Certificate verification

According to an example aspect, there is provided an apparatus configured to participate in establishment of a secured protocol connection, receive over a first interface a certificate in connection with the establishment of the secured protocol connection, receive, in connection with the establishment of the secured protocol connection, over a second interface, information concerning the certificate, and compare the certificate to the information concerning the certificate.

RELATED APPLICATION

This application was originally filed as PCT Application No. PCT/FI2015/050273 filed Apr. 21, 2015.

FIELD

The present invention relates to the field of communication security.

BACKGROUND

Eavesdropping on electronic communications poses a risk to confidentiality of information communicated using communication networks. To prevent unauthorized access to confidential information, such as documents or telephone discussions, use of unsecured networks may be avoided with communicating confidential information.

Using only secured networks, by which it is meant networks that are inaccessible to potential eavesdroppers, may be difficult. For example, separate secured networks may not be available, or their use or implementation may be difficult, slow or expensive.

Encryption may be employed when communicating over an unsecure network. Symmetric encryption keys may be exchanged beforehand, such that the symmetric keys may be used to convert plaintext contents into ciphertext. By transmitting the ciphertext, but not the plaintext, over an unsecure network, confidentiality of the contents may be preserved, since encryption algorithms are designed in such a way that obtaining the plaintext from the ciphertext without the encryption key is very difficult. An example of a symmetric encryption algorithm is the Blowfish algorithm.

Exchanging symmetric encryption keys beforehand may take place out of band, by which it is meant the encryption keys are not communicated over the unsecure network. The encryption keys may be exchanged via paper mail, messenger, diplomatic pouch or other suitable methods.

Out of band encryption key exchange is not needed when using public key encryption, where encryption is possible using a public key, which need not be kept secret and can be communicated over unsecured networks. Ciphertext produced with a public key, however, cannot be decrypted to obtain the plaintext by using the public key, rather, a separate private key is needed, the private key being guarded by the recipient and not communicated over unsecured connections. In some communication protocols, public key encryption is used to communicate a symmetric encryption key that is subsequently used in securing a protocol connection.

Transport layer security, TLS, is a cryptographic protocol for Internet communication. TLS employs cryptographic certificates and public key cryptography to cause a shared secret to be established between communicating nodes, the shared secret subsequently enabling use of symmetric encryption to secure the protocol connection.

SUMMARY OF THE INVENTION

According to a first aspect of the present invention, there is provided an apparatus comprising at least one processing core, at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processing core, cause the apparatus at least to participate in establishment of a secured protocol connection, receive over a first interface a certificate in connection with the establishment of the secured protocol connection, receive, in connection with the establishment of the secured protocol connection, over a second interface, information concerning the certificate, and compare the certificate to the information concerning the certificate.

Various embodiments of the first aspect may comprise at least one feature from the following bulleted list:the at least one memory and the computer program code are configured to, with the at least one processing core, cause the apparatus to participate in the establishment of the secured protocol connection by receiving and transmitting messages over the first interfacethe first interface comprises an internet protocol connection with a correspondent node, the first interface traversing a first transceiver, the secured protocol connection being established between the apparatus and the correspondent nodethe second interface comprises a connection with a network access device, the second interface traversing a second transceiverthe second interface comprises a packet based connection with a network access device, the second interface traversing the first transceiverthe packet based connection with the network access device is secured with a shared secretthe at least one memory and the computer program code are configured to, with the at least one processing core, cause the apparatus to receive the shared secret as input from a userthe secured protocol connection comprises a transport layer security connectionthe at least one memory and the computer program code are configured to, with the at least one processing core, cause the apparatus to verify a cryptographic signature of at least one of the certificate and the information concerning the certificatethe apparatus is configured to complete the establishment of the secured protocol connection at least in part as a response to a determination that the information concerning the certificate is consistent with the certificatethe apparatus is configured to participate in establishing the secured protocol connection over the second interface responsive to the information concerning the certificate being determined to be inconsistent with the certificate.

According to a second aspect of the present invention, there is provided an apparatus comprising at least one processing core, at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processing core, cause the apparatus at least to relay messages between a first node and a second node, the messages relating to establishment of a secured protocol connection, receive, in connection with the establishment of the secured protocol connection, a certificate from the second node, and provide the certificate to the first node over a first interface and over a second interface.

Various embodiments of the second aspect may comprise at least one feature from the following bulleted list:the apparatus is configured to provide network access to the first nodethe first interface comprises a leg of an internet protocol connection between the first node and the second nodethe the second interface comprises a short range radio interface with the first nodethe second interface comprises a packet based connection with the first node, the apparatus being an endpoint of the packet based connection with the first nodethe secured protocol connection comprises a transport layer security connection.

According to a third aspect of the present invention, there is provided a method comprising participating, by an apparatus, in establishment of a secured protocol connection, receiving over a first interface a certificate in connection with the establishment of the secured protocol connection, receiving, in connection with the establishment of the secured protocol connection, over a second interface, information concerning the certificate, and comparing the certificate to the information concerning the certificate.

Various embodiments of the third aspect may comprise at least one feature corresponding to a feature from the preceding bulleted list laid out in connection with the first aspect.

According to a fourth aspect of the present invention, there is provided a method comprising relaying, by an apparatus, messages between a first node and a second node, the messages relating to establishment of a secured protocol connection, receiving, in connection with the establishment of the secured protocol connection, a certificate from the second node, and providing, from the apparatus, the certificate to the first node over a first interface and over a second interface.

Various embodiments of the fourth aspect may comprise at least one feature corresponding to a feature from the preceding bulleted list laid out in connection with the second aspect.

According to a fifth aspect of the present invention, there is provided an apparatus comprising means for participating in establishment of a secured protocol connection, means for receiving over a first interface a certificate in connection with the establishment of the secured protocol connection, means for receiving, in connection with the establishment of the secured protocol connection, over a second interface, information concerning the certificate, and means for comparing the certificate to the information concerning the certificate.

According to a sixth aspect of the present invention, there is provided an apparatus comprising means for relaying messages between a first node and a second node, the messages relating to establishment of a secured protocol connection, means for receiving, in connection with the establishment of the secured protocol connection, a certificate from the second node, and means for providing, from the apparatus, the certificate to the first node over a first interface and over a second interface.

According to a seventh aspect of the present invention, there is provided a non-transitory computer readable medium having stored thereon a set of computer readable instructions that, when executed by at least one processor, cause an apparatus to at least participate in establishment of a secured protocol connection, receive over a first interface a certificate in connection with the establishment of the secured protocol connection, receive, in connection with the establishment of the secured protocol connection, over a second interface, information concerning the certificate, and compare the certificate to the information concerning the certificate.

According to an eighth aspect of the present invention, there is provided a non-transitory computer readable medium having stored thereon a set of computer readable instructions that, when executed by at least one processor, cause an apparatus to at least relay messages between a first node and a second node, the messages relating to establishment of a secured protocol connection, receive, in connection with the establishment of the secured protocol connection, a certificate from the second node, and provide the certificate to the first node over a first interface and over a second interface.

According to a ninth aspect of the present invention, there is provided a computer program configured to cause a method in accordance with at least one the second and third aspects to be performed.

EMBODIMENTS

By obtaining a second copy of a cryptographic certificate via a second interface, it may be discovered if a man-in-the-middle, MITM, attack is ongoing with respect to a first interface in a computing device of a user, when a secured protocol connection, such as a TLS connection, is being established.

FIG. 1illustrates a first system in accordance with at least some embodiments of the present invention. The system ofFIG. 1comprises device110, which may comprise a user device, such as, for example, a laptop computer, desktop computer, tablet computer or other kind of computer, smartphone, or other kind of suitable computing device. Device110ofFIG. 1comprises a first transceiver114and a second transceiver118. First transceiver114may comprise, for example, an Ethernet port, wireless local area network, WLAN, which is also known as Wi-Fi, transceiver, or another kind of suitable port or transceiver. Second transceiver118may comprise a communication transceiver, such as, for example, a wire-line or wireless transceiver. For example, second transceiver118may comprise a low-power wireless interface, or an Ethernet interface. Examples of low-power wireless interfaces include Bluetooth, Wibree, ZigBee and infrared interfaces.

Running in device110is program112, which may comprise a browser, for example. A browser may comprise a program configured to retrieve, over the world wide web, pages that are then rendered, or displayed, to a user. Other examples of program112include a network banking application, a messaging application and a telephonic application that enables voice communication between two parties. Such voice communication may be packet-based, for example.

Program112may be configured to initiate a secured protocol connection with correspondent node140. A secured protocol connection may comprise a transport layer security, TLS, connection, for example. TLS is specified by the Internet Engineering Task Force, IETF, and exists in versions 1.0, 1.1 and 1.2. In general a secured protocol connection may comprise any protocol connection that uses at least one cryptographic certificate to verify at least one identity of a node. Alternatively to TLS, the secured protocol connection may comprise a secure sockets layer, SSL, connection, for example. Program112may be configured to use a default networking option Establishing the secured protocol connection may take place over a first interface, such as, for example, an internet protocol, IP, connection. An IP connection between device110and correspondent node140is illustrated inFIG. 1as comprising legs101C,101D and101E. Further, inside device110, legs101B and101A convey information between program112and correspondent node140. In detail, leg101C connects device110to internet access device120. Internet access device120may comprise a WLAN base station, Ethernet router or another access device configured to provide internet connectivity to device110. Leg101D connects internet access device120to network130. Network130may comprise the Internet, at least in part, and/or a corporate network. Leg101E connects correspondent node140to network130. Leg101A is comprised in the first interface that program112has. Internet access device120may be configured to relay packets comprised in a packet connection between device110and correspondent node140without functioning as an endpoint in the packet connection, for example.

Program112may initiate the establishment of the secured protocol connection by transmitting, over the first interface, an initial packet to correspondent node140. An example of an initial packet is a ClientHello packet in a TLS handshake. In connection with an establishment procedure, such as a handshake, triggered by the initial packet, correspondent node140may transmit to device110a cryptographic certificate of correspondent node140. In some embodiments, it is correspondent node140, rather than program112, that initiates the establishment of the secured protocol connection. A cryptographic certificate of correspondent node140may comprise at least one of the following: a public key, a cryptographic signature, an identifier of a cryptographic signature algorithm, an identifier of correspondent node140and an identifier of a party operating correspondent node140. Once program112has the cryptographic certificate, it may verify the signature on the certificate is valid. The signature may be applied, for example, by a signing authority that is known to program112. Program112may have a public key of the signing authority, or access to such a key, that program112may use in verifying the cryptographic signature of the certificate.

In case the signature is valid, program112may trust that the certificate is from correspondent node140and has not been tampered with, for example during transit over the first interface, that is, legs101E,101D,101C or inside device110itself. Program112may be configured to use the public key in the certificate to transmit to correspondent node140information encrypted with this public key, which can only be decrypted by correspondent node140which possesses the corresponding private key. Program112may be configured to generate the information, before encrypting it with the public key, using a random number generator, for example. This information may be used as a symmetric encryption key on the secured protocol connection between program112and correspondent node140, or it may be used in generating such a symmetric encryption key. In general, a symmetric encryption key is an encryption key that is used with a symmetric encryption algorithm, such that the same key can be used to encrypt and to decrypt. In general, the information program112sends to correspondent node140, encrypted with the public key from the certificate received from correspondent node140, may be used to establish, at least in part, the secured protocol connection.

Once the secured protocol connection is established, it may be used to communicate in an end to end encrypted fashion such that only program112and correspondent node140have the encryption key needed to access the contents of this communication.

A risk in establishing a secured protocol connection as described above is a man-in-the-middle attack, also known by the acronym MITM. In the system ofFIG. 1, device110comprises a MITM element116, which may be installed therein by a manufacturer of device110, or it may be installed therein after manufacture without the knowledge of the user of device110. MITM element116may be comprised in first transceiver114, or it may be distinct from first transceiver114. MITM element116may be configured to monitor connections between program112and first transceiver114, and responsive to a determination that a secured protocol connection establishment is ongoing between program112and a correspondent node, MITM element116may be configured to intercept the message from the correspondent node that comprises the cryptographic certificate. MITM element116may then generate a new forged certificate, which comprises a forged public key. MITM element116may sign this forged certificate with a private key of MITM element116itself, such that a public key corresponding to this private key has been included in a list of trusted signing authority public keys that program112uses to verify incoming cryptographic certificates. An example of a list of trusted signing authority public keys is a Windows certificate store.

MITM element116may then provide the forged and signed cryptographic certificate to program112, such that program112will handle the forged certificate the same way it would handle the genuine certificate, which MITM element116has stored but not provided to program112. Program112may reply toward correspondent node140with a message comprising information encrypted with the forged public key. MITM element116may then intercept this message, decrypt the encrypted information therein with the private key of MITM element116and establish a secured protocol connection between MITM element116and program112. MITM element116may also complete the establishment of the secured protocol connection with correspondent node140without informing program112. As a result, instead of one secured protocol connection there will be two secured protocol connections, a first one between program112and MITM element116, and a second one between MITM element116and correspondent node140. MITM element116may relay packets between the secured protocol connections, such that program112and correspondent node140may both believe they are communicating directly with each other. However, in reality all information exchanged between program112and correspondent node140is decrypted in MITM element116, and re-encrypted before sending to the intended recipient. Such a man-in-the-middle attack provides MITM element116access to the encrypted information exchanged between program112and correspondent node140, severely undermining the confidentiality of this protocol connection.

Program112will verify the forged certificate as valid, since MITM element116has a private key to use in signing the forged certificate that corresponds to a public key that program112thinks is a valid signing key. The delay MITM element116causes in generating the forged certificate is unlikely to be noticed by program112, since there exist end-to-end delays in networks anyway.

Internet access device120may be configured to monitor connections between device110and network130, and responsive to a determination that a secured protocol connection establishment is ongoing between program112and a correspondent node, Internet access device120may be configured to store a copy of the message from the correspondent node that comprises the cryptographic certificate. Program112may, for example via second transceiver118, alert internet access device120that program112is about to initiate, or just has initiated, establishment of a secured protocol connection.

Internet access device120may provide to program112, via connection102it has with second transceiver118, a copy of the cryptographic certificate it received from the correspondent node. This copy of the certificate is provided from second transceiver118to program112over a second interface of program112. The second interface in the system ofFIG. 1connects program112to internet access device120via second transceiver118. Program112may compare this copy received over the second interface to the copy it receives over the first interface, that is, the interface it is using to establish the secured protocol connection. In case a MITM element116disposed between Internet access device120and program112is active, program112may detect its presence since the forged certificate provided to program112by MITM element116is different from the copy of the genuine certificate program112receives via the second interface. Thus program112may alert the user or abort the establishment of the secured protocol connection, for example.

A connection between program112and internet access device120may be secured. For example, the internet access device may have a display configured to display a code, such as a numeric or alphanumeric code, which the user can read and provide to program112via a user interface. Alternatively to a display, a sticker may be placed on Internet access device120that has a code printed thereon. As a yet further alternative, a serial number of internet access device120may be used as the code. This code can be used to secure the connection, for example by using the code as a symmetric encryption key in communication between program112and internet access device120. Alternatively, the code may be used, at least in part, to generate an encryption key that is then used to encrypt communication between program112and internet access device120. Making the connection between program112and Internet access device120secure may prevent malicious code within device110from interfering with the connection to conceal the presence of MITM element116. An alphanumeric code of thirty-two 8-bit characters corresponds to a length of 128 bits, for example.

Thus in the system ofFIG. 1, program112has a first interface, which traverses first transceiver114, with correspondent node140and program112has a second interface, which traverses second transceiver118, with Internet access device120.

FIG. 2illustrates a second system in accordance with at least some embodiments of the present invention. The system ofFIG. 2shares elements with that ofFIG. 1, and like numbering denotes like structure as inFIG. 1. Unlike inFIG. 1, inFIG. 2both the first interface and the second interface traverse first transceiver114. In detail, the second interface comprises communication legs201A,201B and201C. The second interface may comprise a packet connection, such as for example an IP connection, where internet access device120is an endpoint of the packet connection. Since the second interface traverses the first transceiver, the second interface may also traverse MITM element116. Although second transceiver118is not illustrated inFIG. 2, its presence is not excluded in embodiments arranged to function as described herein in connection withFIG. 2.

Since the second interface in the embodiments ofFIG. 2may traverse MITM entity116, the second interface may be secured with a code, as discussed above in connection withFIG. 1. Program112may signal to internet access device120to alert internet access device120that program120intends to establish a secured packet connection, after which internet access device120may transmit a copy of the cryptographic certificate of correspondent node140to program112via the second interface, encrypted with the code or a shared secret derived from the code. Since MITM entity116does not know the code, it cannot tamper with the second interface, in detail, it cannot encrypt the forged certificate it creates with the code, since it doesn't know the code.

In some embodiments the second interface, although traversing MITM entity116, may nonetheless be unsecured with a code. This may work, since MITM entity116may not be configured to react to messaging exchanged between program112and internet access device120, in case MITM entity116is only configured to intercept an establishment procedure, such as a handshake, of a specific cryptographic protocol.

Overall, both in theFIG. 1andFIG. 1embodiments, internet access device120may provide, over the second interface, to program112a copy of the certificate, or more generally information concerning the certificate. Information concerning the certificate may comprise a copy of the certificate itself, a hash of at least part of the certificate, or an identity of a signing authority that has signed the certificate, for example, or a combination thereof. Likewise in theFIG. 1orFIG. 2embodiments, responsive to a mismatch between the certificate received over the first interface and the information concerning the certificate received over the second interface, program112may be configured to establish the secured protocol connection over the second interface. This may comprise restarting the establishment of the secured protocol connection, or completing the already started establishment of the secured protocol connection by transmitting a response to the certificate via the second interface. Likewise, in both theFIG. 1andFIG. 1embodiments, entity120may comprise more generally a network access device, of which an internet access device is an example. However, the principles of the invention are applicable also in embodiments where the internet is not used. Network access device120may be external to device110.

FIG. 3illustrates an example apparatus capable of supporting at least some embodiments of the present invention. Illustrated is device300, which may comprise, for example, device110ofFIG. 1orFIG. 2. Comprised in device300is processor310, which may comprise, for example, a single- or multi-core processor wherein a single-core processor comprises one processing core and a multi-core processor comprises more than one processing core. Processor310may comprise more than one processor. A processing core may comprise, for example, a Cortex-A8 processing core manufactured by ARM Holdings or a Steamroller processing core produced by Advanced Micro Devices Corporation. Processor310may comprise at least one Qualcomm Snapdragon and/or Intel Core processor. Processor310may comprise at least one application-specific integrated circuit, ASIC. Processor310may comprise at least one field-programmable gate array, FPGA. Processor310may be means for performing method steps in device300. Processor310may be configured, at least in part by computer instructions, to perform actions.

Device300may comprise memory320. Memory320may comprise random-access memory and/or permanent memory. Memory320may comprise at least one RAM chip. Memory320may comprise solid-state, magnetic, optical and/or holographic memory, for example. Memory320may be at least in part accessible to processor310. Memory320may be means for storing information. Memory320may comprise computer instructions that processor310is configured to execute. When computer instructions configured to cause processor310to perform certain actions are stored in memory320, and device300overall is configured to run under the direction of processor310using computer instructions from memory320, processor310and/or its at least one processing core may be considered to be configured to perform said certain actions. Memory320may be at least in part comprised in processor310. Memory320may be at least in part external to device300but accessible to device300.

Device300may comprise a transmitter330. Device300may comprise a receiver340. Transmitter330and receiver340may be configured to transmit and receive, respectively, information in accordance with at least one cellular or non-cellular standard. Transmitter330may comprise more than one transmitter. Receiver340may comprise more than one receiver. A combination of transmitter and receiver may be referred to as a transceiver. Transmitter330and/or receiver340may be configured to operate in accordance with global system for mobile communication, GSM, wideband code division multiple access, WCDMA, long term evolution, LTE, IS-95, wireless local area network, WLAN, Ethernet and/or worldwide interoperability for microwave access, WiMAX, standards, for example.

Device300may comprise user interface, UI,360. UI360may comprise at least one of a display, a keyboard, a touchscreen, a vibrator arranged to signal to a user by causing device300to vibrate, a speaker and a microphone. A user may be able to operate device300via UI360, for example to browse the internet or to handle networked banking

Processor310may be furnished with a transmitter arranged to output information from processor310, via electrical leads internal to device300, to other devices comprised in device300. Such a transmitter may comprise a serial bus transmitter arranged to, for example, output information via at least one electrical lead to memory320for storage therein. Alternatively to a serial bus, the transmitter may comprise a parallel bus transmitter. Likewise processor310may comprise a receiver arranged to receive information in processor310, via electrical leads internal to device300, from other devices comprised in device300. Such a receiver may comprise a serial bus receiver arranged to, for example, receive information via at least one electrical lead from receiver340for processing in processor310. Alternatively to a serial bus, the receiver may comprise a parallel bus receiver.

Device300may comprise further devices not illustrated inFIG. 3. For example, where device300comprises a smartphone, it may comprise at least one digital camera. Some devices300may comprise a back-facing camera and a front-facing camera, wherein the back-facing camera may be intended for digital photography and the front-facing camera for video telephony. Device300may comprise a fingerprint sensor arranged to authenticate, at least in part, a user of device300. In some embodiments, device300lacks at least one device described above. For example, some devices300may lack a NFC transceiver350.

Processor310, memory320, transmitter330, receiver340, NFC transceiver350and/or UI360may be interconnected by electrical leads internal to device300in a multitude of different ways. For example, each of the aforementioned devices may be separately connected to a master bus internal to device300, to allow for the devices to exchange information. However, as the skilled person will appreciate, this is only one example and depending on the embodiment various ways of interconnecting at least two of the aforementioned devices may be selected without departing from the scope of the present invention.

FIG. 4illustrates signalling in accordance with at least some embodiments of the present invention. On the vertical axes are disposed, from left to right, in terms ofFIG. 1and/orFIG. 2, program112, MITM entity116, internet access device120, and, finally, correspondent node140. In the figure, time advances from the top toward the bottom.

In phase410, program112may initiate a connection with correspondent node140, such as for example a secured protocol connection. Initiating the connection may comprise triggering an establishment procedure of the connection. Phase410may take place over the first interface. In optional phase420, program112may alert internet access device120, for example over the first interface or the second interface, that a secure protocol connection will be established over the first interface. As a response, internet access device120may begin monitoring for incoming cryptographic certificates. Where present, phase420may take place before or after phase410. Where phase420is absent, internet access device120may continually monitor for incoming cryptographic certificates.

In phase430, correspondent node140transmits its cryptographic certificate toward program112, wherein program112would receive the cryptographic certificate over the first interface but MITM entity116is configured to intercept this message, preventing program112from receiving it. Responsively, in phase440MITM entity440generates a forged certificate, which MITM entity116signs using a private key. In phase460MITM entity116provides the forged certificate to program112as an apparent message from correspondent node140.

In phase450, internet access device120detects that the cryptographic certificate of correspondent node140traverses internet access device120in phase430on its way toward device110, in which program112is running Internet access device120stores a copy of the cryptographic certificate, and in phase470internet access device120transmits, over the second interface, to program112information concerning the cryptographic certificate, which, as noted above, may comprise the cryptographic certificate itself, for example.

In phase480, program112may compare the certificate received in phase460, over the first interface, to the information concerning the certificate, received in phase470over the second interface. Depending on an outcome of this comparison, program112may abort establishment of the secured protocol connection, complete establishment of the secured protocol connection over the first interface, complete establishment of the secured protocol connection over the second interface or alert the user, for example, as described above.

FIG. 5is a first flow graph in accordance with at least some embodiments of the present invention. The phases of the illustrated method may be performed in device110, for example, or in a control device configured to control the functioning of device110, when implanted therein.

Phase510comprises participating, by an apparatus, in establishment of a secured protocol connection. The apparatus may comprise device110, for example. Phase520comprises receiving over a first interface a certificate in connection with the establishment of the secured protocol connection. Phase530comprises receiving over a second interface information concerning the certificate. The receiving of phase530may take place in connection with the establishment of the secured protocol connection. For example, the receiving may take place during the establishment of the secured protocol connection, which may comprise the receiving taking place during a handshaking procedure establishing the secured protocol connection. The method may comprise delaying the completion of the establishment of the secured protocol connection to wait for the reception of the information concerning the certificate. Finally, phase540comprises comparing the certificate to the information concerning the certificate. Participating in establishment of a secured protocol connection may comprise, for example, performing the role of client or server in a handshake procedure of the secured protocol connection, such as, for example, a TLS handshake.

FIG. 6is a second flow graph in accordance with at least some embodiments of the present invention. The phases of the illustrated method may be performed in internet access device120, for example, or in a control device configured to control the functioning of internet access device120, when implanted therein.

Phase610comprises relaying, by an apparatus, messages between a first node and a second node, the messages relating to establishment of a secured protocol connection. The apparatus may comprise internet or network access device120, for example. Phase620comprises receiving, in connection with the establishment of the secured protocol connection, a certificate from the second node. Finally, phase630comprises providing, from the apparatus, the certificate to the first node over a first interface and over a second interface.

INDUSTRIAL APPLICABILITY

At least some embodiments of the present invention find industrial application in increasing communication security.

ACRONYMS LIST

IETF Internet Engineering Task ForceIP Internet protocolMITM man-in-the middle attackWi-Fi wireless local area networkWLAN wireless local area networkSSL secure sockets layerTLS transport layer security

REFERENCE SIGNS LIST

101A-EConnection between program 112 and correspondent node 140102Connection between internet access device and second transceiver110Device112Program114First transceiver116MITM entity118Second transceiver120internet access device, more generally network access device130Network140Correspondent node201A-CSecond interface in the FIG. 2 embodiment300-360Structure of FIG. 3 device410-480Phases of FIG. 4 method510-540Phases of FIG. 5 method610-640Phases of FIG. 6 method