Certificate Issuance Identity-Public Key Consistency Check
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing automatic certificate issuance solutions lack verification of the consistency between the identity of the certificate applicant and the public key, leading to security risks such as public key replacement attacks.
Innovation Solution
Introduce a trusted Identity Provider (IDP) to authenticate the certificate application identity and ensure the public key matches the identity, by comparing the public key returned by the IDP with the one requested in the certificate signing request.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automatic certificate issuance is implemented without manual identity authentication, then certificate issuance efficiency is improved, but security risks increase due to lack of identity-public key consistency verification
Solution Approach 1:
The patent applies preliminary action by requiring the certificate applicant to pre-authenticate their identity with an identity provider (IDP) before submitting the certificate signing request. The IDP binds the applicant's identity to a public key in advance, and this binding is later verified by the certificate issuance device. This preliminary identity authentication ensures that when the automatic issuance process occurs, the security requirement for identity-public key consistency is already satisfied, thus resolving the contradiction between automation efficiency and security reliability
2Device complexity
If only ownership of certificate application identity is verified, then issuance process is simplified and automated, but public key tampering cannot be detected
Solution Approach 1:
The patent implements feedback by having the certificate issuance device compare the public key obtained from the IDP (after identity authentication) with the public key included in the certificate signing request submitted by the applicant. This feedback mechanism verifies whether the public key has been tampered with between the identity verification stage and the certificate issuance stage. If the public keys match, it confirms no tampering occurred; if they differ, the issuance is rejected. This feedback loop detects public key tampering while maintaining automated issuance, resolving the contradiction between process simplicity and security against tampering
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A certificate management method is provided, and is applied to a scenario in which a digital certificate is automatically issued. In the method, in a digital certificate application process, a trusted identity provider is introduced to authenticate a certificate application identity and obtain a public key corresponding to the certificate application identity, so as to compare whether the public key corresponding to the certificate application identity is the same as a public key in a certificate signing request, thereby ensuring consistency between the certificate application identity and the public key, preventing the public key from being tampered with in a phase of submitting the certificate signing request, avoiding a case in which identity information in an issued digital certificate does not match the public key, and improving security in a digital certificate issuance process.