Client Certificate Pre-configuration for Automatic Server Failover

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In client-server systems, when a server's hardware security module fails, communication breakdown occurs, and users must intervene manually to switch to a backup server, posing security risks and operational inefficiencies.

Innovation Solution

A method where a client receives a main certificate and a reserve certificate from the first and second servers respectively, allowing it to automatically switch to the second server if the first server fails, ensuring continuous secure communication without user intervention.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a hardware security module is used to securely store private keys, then security is improved, but if the module fails, communication is completely interrupted requiring manual intervention

Engineering Contradiction:

ImprovesecurityVSAvoidmanual intervention required

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The client is pre-configured with multiple server certificates (primary and backup) before any failure occurs. When the primary server becomes unavailable, the client automatically switches to the backup server using the pre-stored certificate, eliminating the need for manual intervention and maintaining communication continuity.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system changes the operational parameter from single-server dependency to multi-server redundancy. By storing multiple certificates in the client and implementing automatic selection logic, the system transitions from a state requiring manual intervention to one with automatic failover capability.

Inventive Principle:

Principle #35Parameter changes

2Object-affected harmful factors

If manual intervention is required to switch servers after hardware security module failure, then security control is maintained, but operational efficiency deteriorates

Engineering Contradiction:

Improvesecurity controlVSAvoidoperational efficiency

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The client system performs self-service by automatically detecting server unavailability and switching to backup servers using pre-configured certificates. This automated process maintains security control while eliminating the need for manual intervention, thereby improving operational efficiency.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system implements a feedback mechanism where the client continuously monitors server availability. When the primary server is detected as unavailable, the system automatically triggers the failover process to a backup server, maintaining both security control and operational efficiency through closed-loop control.

Inventive Principle:

Principle #23Feedback

3Device complexity

If a single primary server is used, then system simplicity is maintained, but system reliability deteriorates when the server fails

Engineering Contradiction:

Improvesystem simplicityVSAvoidcommunication continuity

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The client is designed with multi-functionality to communicate with multiple servers (primary and backup) using different certificates. This universal design maintains relative system simplicity while significantly improving communication continuity through automatic failover capability.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system prepares backup certificates and server configurations in advance, creating a cushion against potential primary server failures. This prior preparation ensures that when failures occur, the system can seamlessly switch to backup servers without disruption to communication continuity.

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

Data Source

PatentEP3267619B1Method for producing fault prevention in a framework

Publication Date: 2019.05.22 MTG AG

Figure 1~2
Figure 3

AI summary

A method for establishing failover in a network comprising a client (1), a first server (2) and a second server (3), wherein the method comprises at least the following steps: a one-time transmission of a primary certificate (8) associated with the first server (2) and at least one reserve certificate (9) associated with the second server (3) to the client (1); the client (1) making a request to the first server (2), wherein, upon successful request by the client (1) to the first server (2), the first server (2) authenticates itself to the client (1) as the holder of the primary certificate (8); and, upon unsuccessful request by the first server (2), the client (1) makes a request to the second server (3), and the second server (3) authenticates itself to the client (1) as the holder of the reserve certificate (9).After successful authentication with the client (1), a secure connection is established between the client (1) and the first server (2) or the second server (3) for the transmission of user data by the first server (2) or the second server (3).