Client-Side Encryption Key Recertification for Transaction Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing process of invalidating and issuing new encryption keys by a certificate authority leads to desynchronization, allowing unauthorized transactions during the delay period, and querying the authority for each transaction is impractical for servers, potentially violating user privacy.
Innovation Solution
A security tool on a user's device intercepts transaction requests, re-certifies the private encryption key with the certificate authority, and generates messages indicating key validity, ensuring servers only process transactions with validated keys, thus reducing desynchronization and maintaining user privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If servers query the certificate authority for each transaction to validate encryption keys, then security against fraud is improved, but server overload occurs and user privacy is violated
Solution Approach 1:
The client device performs key validity verification with the certificate authority before sending the transaction request to the server. This preliminary action ensures that the encryption key is valid prior to the server needing to process the transaction, eliminating the need for the server to query the certificate authority for each transaction.
Solution Approach 2:
The client device acts as an intermediary between the user and the server for key validation purposes. Instead of the server directly querying the certificate authority, the client device handles the verification process and uses the validity information in its response to the server, thereby preventing server overload and preserving user privacy.
2Device complexity
If the certificate authority does not publish or push updates to key status, then system complexity is reduced, but desynchronization occurs allowing unauthorized transactions
Solution Approach 1:
The client device performs a recertification request with the certificate authority before each transaction to obtain current validity information. This preliminary verification ensures that the server and client are synchronized regarding key validity without requiring the certificate authority to actively push updates or publish status changes.
Solution Approach 2:
The client device receives feedback from the certificate authority regarding the validity of the encryption key through the recertification process. This feedback mechanism ensures that the client is informed of any key status changes, allowing it to prevent unauthorized transactions while maintaining system simplicity.
Data Source
AI summary
An apparatus includes a memory and a hardware processor. The memory stores a private encryption key. The processor intercepts a first transaction request from a user, communicates a first recertification request to a certificate authority that issued the private encryption key, and receives, from the certificate authority, a first message indicating that the private encryption key is valid for use. In response to the first message, the processor generates a first digital signature using the private encryption key, generates a first non-repudiation message comprising the first digital signature and the first message, generates a second message comprising the first transaction request and the first non-repudiation message, and communicates the second message to a server to process the first transaction request.