System and method for a multi system trust chain
A trust chain having client system and a remote system in a secure connection, wherein an intermediary system associated with the network flow path serves as a signing entity to establish an end to end transitive trust. The intermediate system is a corroborative entity in the operations technology realm of the client system. The remote system serves as the host for a plurality of services in the information technology realm. A two way handshake during the initial secure exchange protocol between a local client application and a remote service is extended to a three way handshake that includes a nonce issued by the remote service on the remote system and a digital signature for the nonce issued by a signature service on an associated intermediate system. The nonce signature is verified authoritatively at the remote system based on the signing certificate of the intermediate system for explicit proof of association.
1. A method comprising:
obtaining, by a first computing system, from a second computing system, a digital certificate associated with a third computing system, wherein the third computing system is located in a network flow path between the first computing system and the second computing system;
verifying, by the first computing system, the digital certificate;
issuing, by the first computing system, to the second computing system, a nonce based at least in part on verifying the digital certificate, wherein the second computing system routes, to the third computing system, a request to sign the nonce using a key associated with the digital certificate and obtains, from the third computing system, a digital signature based at least in part on a verification of metrics associated with the second computing system;
obtaining, by the first computing system, from the second computing system, the digital signature;
validating, by the first computing system, the digital signature using the digital certificate; and
establishing, by the first computing system, an updated flow path for one or more encrypted communications between the first computing system and the second computing system based at least in part on validating the digital signature, the updated flow path traversing the third computing system.
2. The method of claim 1 , wherein the updated flow path comprises a transitive trust chain between the first computing system and the second computing system.
3. The method of claim 1 , wherein the updated flow path comprises a transitive trust chain between the first computing system and the second computing system, the method further comprising verifying the transitive trust chain based on validating the digital signature.
4. The method of claim 1 , wherein the first computing system is a remote system and the second computing system is a client system.
5. The method of claim 1 , further comprising obtaining, by the first computing system, from the second computing system, one or more cipher suites.
6. The method of claim 1 , further comprising:
obtaining, by the first computing system, from the second computing system, one or more cipher suites; and
selecting, by the first computing system, a cipher suite of the one or more cipher suites.
7. The method of claim 1 , further comprising:
obtaining, by the first computing system, from the second computing system, one or more cipher suites;
selecting, by the first computing system, a cipher suite of the one or more cipher suites; and
transmitting, by the first computing system, to the second computing system, the cipher suite and the digital certificate.
8. The method of claim 1 , further comprising:
obtaining, by the first computing system, from the second computing system, one or more cipher suites;
selecting, by the first computing system, a cipher suite of the one or more cipher suites; and
transmitting, by the first computing system, to the second computing system, the cipher suite, the nonce, and the digital certificate.
9. The method of claim 1 , wherein a signed nonce is generated based on the second computing system routing, to the third computing system, the request to sign the nonce.
10. The method of claim 1 , wherein a signed nonce is generated based on the second computing system routing, to the third computing system, the request to sign the nonce, wherein the digital signature comprises the signed nonce.
11. The method of claim 1 , further comprising obtaining, by the first computing system, from the second computing system, an encrypted key.
12. The method of claim 1 , further comprising:
obtaining, by the first computing system, from the second computing system, an encrypted key; and
computing, by the first computing system, a shared secret.
13. The method of claim 1 , further comprising:
obtaining, by the first computing system, from the second computing system, an encrypted key;
computing, by the first computing system, a shared secret; and
engaging, by the first computing system, with the second computing system, in encrypted communications using the shared secret.
14. A first computing system comprising: memory; and
at least one processing device configured to:
obtain, from a second computing system, a digital certificate associated with a third computing system, wherein the third computing system is located in a network flow path between the first computing system and the second computing system;
verify the digital certificate;
issue, to the second computing system, a nonce based at least in part on verifying the digital certificate, wherein the second computing system routes, to the third computing system, a request to sign the nonce using a key associated with the digital certificate and obtains, from the third computing system, a digital signature based at least in part on a verification of metrics associated with the second computing system;
obtain, from the second computing system, the digital signature; validate, the digital signature using the digital certificate; and
establish an updated flow path for one or more encrypted communications between the first computing system and the second computing system based at least in part on validating the digital signature, the updated flow path traversing the third computing system.
15. The first computing system of claim 14 , wherein the updated flow path comprises a transitive trust chain between the first computing system and the second computing system, wherein the at least one processing device is further configured to verify the transitive trust chain based on validating the digital signature.
16. The first computing system of claim 14 , wherein the at least one processing device is further configured to:
obtain, from the second computing system, one or more cipher suites; and select, a cipher suite of the one or more cipher suites.
17. The first computing system of claim 14 , wherein the at least one processing device is further configured to:
obtain, from the second computing system, one or more cipher suites; select a cipher suite of the one or more cipher suites; and
transmit, to the second computing system, the cipher suite and the digital certificate.
18. The first computing system of claim 14 , wherein the at least one processing device is further configured to:
obtain, from the second computing system, one or more cipher suites; select a cipher suite of the one or more cipher suites; and
transmit, to the second computing system, the cipher suite, the nonce, and the digital certificate.
19. The first computing system of claim 14 , wherein the at least one processing device is further configured to:
obtain, from the second computing system, an encrypted key; and compute a shared secret.
20. The first computing system of claim 14 , wherein the at least one processing device is further configured to:
obtain, from the second computing system, an encrypted key; compute a shared secret; and
engage, with the second computing system, in encrypted communications using the shared secret.