Client Device CA Certificate Storage Segmentation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Client devices with limited storage capacity face cluttering issues due to an increasing number of Certification Authority (CA) certificate data when using multiple services, which affects their ability to efficiently verify server certificate data.

Innovation Solution

A client device system that includes a communication device, storage, and a controller, which separates CA certificate data into distinct storage areas for different servers, allowing for efficient verification and storage of CA certificate data, and retrieves missing CA certificate data from a relay device when needed, thereby managing storage effectively.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If the client device stores CA certificate data for multiple services, then the device can verify server certificate data for multiple services, but the storage area becomes cluttered and runs out of space

Engineering Contradiction:

Improveability to use multiple servicesVSAvoidstorage capacity

Core Design Contradiction:

Adaptability or versatilityVSQuantity of substance

Solution Approach 1:

The patent segments the verification process into two parts: (1) verification using pre-stored CA certificate data for commonly trusted services, and (2) verification using relay device-mediated certificate data for services with limited storage. This segmentation allows the client device to maintain versatility across multiple services while avoiding storage clutter by only storing essential CA certificates locally.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The relay device serves as an intermediary that provides CA certificate data to the client device on demand. Instead of storing all CA certificate data locally, the client device can retrieve necessary certificates through the relay device, which acts as a centralized storage and distribution point. This mediator approach resolves the contradiction by externalizing storage requirements.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Quantity of substance

If the client device retrieves CA certificate data from the relay device for each service, then storage capacity is preserved, but communication overhead and verification time increase

Engineering Contradiction:

Improvestorage capacityVSAvoidcertificate verification time

Core Design Contradiction:

Quantity of substanceVSLoss of time

Solution Approach 1:

The system performs preliminary action by pre-storing frequently used CA certificate data in the client device's storage area. For services with pre-stored certificates, verification can proceed immediately without relay device communication, thus avoiding time loss. The relay device is only contacted when necessary, minimizing communication overhead while preserving storage capacity.

Inventive Principle:

Principle #10Preliminary action

3Quantity of substance

If the client device stores minimal CA certificate data, then storage capacity is optimized, but the ability to verify certificates for new services is limited

Engineering Contradiction:

Improvestorage capacityVSAvoidability to verify new service certificates

Core Design Contradiction:

Quantity of substanceVSAdaptability or versatility

Solution Approach 1:

The relay device acts as a mediator that enables the client device to verify certificates for new services without storing them permanently. When a new service requires verification, the client device can temporarily obtain the necessary CA certificate data from the relay device, perform verification, and then discard the data. This approach optimizes storage while maintaining adaptability to new services.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system implements dynamic certificate management where the set of stored CA certificates changes based on service requirements. The client device maintains a core set of frequently used certificates in storage and dynamically retrieves additional certificates from the relay device when needed for specific services or new services, optimizing the balance between storage and versatility.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS9628470B2Client device, non-transitory storage medium storing instructions executable by the client device, and service performing system

Publication Date: 2017.04.18 BROTHER KOGYO KK

AI summary

A client device communicates with a server and a relay device and includes a controller and a storage. The controller is configured to: receive service use information from the relay device; use the received service use information to transmit connection request information to the server; receive the server certificate data which is transmitted from the server as a response to the connection request information; determine whether certificate-authority certificate data for verification of server certificate data is stored in the storage; when the certificate-authority certificate data is stored in the storage, verify the server certificate data using the certificate-authority certificate data; when the certificate-authority certificate data is not stored in the storage, receive the certificate-authority certificate data from the relay device; verify the server certificate data using the received certificate-authority certificate data; and store the received certificate-authority certificate data into the storage.