Achieving certificate pinning security in reduced trust networks

A method, implemented at a computer system that includes at least one processor, for achieving certificate pinning security when serving data through a reduced trust network, the method comprising:

• establishing a first secured communications channel with a remote client computer system, including offering a first digital certificate to the remote client computer system for securing the first communications channel, the first digital certificate being certified by a certificate that has been pinned at the client computer system;
• sending, over the first communications channel, an identity of a second digital certificate, the second digital certificate being used by the computer system to protect integrity and authenticity of content sent by the computer system over a second communications channel;
• establishing the second communications channel with an untrusted second remote computer system;
• receiving a request over the second communications channel the request including a request Uniform Resource Identifier (URI);
• and
• based on receiving the request,
• at least one of generating or identifying a payload corresponding to the request URI;
• generating a timestamp and a URI portion comprising at least a subset of the request URI;
• using the second digital certificate, generating a signature over the payload, the timestamp, and the URI portion;
• and
• sending a response over the second communications channel towards the remote client computer system, the response comprising the timestamp, the URI portion, and the signature.

A computer system for achieving certificate pinning security in reduced trust networks, the computer system comprising:

• a client computer that includes one or more first processors and a first computer-readable medium having stored thereon first computer-executable instructions that are executable by the one or more first processors to cause the client computer to:
• receive, over a first secured communications channel, an identity of a second digital certificate, the second digital certificate to be used to verify integrity and authenticity of content received over a second communications channel, the first secured communications channel established based at least upon a first digital certificate associated with the first secured communications channel being certified by a pinned certificate;
• establish the second communications channel with an untrusted remote computer system;
• send a request over the second communications channel, the request including a request Uniform Resource Identifier (URI);
• based on sending the request, receive a response from the untrusted remote computer system over the second communications channel, the response comprising a timestamp, a URI portion, and a signature over a payload, the timestamp, the URI portion;
• verify integrity and authenticity of the response including:
• verifying that the timestamp is valid;
• verifying that the URI portion corresponds to the request URI;
• and
• using the second digital certificate and the signature, verifying that the response is authentic;
• and
• based on verifying the integrity and the authenticity of the response, process the payload;
• and
• a server computer, which includes one or more second processors and a second computer-readable medium having stored thereon second computer-executable instructions that are executable by the one or more second processors to cause the server computer to:
• send, over the first communications channel, the identity of the second digital certificate;
• establish a third communications channel with an intermediary computer system;
• receive the request over the third communications channel;
• and
• based on receiving the request,
• at least one of generate or identify the payload, the payload corresponding to a URI portion, the URI portion comprising at least a subset of the request URI;
• generate the timestamp and the URI portion;
• using the second digital certificate, generate the signature over the payload, the timestamp, and the URI portion;
• and
• send the response over the third communications channel towards the client computer, the response comprising the timestamp, the URI portion, and the signature.