Asynchronous Security Asset Rotation for Zero-Downtime Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure communication systems face challenges in rotating security assets, such as key pairs and certificates, without causing downtime, which is essential for maintaining secure communications against eavesdropping, tampering, and message forgery.
Innovation Solution
The system and method involve retrieving and rotating multiple security assets from a security asset repository, allowing new security assets to be asynchronously introduced into servers, enabling secure communication sessions without interrupting service by using certificates with different versions that are trusted and authenticated through the SSL handshake protocol.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security assets are rotated in traditional secure communication systems, then security is improved, but service downtime occurs
Solution Approach 1:
The system pre-generates multiple security assets (certificates and key pairs) with different validity periods before they are needed. When a security asset rotation is required, the system can switch to a pre-generated asset without interruption, eliminating downtime while maintaining security improvements
2Object-affected harmful factors
If security assets are rotated to prevent eavesdropping and tampering, then security against fraudulent actors is improved, but communication sessions are interrupted
Solution Approach 1:
The system introduces a security asset repository as an intermediary that stores multiple security assets. During rotation, the repository provides continuous access to valid security assets, allowing communication sessions to maintain continuity while transitioning between different security assets for enhanced security
3Reliability
If multiple security assets are managed with different validity periods, then security is enhanced, but system complexity increases
Solution Approach 1:
The security asset repository is designed to universally handle multiple types of security assets (certificates and key pairs) with different validity periods through a unified interface. This multi-functional design allows the system to manage diverse security assets without proportionally increasing complexity, as the repository applies consistent storage, retrieval, and rotation logic across all asset types
Data Source
AI summary
Systems and methods to rotate security assets used to for secure communications are disclosed. The system includes initiating a communication session between two servers. Additionally, a server provides a first version of a first certificate to another server. The first version of the first certificate has identifying information including a first public key. The server receives a second certificate. The server determines that the second certificate is trusted by determining that the second certificate has identifying information matching the identifying information of the first version of the first certificate. In response to determining that the second certificate is trusted, the server encrypts the first public key. The server provides the encrypted first public key to the other server. The server then receives a verification of decryption of the encrypted first public key.