Peer-to-peer security protocol apparatus, computer program, and method
An apparatus, computer program, and method are afforded for providing a peer-to-peer security protocol. In operation, a message is identified that is directed from a first peer device to a second peer device. Further, the message is copied, so that a copy of the message is caused to be sent to an auditing server.
1. A computer program product comprising computer executable instructions stored on a non-transitory computer readable medium that when executed by a processor instruct the processor to:
initialize a first peer device with an auditing server, by:
receiving, by the auditing server from the first peer device, a first data at rest (DAR) key pair that includes a first DAR public key and a first encrypted DAR private key, the first encrypted DAR private key formed by the first peer device encrypting a first DAR private key using an auditing public key provided by the auditing server, and
storing, by the auditing server, the first encrypted DAR private key in association with an identifier of the first peer device;
initialize a second peer device with the auditing server, by:
receiving, by the auditing server from the second peer device, a second data at rest (DAR) key pair that includes a second DAR public key and a second encrypted DAR private key, the second encrypted DAR private key formed by the second peer device encrypting a second DAR private key using the auditing public key provided by the auditing server,
storing, by the auditing server, the second encrypted DAR private key in association with an identifier of the second peer device;
receive, by the auditing server from a routing server, a copy of a peer-to-peer broadcast message sent by the first peer device for transmission to the second peer device, the peer-to-peer broadcast message generated by the first peer device using the second DAR public key and wrapped using a peer-to-peer security protocol;
validate, by the auditing server, the peer-to-peer broadcast message by:
determining that the peer-to-peer broadcast message contains a message copy for the auditing server, and
verifying a digital signature on the peer-to-peer broadcast message and that the second DAR public key is stored for the second peer device that is the intended recipient of the peer-to-peer broadcast message;
responsive to the auditing server validating the peer-to-peer broadcast message:
provide, by the auditing server, an indication of success to the routing server for prompting the routing server to transmit the peer-to-peer broadcast message to the second peer device, and
store, in a database associated with the auditing server, the copy of the peer-to-peer broadcast message and associated metadata indicating the first peer device as a sender of the peer-to-peer broadcast message, the second peer device as a receiver of the peer-to-peer broadcast message, and a timestamp;
wherein the copy of the peer-to-peer broadcast message stored in the database is only accessible to one or more compliance offers having knowledge of an auditing private key, using the second encrypted DAR private key stored by the auditing server in association with the identifier of the second peer device;
wherein the first peer device, the second peer device, the auditing server, and the routing server communicate via a network.
2. The computer program product of claim 1 , wherein the computer program product is further configured such that the auditing private key stored in a hardware security module.
3. An apparatus, comprising:
an auditing server configured to:
initialize a first peer device with the auditing server, by:
receiving, by the auditing server from the first peer device, a first data at rest (DAR) key pair that includes a first DAR public key and a first encrypted DAR private key, the first encrypted DAR private key formed by the first peer device encrypting a first DAR private key using an auditing public key provided by the auditing server, and
storing, by the auditing server, the first encrypted DAR private key in association with an identifier of the first peer device;
initialize a second peer device with the auditing server, by:
receiving, by the auditing server from the second peer device, a second data at rest (DAR) key pair that includes a second DAR public key and a second encrypted DAR private key, the second encrypted DAR private key formed by the second peer device encrypting a second DAR private key using the auditing public key provided by the auditing server,
storing, by the auditing server, the second encrypted DAR private key in association with an identifier of the second peer device;
receive, by the auditing server from a routing server, a copy of a peer-to-peer broadcast message sent by the first peer device for transmission to the second peer device, the peer-to-peer broadcast message generated by the first peer device using the second DAR public key and wrapped using a peer-to-peer security protocol;
validate, by the auditing server, the peer-to-peer broadcast message by:
determining that the peer-to-peer broadcast message contains a message copy for the auditing server, and
verifying a digital signature on the peer-to-peer broadcast message and that the second DAR public key is stored for the second peer device that is the intended recipient of the peer-to-peer broadcast message;
responsive to the auditing server validating the peer-to-peer broadcast message:
provide, by the auditing server, an indication of success to the routing server for prompting the routing server to transmit the peer-to-peer broadcast message to the second peer device, and
store, in a database associated with the auditing server, the copy of the peer-to-peer broadcast message and associated metadata indicating the first peer device as a sender of the peer-to-peer broadcast message, the second peer device as a receiver of the peer-to-peer broadcast message, and a timestamp;
wherein the copy of the peer-to-peer broadcast message stored in the database is only accessible to one or more compliance offers having knowledge of an auditing private key, using the second encrypted DAR private key stored by the auditing server in association with the identifier of the second peer device;
wherein the first peer device, the second peer device, the auditing server, and the routing server communicate via a network.
4. A method, comprising:
initializing a first peer device with an auditing server, by:
receiving, by the auditing server from the first peer device, a first data at rest (DAR) key pair that includes a first DAR public key and a first encrypted DAR private key, the first encrypted DAR private key formed by the first peer device encrypting a first DAR private key using an auditing public key provided by the auditing server, and
storing, by the auditing server, the first encrypted DAR private key in association with an identifier of the first peer device;
initializing a second peer device with the auditing server, by:
receiving, by the auditing server from the second peer device, a second data at rest (DAR) key pair that includes a second DAR public key and a second encrypted DAR private key, the second encrypted DAR private key formed by the second peer device encrypting a second DAR private key using the auditing public key provided by the auditing server,
storing, by the auditing server, the second encrypted DAR private key in association with an identifier of the second peer device;
receiving, by the auditing server from a routing server, a copy of a peer-to-peer broadcast message sent by the first peer device for transmission to the second peer device, the peer-to-peer broadcast message generated by the first peer device using the second DAR public key and wrapped using a peer-to-peer security protocol;
validating, by the auditing server, the peer-to-peer broadcast message by:
determining that the peer-to-peer broadcast message contains a message copy for the auditing server, and
verifying a digital signature on the peer-to-peer broadcast message and that the second DAR public key is stored for the second peer device that is the intended recipient of the peer-to-peer broadcast message;
responsive to the auditing server validating the peer-to-peer broadcast message:
providing, by the auditing server, an indication of success to the routing server for prompting the routing server to transmit the peer-to-peer broadcast message to the second peer device, and
storing, in a database associated with the auditing server, the copy of the peer-to-peer broadcast message and associated metadata indicating the first peer device as a sender of the peer-to-peer broadcast message, the second peer device as a receiver of the peer-to-peer broadcast message, and a timestamp;
wherein the copy of the peer-to-peer broadcast message stored in the database is only accessible to one or more compliance offers having knowledge of an auditing private key, using the second encrypted DAR private key stored by the auditing server in association with the identifier of the second peer device;
wherein the first peer device, the second peer device, the auditing server, and the routing server communicate via a network.