Digital Certificate Issuance via Challenge-Response Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for issuing digital certificates by a certification authority only verify that a device possesses the corresponding private key, failing to authenticate the device's genuineness or originality, which can lead to issuance of certificates for non-original devices.
Innovation Solution
Incorporating a challenge-response dialog based on the Diffie-Hellman method, where the certification authority generates a random number and the device calculates a corresponding value, ensuring secure authentication without requiring a secure second transmission path, and optionally using an authentication chip for key storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If only the private key possession is verified through CSR signature, then the certificate issuance process is simple and fast, but the device authenticity cannot be verified
Solution Approach 1:
The patent applies preliminary action by performing authentication challenges before the certificate issuance is completed. The certification authority sends challenge messages to the device, and only after successful verification of the device's response does the CA proceed to issue the certificate. This ensures the device is authenticated before the critical certificate creation step.
Solution Approach 2:
The patent implements feedback through the challenge-response mechanism where the certification authority sends challenge messages to the device and verifies the responses. This feedback loop allows the CA to confirm the device's identity and possession of the private key before issuing the certificate, thereby improving reliability without permanently complicating the overall process.
2Reliability
If a secure second transmission path is used to transport CSR, then device authenticity can be verified, but the system complexity and potential attack vectors increase
Solution Approach 1:
The patent extracts the authentication mechanism from the CSR transmission process itself. Instead of relying on a separate secure transmission path for the CSR, the authentication challenges are integrated into the certificate issuance dialogue. The CA sends challenges directly to the device, and the device responds using its private key, thereby verifying authenticity without requiring a separate secure channel for CSR transport.
Solution Approach 2:
The patent makes the certification authority's communication serve multiple functions: it both authenticates the device and manages the certificate issuance process. The challenge-response mechanism allows the same communication channel to be used for both authentication and certificate transmission, eliminating the need for separate secure paths and reducing attack surface.
3Reliability
If challenge-response authentication is added to verify device genuineness, then the security against plagiarism increases, but the certificate issuance time increases
Solution Approach 1:
The patent applies partial action by implementing challenge-response authentication only for critical verification steps rather than throughout the entire certificate lifecycle. The authentication challenges are performed during the issuance process to verify device genuineness, but once authenticated, the certificate can be issued efficiently without continuous authentication overhead, thereby balancing security with time efficiency.
Data Source
Figure 1~2
AI summary
The invention relates to a method for issuing a digital certificate by a certification authority (B), wherein a device (A) sends a request message to the certification authority (B) for issuing the certificate, the certification authority (B) receives the request message and sends a request for authenticating the device (A) to the device (A), the device (A) sends a response to the certification authority (B) in response to the received request, and the certification authority (B) checks the received response and generates the certificate and sends the certificate to the device (A), if the response was identified as correct.