Trusted Host List for Flexible TLS Session Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large networks, servers must obtain new digital certificates whenever they are moved to a different subnet, leading to cumbersome certificate management and potential connection issues due to the lack of flexibility in authentication processes.
Innovation Solution
Implementing a trusted host list within the TLS session that allows for flexible authentication by comparing digital certificate field values against pre-defined rules, including the use of wildcards, to authorize secure communication sessions without requiring constant certificate updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital certificates are used for TLS authentication in large networks, then security is improved, but certificate management complexity increases when servers are moved between subnets
Solution Approach 1:
The patent segments the certificate validation process into two independent parts: (1) validation of the certificate signature by a trusted CA, and (2) validation of the server identity through subnet IP address matching. This separation allows the identity validation to be flexible regarding server movements while maintaining security through cryptographic signature verification.
Solution Approach 2:
The patent changes the validation parameter from certificate-based identity binding to IP address-based subnet matching. Instead of requiring certificate re-issuance when a server moves, the system validates whether the server's current IP address falls within authorized subnet ranges defined in the certificate, providing flexibility while maintaining security.
2Measurement precision
If digital certificates bind server identity to specific subnets, then authentication precision is improved, but adaptability deteriorates when servers need to be moved
Solution Approach 1:
The patent introduces dynamic IP address range validation into the certificate verification process. Instead of static one-to-one binding between certificates and server identities, the system dynamically checks whether the server's current IP address falls within authorized ranges, allowing servers to move between subnets while maintaining authenticated status.
Solution Approach 2:
The patent makes the certificate validation process universal by supporting multiple validation modes: traditional exact hostname matching and the new subnet IP address range matching. This multi-functionality allows the same certificate infrastructure to support both precise authentication and flexible server mobility scenarios.
3Reliability
If traditional TLS certificate validation is used, then connection security is maintained, but the need for frequent certificate re-issuance increases when servers are moved
Solution Approach 1:
The patent performs preliminary validation of the server's IP address against authorized ranges during the TLS handshake process, before any actual data transmission occurs. This preliminary check ensures security is maintained while avoiding the need for time-consuming certificate re-issuance procedures when servers move between subnets.
Data Source
AI summary
Methods, devices, and systems for creating and using a trusted host list for Transport Layer Security (TLS) sessions are provided. The proposed solutions described herein provide a mechanism of specifying authorization policy for TLS sessions where such authorization was traditionally implied by the possession of a certificate issued by a mutually trusted third party. The proposed solutions also provide for wildcard use and regular expression matching to simplify administration of the trusted host list.