Authentication System Using Multi-Network CRL Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication systems for household devices lack a robust mechanism to prevent connections to invalid controllers, leading to potential security breaches and unauthorized access.
Innovation Solution
An authentication system that allows devices to acquire and compare certificate revocation lists (CRLs) from multiple controllers, determining the validity of the controllers and disabling connections to invalid ones, thereby ensuring secure connections to valid controllers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a device connects to a controller using conventional Wi-Fi Protected Setup, then device interconnectivity is guaranteed, but authentication is not performed to verify whether the connected device is valid
Solution Approach 1:
The patent performs authentication checks before establishing a connection. The device obtains a CRL from the controller and verifies the controller's certificate against it prior to connecting, preventing unauthorized connections before they can occur
Solution Approach 2:
The patent introduces a certificate revocation list (CRL) as an intermediary mechanism. The CRL acts as a mediator that carries revocation information from the certificate authority to the device, enabling the device to verify controller validity without direct communication with the certificate authority
2Reliability
If a certificate revocation list is used to authenticate device validity, then unauthorized access can be prevented, but the CRL must be kept updated which requires continuous network communication
Solution Approach 1:
The device obtains the CRL in advance during the connection establishment process, before authentication occurs. This preliminary acquisition ensures the device has current revocation information without requiring continuous updates
Solution Approach 2:
The controller automatically provides the current CRL to the device during connection setup. The device independently performs the verification using this provided CRL, without requiring manual intervention or complex update management
3Ease of operation
If a device is connected to only one controller, then connection management is simple, but the device cannot detect if the controller is invalid and cannot update its CRL
Solution Approach 1:
The patent divides the CRL verification process into separate steps: first obtaining the CRL from the controller, then verifying the controller's certificate against it. This segmentation allows the device to detect invalid controllers even with a single connection
Solution Approach 2:
The device performs feedback verification by checking the controller's certificate against the obtained CRL. This feedback mechanism allows the device to detect whether the controller is invalid and prevent connection accordingly
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An authentication system according to the present disclosure includes a first controller connected to a first server via a first network, a second controller connected to a second server via a second network, and a device. The device compares a next issue date described in a first certificate revocation list acquired from the first controller and an issue date described in a second certificate revocation list acquired from the second controller thereby determining whether the first controller is invalid or not.