Endpoint validation security
Examples of the disclosure provide for a scatter network device. In some examples, the scatter network device includes a non-transitory memory, at least one processor, and a key exchange application stored in the non-transitory memory. When executed by the at least one processor, the key exchange application transmits a key exchange request to a first network endpoint, the key exchange request including an identifier of the scatter network device, receives a key exchange response from the first network endpoint, the key exchange response including a set of one-time-use endpoint validation tokens (EVTs) uniquely associated with the identifier of the scatter network device, and transmits an authenticated message to a second network endpoint, the authenticated message including a first of the set of one-time-use EVTs concatenated with an encrypted data portion.
1 . A scatter network device, comprising:
a non-transitory memory;
at least one processor; and
a key exchange application stored in the non-transitory memory that, when executed by the at least one processor:
transmits a key exchange request to a first network endpoint, the key exchange request including an identifier of the scatter network device;
receives a key exchange response from the first network endpoint, the key exchange response including a set of one-time-use endpoint validation tokens (EVTs) uniquely associated with the identifier of the scatter network device;
transmits an authenticated message to a second network endpoint, the authenticated message including a first of the set of one-time-use EVTs concatenated with an encrypted data portion;
responsive to a number of EVTs remaining in the set of one-time-use EVTs decreasing to be less than a threshold number, transmit a second request to the second network endpoint, the second request including the identifier of the scatter network device; and
receive a second response from the second network endpoint, the second response including a second set of one-time-use EVTs uniquely associated with the identifier of the scatter network device.
2 . The scatter network device of claim 1 , wherein each EVT of the set of one-time-use EVTs includes an encrypted representation of the identifier of the scatter network device concatenated with a variable counter value.
3 . The scatter network device of claim 2 , wherein the encrypted data portion is symmetrically encrypted with an encryption key accessible to the second network endpoint with reference to the identifier of the scatter network device.
4 . The scatter network device of claim 1 , wherein executing the key exchange application further causes the processor to:
transmit a second authenticated message to the second network endpoint, the second authenticated message including a second of the set of one-time-use EVTs concatenated with a second encrypted data portion.
5 . The scatter network device of claim 1 , wherein executing the key exchange application further causes the processor to transmit a second authenticated message to a third network endpoint, the second authenticated message including a first of the second set of one-time-use EVTs concatenated with a second encrypted data portion.
6 . The scatter network device of claim 1 , wherein executing the key exchange application further causes the processor to transmit a second authenticated message to the second network endpoint in a same communication channel as the processor transmitted the authenticated message, the second authenticated message including a second encrypted data portion.
7 . A method of secure data routing, comprising:
receiving, at a first network endpoint, a key exchange request from a client device, the key exchange request including an identifier of the client device;
generating a set of one-time-use endpoint validation tokens (EVTs) uniquely associated with the identifier of the client device;
generating a key exchange response including the set of one-time-use EVTs;
transmitting, to the client device, the key exchange response;
receiving, at a second network endpoint and in a first communication channel, an authenticated message from the client device, the authenticated message including a first of the set of one-time-use EVTs concatenated with an encrypted data portion;
decrypting the first of the set of one-time-use EVTs to obtain the identifier of the client device;
associating the identifier of the client device with the first communication channel;
performing a database lookup based on the identifier of the client device to obtain a symmetric encryption key according to which the encrypted data portion is encrypted; and
decrypting the encrypted data portion according to the symmetric encryption key.
8 . The method of claim 7 , wherein each EVT of the set of one-time-use EVTs includes an encrypted representation of the identifier of the client device concatenated with a variable counter value.
9 . The method of claim 7 , further comprising:
receiving, at the second network endpoint and in the first communication channel, a second authenticated message from the client device, the second authenticated message including a second encrypted data portion;
performing a database lookup based on the association of the identifier of the client device to the first communication channel to obtain the symmetric encryption key according to which the second encrypted data portion is encrypted; and
decrypting the second encrypted data portion according to the symmetric encryption key.
10 . The method of claim 7 , further comprising:
receiving, at the second network endpoint and in a second communication channel, a second authenticated message from the client device, the second authenticated message including a second of the set of one-time-use EVTs concatenated with a second encrypted data portion;
performing a database lookup based on the second of the set of one-time-use EVTs to obtain the identifier of the client device;
performing a database lookup based on the identifier of the client device to obtain the symmetric encryption key according to which the second encrypted data portion is encrypted; and
decrypting the second encrypted data portion according to the symmetric encryption key.
11 . A computing device, comprising:
a non-transitory memory;
at least one processor; and
a key exchange application stored in the non-transitory memory that, when executed by the at least one processor:
receives an authenticated message in a first communication channel from a client device, the authenticated message including a symmetrically encrypted data portion and at least one endpoint validation token (EVT) uniquely associated with an identifier of the client device;
associates the identifier of the client device with the first communication channel;
performs a database lookup based on the at least one EVT to obtain the identifier of the client device;
performs a database lookup based on the identifier of the client device to obtain a symmetric encryption key according to which the encrypted data portion is encrypted;
decrypts the encrypted data portion according to the symmetric encryption key;
receives a second authenticated message from the client device, the second authenticated message including a second encrypted data portion;
performs a database lookup based on the association of the identifier of the client device to the first communication channel to obtain the symmetric encryption key according to which the second encrypted data portion is encrypted; and
decrypts the second encrypted data portion according to the symmetric encryption key.
12 . The computing device of claim 11 , wherein the at least one EVT includes an encrypted representation of the identifier of the client device concatenated with a variable counter value.
13 . The computing device of claim 11 , wherein the authenticated message includes a second EVT, and wherein executing the key exchange application further causes the processor to:
receive, at the second network endpoint and in a second communication channel, a second authenticated message from the client device, the second authenticated message including the second EVT concatenated with a second encrypted data portion;
perform a database lookup based on the second EVT to obtain the identifier of the client device;
perform a database lookup based on the identifier of the client device to obtain the symmetric encryption key according to which the second encrypted data portion is encrypted; and
decrypt the second encrypted data portion according to the symmetric encryption key.
14 . The computing device of claim 11 , wherein the authenticated message includes a plurality of single-use EVTs including the at least one EVT.
15 . The computing device of claim 11 , wherein the at least one EVT is a timed-use EVT.
16 . The computing device of claim 11 , wherein the at least one EVT expires after a programmed number of transmissions by the client device.