Certificate Authentication Using Positive List Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital certificate authentication methods in automation systems lack clarity on whether validation is based on a white list, leading to potential security vulnerabilities as devices may be authorized without thorough verification.
Innovation Solution
Incorporating admissibility information into the message that includes signature verification and white list determination, ensuring both checks are conducted and communicated, with additional parameters like issuer, age, and application environment to restrict whitelist usage, thereby enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If digital certificate authentication is performed without white list checking, then authentication speed is improved, but security is worsened
Solution Approach 1:
The white list is pre-generated and stored before authentication occurs. The authenticating unit retrieves the appropriate white list from storage and performs checking as part of the standard authentication flow, eliminating the need for real-time external reference checks while maintaining security.
Solution Approach 2:
The patent introduces an intermediary structure where the white list acts as a mediator between the certificate and the authentication decision. The white list contains pre-processed allowed certificates or characteristics, enabling efficient comparison without requiring complex real-time validation logic.
2Reliability
If white list checking is performed for every certificate, then security is improved, but authentication complexity is worsened
Solution Approach 1:
The authentication process is segmented into distinct phases: certificate retrieval, white list selection based on device context, and verification. This segmentation allows each component to be optimized independently and makes the overall process more manageable and maintainable.
Solution Approach 2:
The system changes the parameter of white list selection based on device context, such as device type, location, or application requirements. Different white lists or white list subsets are applied depending on the specific authentication scenario, simplifying the verification process for each context rather than using a single complex universal check.
3Reliability
If admissibility information is added to messages, then authorization security is improved, but message size is worsened
Solution Approach 1:
The white list data is extracted and stored separately from the authentication messages. Only references or summaries of the white list (such as identifiers or hashes) are included in messages, while the full white list content is stored externally and accessed as needed during authentication.
Solution Approach 2:
The admissibility information is nested within the message structure in a compact format, with the white list references contained within the admissibility field. This nested structure allows efficient storage and transmission while maintaining the necessary security information.
Data Source
Figure 1~3
Figure 4
Figure 5
AI summary
The invention relates to methods and apparatuses for using certificates (ZERT) using a positive list (WL). This involves a message (VMSG), wherein the message (VMSG) comprises a certificate (ZERT) for a device (G), the certificate (ZERT) has a signature (SIG) for checking (PROOF1) an authenticity of the certificate (ZERT) and a piece of admissibility information (ZINFO) for ascertaining (PROOF2) an admissibility of the certificate (ZERT) using a positive list (WL), being taken as a basis for carrying out authorisation for the device (G) subject to the check and the ascertainment. The invention can be used in industrial or medical environments.