Establishing an Ad-Hoc Secure Connection Between Two Electronic Computing Devices Using a Self-Expiring Locally Transmitted Information Packet

A computer-implemented method for establishing a secure connection between two electronic computing devices which are located in a network environment, the two electronic computing devices being a first computing device offering the connection and a second computing device designated to accept the connection, the method comprising executing, by at least one processor of at least one computer, a connection-establishing application, wherein execution of the connection-establishing application causes the at least one processor of the at least one computer steps of:

• generating an ephemeral private key by the connection-establishing application and deriving its ephemeral public key, and generating a unique ID by means of the connection-establishing application;
• submitting the unique ID to a trusted server for an additional signature with the private key matching a publicly trusted certificate associated with the trusted server;
• sending back the signed unique ID to the first computing device;
• registering a virtual endpoint on a relay server with the signed unique ID, whereby the signed unique ID becomes a signed unique ID of the virtual endpoint;
• acquiring, at the second computing device and from the first computing device, an information packet comprising information about:
• a network configuration of the first computing device comprising:
• the signed unique ID of the virtual endpoint on the relay server;
• and
• an address of the relay server;
• the ephemeral public key;
• a fully qualified domain name of the trusted server;
• and
• the signature associated with the signed unique ID;
• determining, by the second computing device, whether the signature associated with the signed unique ID is valid and trusted;
• if the signature check of the prior determining step results in that the unique ID signature is valid and trusted, establishing a connection from the second computing device to the first computing device via the virtual endpoint by means of a transparent relay through the relay server;
• receiving, at the first computing device and from the second computing device, an information packet response being a response of the second computing device to the acquisition of the information packet, wherein the information packet response is encrypted with the ephemeral public key, and wherein the information packet response is transferred through the relay server by the second computing device and decrypted using the ephemeral private key, wherein the information packet response contains the following:
• the address of the relay server;
• a unique authorization token;
• a cryptographic checksum of a publicly trusted certificate associated with a private key of the second computing device, with the relay server address contained in the common name or alternate names of the publicly trusted certificate associated with the second computing device;
• and
• a signature generated using the private key corresponding to the publicly trusted certificate associated with the second computing device, the signature signing the address of the relay server, the unique authorization token and the cryptographic checksum of the publicly trusted certificate associated with the second computing device;
• determining, by the first computing device, whether the publicly trusted certificate which has been retrieved from a trusted source and is associated with the second computing device is valid;
• verifying the signature contained in the information packet response by validating the signature contained in the information packet response against a public key obtained from the publicly trusted certificate associated with the second computing device;
• if the verification of the information packet response results in that the information packet is valid, initiating a secure connection to the second computing device;
• providing a proof of possession of the ephemeral private key by generating a signature signing, with the ephemeral private key, information shared between the first computing device and the second computing device;
• accepting, by the second computing device, the connection, and allowing, by the second computing device, further data exchange between the two computing devices, by executing the following steps:
• receiving, at the second computing device, a hypertext transfer protocol secure request with the unique authorization token;
• verifying the proof of possession of the ephemeral private key by verifying the signature generated by signing the shared information, and thereby granting permanent means of authentication, namely a session token signed with the private key corresponding to the publicly trusted certificate associated with the second computing device, and granting access to resources available by means of the second computing device;
• and
• authorizing, by the second computing device, the secure connection from the first computing device.

A system for establishing a secure connection between two electronic computing devices which are located in a network environment, comprising:

• at least one computer having at least one processor and an associated memory, the memory having stored instructions which, when executed by the at least one processor, are operable to;
• generate an ephemeral private key by the connection-establishing application and deriving its ephemeral public key, and generating a unique ID by means of the connection-establishing application;
• submit the unique ID to a trusted server for an additional signature with the private key matching a publicly trusted certificate associated with the trusted server;
• send back the signed unique ID to the first computing device;
• register a virtual endpoint on a relay server with the signed unique ID, whereby the signed unique ID becomes a signed unique ID of the virtual endpoint;
• acquire, at the second computing device and from the first computing device, an information packet comprising information about:
• a network configuration of the first computing device comprising:
• the signed unique ID of the virtual endpoint on the relay server;
• and
• an address of the relay server;
• the ephemeral public key;
• a fully qualified domain name of the trusted server;
• and
• the signature associated with the signed unique ID;
• determine, by the second computing device, whether the signature associated with the signed unique ID is valid and trusted;
• if the signature check results in that the unique ID signature is valid and trusted, establish a connection from the second computing device to the first computing device via the virtual endpoint by means of a transparent relay through the relay server;
• receive, at the first computing device and from the second computing device, an information packet response being a response of the second computing device to the acquisition of the information packet, wherein the information packet response is encrypted with the ephemeral public key, and wherein the information packet response is transferred through the relay server by the second computing device and decrypted using the ephemeral private key, wherein the information packet response contains the following:
• the address of the relay server;
• a unique authorization token;
• a cryptographic checksum of a publicly trusted certificate associated with a private key of the second computing device, with the relay server address contained in the common name or alternate names of the publicly trusted certificate associated with the second computing device;
• and
• a signature generated using the private key corresponding to the publicly trusted certificate associated with the second computing device, the signature signing the address of the relay server, the unique authorization token and the cryptographic checksum of the publicly trusted certificate associated with the second computing device;
• determine, by the first computing device, whether the publicly trusted certificate which has been retrieved from a trusted source and is associated with the second computing device is valid;
• verify the signature contained in the information packet response by validating the signature contained in the information packet response against a public key obtained from the publicly trusted certificate associated with the second computing device;
• if the verification of the information packet response results in that the information packet is valid, initiate a secure connection to the second computing device;
• provide a proof of possession of the ephemeral private key by generating a signature signing, with the ephemeral private key, information shared between the first computing device and the second computing device;
• accept, by the second computing device, the connection, and allowing, by the second computing device, further data exchange between the two computing devices, by executing the following steps:
• receive, at the second computing device, a hypertext transfer protocol secure request with the unique authorization token;
• verify the proof of possession of the ephemeral private key by verifying the signature generated by signing the shared information, and thereby granting permanent means of authentication, namely a session token signed with the private key corresponding to the publicly trusted certificate associated with the second computing device, and granting access to resources available by means of the second computing device;
• and
• authorize, by the second computing device, the secure connection from the first computing device.