Certificate Chain Verification via Sequential Overwrite

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current systems for verifying certificate chains in storage devices face challenges due to limited memory and processing capacity, making it difficult to efficiently store and analyze long strings of certificates, which are often received in random order, requiring significant storage space and processing power.

Innovation Solution

Implementing a system where certificate chains are received and verified in sequential order, allowing for immediate verification and storage of each string, with the option to overwrite previously verified strings, reducing the need for extensive storage space and optimizing processing efficiency.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If certificate chains are stored in storage devices for verification, then authentication security is improved, but memory usage and processing capacity requirements increase significantly

Engineering Contradiction:

Improveauthentication securityVSAvoidmemory usage

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The certificate chain verification process is divided into multiple passes. In the first pass, certificates are verified sequentially and stored in a verification buffer. In the second pass, the stored certificates are used to verify the authentication request. This segmentation allows certificates to be processed and discarded in stages rather than requiring all certificates to be stored simultaneously, reducing memory requirements while maintaining verification security.

Inventive Principle:

Principle #1Segmentation

2Reliability

If complete certificate chains are received and verified, then authentication reliability is improved, but processing time and computational overhead increase

Engineering Contradiction:

Improveauthentication reliabilityVSAvoidprocessing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The host device performs preliminary verification of the certificate chain before transmitting it to the storage device. The host verifies the cryptographic signatures and validity of certificates in advance, so that the storage device only needs to perform the final authentication check using the pre-verified certificates. This preliminary action reduces the processing time and computational burden on the resource-constrained storage device while maintaining overall authentication reliability.

Inventive Principle:

Principle #10Preliminary action

3Adaptability or versatility

If certificates are received in random order, then flexibility in transmission is improved, but verification complexity and storage requirements increase

Engineering Contradiction:

Improvetransmission flexibilityVSAvoidverification complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

Instead of requiring certificates to be received and stored in the order they will be verified, the system inverts the approach by first receiving all certificates in any order, verifying them sequentially to build the verification chain, and only then using them for authentication. This inversion allows flexible reception order while maintaining verification simplicity, as the sequential processing naturally handles the certificate hierarchy regardless of arrival order.

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS8140843B2Content control method using certificate chains

Publication Date: 2012.03.20 SANDISK TECHNOLOGIES LLC

AI summary

Continuous strings of certificates in a certificate chain received by a memory device sequentially in the same order that the strings are verified. Each string except for the last may be overwritten by the next one in the sequence.