Blockchain-Based Mutual Authentication for Decentralized Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic access control systems relying on Public Key Infrastructures (PKIs) face vulnerabilities due to the risk of a 'single point of failure' from external attacks and inability to track certificate usage, limiting access control and certificate modification.
Innovation Solution
Implementing a blockchain-based access control method where terminal and ID token certificates are stored on separate blockchains, enabling mutual authentication and usage tracking without relying on PKIs, allowing for secure, decentralized, and offline-capable access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PKI-based certificate validation is used, then access control security is provided, but the system becomes vulnerable to single point of failure from external attacks and requires online connection
Solution Approach 1:
The patent segments the centralized certificate validation into distributed blockchain nodes. Each node maintains a copy of the certificate chain, eliminating the single point of failure. The blockchain is divided into blocks that are distributed across multiple nodes, allowing validation to occur locally without relying on a central online service.
Solution Approach 2:
The patent implements local certificate validation by storing the complete certificate chain locally in the blockchain. Each terminal can validate certificates independently using locally stored cryptographic data, eliminating the need for online connection to external validation services while maintaining security.
2Reliability
If PKI-based systems are used, then certificate validation is possible, but usage tracking and certificate modification capabilities are lost
Solution Approach 1:
The patent implements feedback mechanisms through blockchain transactions that record certificate usage. Each access attempt generates a transaction that is added to the blockchain, providing immutable usage records. This allows the system to track and audit certificate usage while maintaining validation capabilities.
Solution Approach 2:
The patent performs preliminary actions by pre-storing certificate chains and validation data in the local blockchain before online connection is available. This allows offline validation to occur using pre-loaded cryptographic materials, with usage tracking recorded in the local blockchain structure.
3Ease of operation
If centralized certificate validation service is used, then online access control works, but the system fails when the service becomes unavailable due to attacks
Solution Approach 1:
The patent implements self-service by enabling terminals to autonomously validate certificates using locally stored blockchain data. Each terminal independently performs cryptographic validation without requiring external service intervention, making the system self-sufficient and resilient to service unavailability.
Solution Approach 2:
The patent prepares validation data and certificate chains in advance by storing them in the local blockchain before online connection is needed. This preliminary preparation cushions the system against service unavailability, allowing continuous offline operation with pre-loaded validation materials.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for controlling access by a terminal (152) to an attribute (109) stored in an ID token. Terminal certificate information (165) relating to a terminal certificate (162) associated with the terminal (152) is stored in one or more entries of a first blockchain (114). The first blockchain (114) is stored in a memory of the ID token. Furthermore, ID token certificate information (115) relating to an ID token certificate (112) associated with the ID token is stored in one or more entries of a second blockchain (164), the second blockchain (164) being stored in a memory of the terminal (152).The procedure includes: • Performing terminal authentication, where the terminal (152) is authenticated by the ID token using the terminal certificate (162) and the terminal certificate information (165) of the second blockchain (164), • Performing ID token authentication, where the ID token is authenticated by the terminal (152) using the ID token certificate (112) and the ID token certificate information (115) of the first blockchain (114), • Upon successful terminal authentication and successful ID token authentication, releasing access for the terminal (152) to the attribute (109) stored in the ID token.