Distributed Credential Encryption for Low-Latency Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed computing systems face challenges in providing secure services to a large number of geographically dispersed clients, leading to increased network latency, messaging bottlenecks, and the need for secure storage of service instances, particularly in transaction systems where transactions must be authorized over short timeframes and maintained securely.
Innovation Solution
A method involving encryption and decryption processes using block ciphers and cryptographic algorithms like SM4 and SM3, with key validity periods tailored for different processes, ensures secure service provision by distributing credential generation and validation across geographically distributed nodes, reducing network latency and minimizing resource demand.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a centralized system is used to provide services to a large number of geographically distributed clients, then service provision is simplified, but network latency increases and messaging bottlenecks occur
Solution Approach 1:
The patent divides the centralized credential management system into multiple distributed credential management nodes. Each node can independently generate and validate credentials, eliminating the single-point bottleneck. The service is segmented across geographically distributed nodes, allowing clients to access nearby nodes and reducing network latency while maintaining service simplicity through standardized interfaces.
2Loss of time
If services are distributed across multiple nodes, then network latency is reduced, but new bottlenecks appear and messaging quantity increases
Solution Approach 1:
The patent implements universal credential management nodes that can perform multiple functions: generating credentials, validating credentials, and managing key pairs. Each node is designed to handle diverse service requests through standardized protocols, reducing the need for specialized components and minimizing system complexity despite distribution across multiple nodes.
Solution Approach 2:
The patent changes the operational parameters of credential management by introducing asymmetric cryptography with different validity periods for private keys and public keys. Private keys have shorter validity periods for enhanced security, while public keys have longer validity periods to reduce messaging frequency. This parameter differentiation optimizes both security and system efficiency.
3Reliability
If credential data is stored securely for long periods, then data security is maintained, but resource demand increases
Solution Approach 1:
The patent implements periodic key rotation where credential keys are renewed at specified intervals. Private keys have shorter validity periods and are rotated more frequently, while public keys have longer validity periods. This periodic action maintains data security over long periods without requiring continuous storage of all historical credential data, thereby reducing resource demand.
Solution Approach 2:
The patent allows for the secure discarding of expired credential data while maintaining the ability to recover or regenerate credentials when needed. Expired private keys are discarded to reduce storage resources, while the system maintains the capability to issue new credentials through the distributed nodes, balancing security requirements with resource efficiency.
Data Source
AI summary
A method of providing a secure service at a computing node is described. The secure service is for a requesting party external to the computing node. The following steps take place at the computing node. A service request is received from the requesting party. This service request comprises a request to generate a credential. The credential is then generated, and service-related information is obtained. The credential and the service-related information are encrypted using an encryption process to form an encrypted message part. A service-identifying clear message part is also created, and a message is sent comprising the clear message part and the encrypted message part to the requesting party. Methods of using such a message to validate the credential, and of using such a message to confirm the integrity of service-related information held in the message, are also described, as is computing apparatus adapted to carry out one or more of these methods.