Unmanaged Secure Inter-App Data Communications via Certificate Authority
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile device management (MDM) platforms are inadequate for ensuring secure inter-application communications on both managed and unmanaged computing devices, as they cannot reliably facilitate secure data exchange between applications on the same device.
Innovation Solution
A mechanism is provided for secure inter-application communications where applications generate asymmetric key pairs, obtain identity certificates, and exchange public keys through a management computing environment, using a certificate authority to authenticate and store these keys in a mapping table for encrypted data sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MDM platforms are used to provide secure communications between computing devices, then secure data exchange capability is improved, but the solution is not reliable for unmanaged devices and cannot be depended upon to achieve secure inter-application communications in all cases
Solution Approach 1:
The system enables applications on unmanaged devices to autonomously generate asymmetric key pairs, obtain identity certificates from a certificate authority, and exchange public keys without requiring MDM platform intervention. Applications self-manage their cryptographic credentials and establish secure communication channels independently, eliminating dependency on MDM platforms for unmanaged devices.
Solution Approach 2:
A certificate authority serves as a trusted intermediary that issues identity certificates to applications on computing devices. This intermediary enables mutual authentication between applications by verifying their digital credentials, establishing secure communication channels without requiring direct trust between applications or dependency on MDM platforms.
2Reliability
If applications exchange public keys through a management computing environment, then authentication reliability is improved, but device complexity increases due to key pair generation, certificate acquisition, and public key exchange mechanisms
Solution Approach 1:
The authentication mechanism is segmented into distinct functional components: asymmetric key pair generation for each application, centralized certificate authority for identity verification, and public key exchange through a management computing environment. This segmentation allows each component to perform its specific function independently, improving reliability while maintaining manageable complexity through modular architecture.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Aspects of secure inter-application data communications are described. In one example, a first application executing on a computing device obtains an identity certificate. The identity certificate can include a unique identifier of the computing device and a public key of the first application. To obtain the public keys of other applications executing on the computing device, the first application can query a management computing environment using the identity certificate. Once the computing device is authenticated by the management computing environment, the management computing environment can store the public key of the first application and return any public keys of other applications executing on the computing device. Once the public keys have been exchanged between the applications, the applications can encrypt and sign data packages for secure data communications between each other.