Blockchain Public Key Infrastructure Scalability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current public key infrastructure (PKI) systems face scalability challenges, particularly in establishing trust and verifying revoked digital certificates, especially as the number of asymmetric key pairs is expected to increase significantly with the Internet of Things (IoT) deployments, with thousands of 'root' CAs existing and the current method for finding a root certificate being inefficient and reliant on human verification.
Innovation Solution
Implementing a public key infrastructure using a blockchain as a scalable infrastructure, where a blockchain serves as a repository for public keys and certificates, enabling chains of trust and resilient integrity through distributed hashing and consensus among miners, allowing for efficient introduction and revocation of public keys and maintaining a history of past behavior for reputation-based trust.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single global root CA is used to issue and sign digital certificates, then trust establishment and interoperability are simplified, but the system lacks scalability and resilience for large-scale deployments like IoT
Solution Approach 1:
The patent segments the centralized root CA into multiple distributed root CAs across a blockchain network. Each root CA operates independently but maintains trust through cryptographic verification of signatures on the blockchain, eliminating the need for a single global authority while preserving trust establishment.
Solution Approach 2:
The blockchain serves as an intermediary layer between entities and root CAs. Instead of directly trusting a single root CA, entities verify certificates through the blockchain's distributed ledger, which records and validates signatures from multiple root CAs, thereby mediating trust establishment across the network.
2Productivity
If thousands of root CAs are deployed to improve scalability, then the system can handle more entities, but finding and verifying root certificates becomes inefficient and requires human intervention
Solution Approach 1:
The system enables automated self-service verification where endpoints independently verify root certificates by checking cryptographic signatures on the blockchain without human intervention. The blockchain's consensus mechanism and distributed verification allow automatic validation of trust relationships.
Solution Approach 2:
The blockchain provides real-time feedback on certificate validity and revocation status through its immutable ledger. Verification processes query the blockchain for current trust states, receiving immediate feedback on whether certificates are valid, revoked, or compromised, eliminating manual verification delays.
3Reliability
If traditional PKI methods are used for revocation checking, then certificate revocation can be implemented, but the process requires tracing through multiple reports and advisories which is time-consuming and inefficient
Solution Approach 1:
The patent merges the revocation checking function into the blockchain's core ledger structure. Instead of separate revocation lists and advisory reports, revocation information is integrated directly into the blockchain's certificate validation process, allowing simultaneous verification of certificate validity and revocation status in a single operation.
Solution Approach 2:
The system performs preliminary actions by pre-recording all certificate issuance, revocation, and status changes on the blockchain in real-time. When verification is needed, the information is already available and validated on the distributed ledger, eliminating the need to trace through multiple reports and advisories after the fact.
4Reliability
If endpoints store millions of digital certificates locally for verification, then complete trust verification is possible, but the storage requirements and computational overhead become prohibitive
Solution Approach 1:
The blockchain serves multiple functions: it acts as a distributed database for certificates, a verification authority through cryptographic validation, a revocation registry, and a trust anchor simultaneously. This multi-functionality eliminates the need for endpoints to maintain separate local repositories of millions of certificates while achieving complete trust verification.
Solution Approach 2:
The blockchain acts as an intermediary that provides on-demand certificate verification services to endpoints. Instead of storing all certificates locally, endpoints query the blockchain for specific certificate validations, receiving verified trust information without maintaining large local storage requirements.
Data Source
AI summary
Techniques for implementing public key infrastructure using blockchains are described. An apparatus may receive, from a introducee principal, a proof-of-work. The apparatus may combine the proof-of-work with an identifier of the introducee principal. The apparatus may generate an introduction of the introducee principal. The introduction may include signing, using an asymmetric private key assigned to the apparatus, the combination of the proof-of-work and the identifier of the introducee principal. The apparatus may publish the introduction of the introducee principal to a blockchain.