SSL Certificate Verification via Attribute Comparison

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Certificate authorities in Secure Sockets Layer (SSL) protocols are a weak point for security, vulnerable to man-in-the-middle attacks, as they rely on verification methods that can be compromised.

Innovation Solution

A method and system that identifies and compares attributes of certificates used in SSL connections, determining policy actions based on similarities with stored certificates to prevent and detect attacks, utilizing an in-line server to oversee client connections and enforce security policies.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If certificate authorities are used to verify SSL connections, then connection security is established, but the system becomes vulnerable to man-in-the-middle attacks

Engineering Contradiction:

Improveconnection securityVSAvoidman-in-the-middle attack vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary certificate verification by comparing the server's certificate against previously stored certificates from legitimate sources before allowing the SSL connection to be established. This advance checking prevents compromised certificates from being accepted, thereby blocking man-in-the-middle attacks while maintaining connection security.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If certificate verification is performed during SSL connection establishment, then authentication is ensured, but connection establishment time increases

Engineering Contradiction:

Improvecertificate authenticationVSAvoidconnection establishment time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs a partial verification by comparing only critical certificate attributes (such as domain name, issuer, and validity period) against stored certificates rather than performing a complete cryptographic verification. This selective approach maintains authentication reliability while significantly reducing the time required for certificate verification during connection establishment.

Inventive Principle:

Principle #16Partial or excessive action

3Measurement precision

If comprehensive certificate attributes are compared, then attack detection accuracy improves, but processing complexity increases

Engineering Contradiction:

Improveattack detection accuracyVSAvoidcertificate comparison complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system segments the certificate verification process into distinct attribute comparisons (domain name, issuer organization, validity dates, certificate type) rather than treating it as a single complex operation. Each attribute is extracted and compared independently against the corresponding attribute in stored certificates, which simplifies the overall processing while maintaining high detection accuracy for various types of attacks.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS9906371B2Secure connection certificate verification

Publication Date: 2018.02.27 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

One or more computer processors identify a first certificate that is used to establish a secure Internet connection. One or more computer processors identify a stored second certificate that shares at least one attribute with the first certificate. One or more computer processors determine a policy action based, at least in part, on a result of a comparison between an attribute of the first certificate and an attribute of the second certificate.