embedded in a second device establishes a HTTPS session with the serverand retrievesa web application from theserver, themethod comprising the steps: -the server sends to the web applicationan application certificate which is linked to a specific data reflecting the identity of the server, -the secure element gets the application certificate and the specific data, -the secure element checks the validity of the application certificate and that the application certificate is consistently linked to the specific data, -in case of successful checks, the secure element and the server generate an ephemeral session key and use it for opening a secure channel.