US 11,706,037 B2
Achieving certificate pinning security in reduced trust networks
Brandon T. Hunt, Redmond, WA (US); Alexander Burba, Seattle, WA (US); and Yuval Gross, Redmond, WA (US)
Assigned to Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed by Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed on Sep. 17, 2021, as Appl. No. 17/478,719.
Application 17/478,719 is a continuation of application No. 16/687,293, filed on Nov. 18, 2019, granted, now 11,153,100.
Prior Publication US 2022/0006656 A1, Jan. 6, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); H04L 9/32 (2006.01); H04L 9/08 (2006.01); H04L 9/06 (2006.01)
CPC H04L 9/3268 (2013.01) [H04L 9/0643 (2013.01); H04L 9/0825 (2013.01); H04L 9/3297 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method, implemented at a computer system that includes at least one processor, for achieving certificate pinning security when obtaining data through a reduced trust network, the method comprising:
receiving, over a first secured communications channel, an identity of a second digital certificate, the second digital certificate to be used to verify integrity and authenticity of content received over a second communications channel established with an untrusted second remote computer system, the first secured communications channel established based at least upon a first digital certificate associated with the first secured communications channel being certified by a pinned certificate;
sending a request over the second communications channel, the request including a request Uniform Resource Identifier (URI);
based on sending the request, receiving a response from the untrusted second remote computer system over the second communications channel, the response comprising a payload, a timestamp, a URI portion, and a signature over the payload, the timestamp, the URI portion;
verifying integrity and authenticity of the response, including:
verifying that the timestamp is valid;
verifying that the URI portion corresponds to the request URI; and
using the second digital certificate and the signature, verifying that the response is authentic; and
based on verifying the integrity and the authenticity of the response, processing the payload.