Server Certificate Rotation Through Cryptographic Discovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional communication systems face challenges in securely rotating server certificates without reconfiguring clients or servers, which can lead to security risks and service dysfunction, and are vulnerable to man-in-the-middle attacks when malicious actors obtain valid certificates.
Innovation Solution
A certificate rotating system that utilizes a discovery endpoint to provide a cryptographically verifiable list of server certificates, allowing clients to update their lists without reconfiguring or redeploying code, and ensures scalability and security by verifying the authenticity of server certificates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate thumbprinting is implemented to verify trusted sources, then security against man-in-the-middle attacks is improved, but the system becomes vulnerable when malicious actors obtain valid certificates from certificate authorities
Solution Approach 1:
The patent introduces a discovery endpoint as an intermediary between clients and servers. This endpoint provides a discovery response that cryptographically links the server certificate to the service, creating an additional verification layer. The discovery response acts as a mediator that proves the certificate belongs to the legitimate service, preventing attackers from using stolen certificates even if they obtain them from certificate authorities.
2Adaptability or versatility
If certificate rotation is performed by reconfiguring client and server applications, then updated certificates can be deployed, but the process exposes systems to additional security risks and may render services dysfunctional
Solution Approach 1:
The patent implements preliminary action by having the server publish its current certificate to the discovery endpoint before the certificate rotation occurs. This allows clients to proactively update their certificate caches with the new certificate information before the actual rotation happens. The service can then rotate certificates without forcing clients to reconfigure, as clients will automatically pick up the new certificate from the discovery endpoint during their next discovery request.
Solution Approach 2:
The discovery endpoint dynamically updates certificate information without requiring system reconfiguration. The certificate cache on clients is designed to be dynamic, automatically updating when new discovery responses are received. This dynamic approach allows certificate rotation to occur seamlessly in the background while services continue to operate, eliminating the need for downtime or manual intervention.
3Ease of operation
If a discovery endpoint is implemented to provide certificate information, then clients can update certificates without reconfiguration, but additional system components and complexity are introduced
Solution Approach 1:
The discovery endpoint is designed as a multi-functional component that serves both service discovery and certificate distribution purposes. By combining these functions, the patent avoids adding a separate dedicated certificate update service, thereby reducing overall system complexity. The same endpoint that clients query to find services also provides the certificate information, making the system easier to operate without significantly increasing architectural complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure relates to systems, methods, and computer-readable media for enhancing security of communications between instances of clients and servers while enabling rotation of server certificates (e.g., X.509 certificates). The systems described herein involve updating a client list of server certificates (e.g., a certificate thumbprint) without reconfiguring or re-installing a client and/or server application, starting a new session (e.g., a hypertext transfer protocol secure (HTTPS) session), or deploying new code. The systems described herein may passively or actively update a client list of certificates to enable a client to security verify an identity of a server instance in a non-invasive way that boosts security from man-in-the-middle types of attacks.