Authentication Data Decoupling via Reference-Based Certificate
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing certificate systems for cryptographically secured communication between computer systems face challenges in decoupling authentication data from certificates, making it difficult to change authentication data without altering the certificate, and ensuring the authenticity and integrity of both the certificate and authentication data.
Innovation Solution
A method where an authentication file with authentication data is provided by a third computer system, using a certificate with a reference that secures the authenticity and integrity of the source, allowing changes to authentication data independently of the certificate, and ensuring the authenticity and integrity of the authentication data by the third computer system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If authentication data is embedded in the certificate, then the certificate contains all necessary authentication information, but the authentication data cannot be changed without altering the certificate
Solution Approach 1:
The patent divides the authentication system into two separate components: the certificate (containing only the reference and secured by certificate signature) and the authentication data (stored externally and accessed via the reference). This segmentation allows the authentication data to be changed independently of the certificate, resolving the contradiction between adaptability and complexity.
Solution Approach 2:
The authentication data is extracted from the certificate and stored in an external authentication file. The certificate retains only the reference to this external data and the certificate signature that secures the reference. This extraction enables the authentication data to be modified without altering the certificate, improving adaptability while maintaining certificate integrity.
2Productivity
If the certificate includes all authentication information, then verification is straightforward, but any change to authentication data requires reissuing the certificate
Solution Approach 1:
The patent introduces dynamic access to authentication data through a reference mechanism. The authentication data is stored externally and can be updated in real-time without triggering certificate reissuing. The certificate remains static with its reference and signature, while the authentication data can be dynamically changed, improving update efficiency and eliminating time loss for certificate reissuing.
3Stability of the object's composition
If authentication data is stored externally with a reference, then the certificate remains stable, but the authenticity and integrity of the authentication data must be secured separately
Solution Approach 1:
The patent uses the certificate signature as an intermediary that secures the reference to the authentication data. The certificate signature verifies the authenticity and integrity of the reference without requiring the authentication data itself to be embedded in the certificate. This intermediary mechanism maintains certificate stability while ensuring the reliability of authentication data access.
4Adaptability or versatility
If the certificate and authentication data are coupled, then verification is simple, but flexibility to change authentication data independently is lost
Solution Approach 1:
The patent segments the authentication system into the certificate (with reference and signature) and the authentication data (stored externally). This segmentation provides independent change capability for authentication data while maintaining verification simplicity through the reference mechanism, resolving the contradiction between adaptability and operational ease.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
The invention relates to a method for authenticating a first computer system (100) to a second computer system (200). A third computer system (300) provides an authentication file containing authentication data for authenticating the first computer system (100). A certificate (112) issued for the first computer system (100) comprises a reference (128) for identifying the authentication data. The third computer system (300) receives a read request from the second computer system (200) for reading the authentication data, wherein the read request identifies the authentication data by using the reference (128). In response to reception of the read request, the third computer system (300) transmits the requested authentication data to the second computer system (200).