Distributed Credential Encryption for Low-Latency Service Validation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Distributed computing systems face challenges in providing secure services to a large number of geographically dispersed clients, leading to increased messaging, network latency, and the need for secure storage of service instances, particularly in transaction systems where transactions must be authorized over short timeframes and data must be reliably stored for extended periods.

Innovation Solution

A method involving generating a credential, creating a checksum, encrypting service-related information, and sending a message with both encrypted and unencrypted parts to ensure data integrity and security, using block ciphers and keyed-hash algorithms, with flexible key management to allow decryption across multiple nodes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a centralized system is used to provide services to a large number of geographically distributed clients, then service security and control are improved, but network latency and system bottleneck increase

Engineering Contradiction:

Improveservice securityVSAvoidnetwork latency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent divides the centralized system into multiple distributed validation nodes that can independently validate credentials. This segmentation allows clients to connect to nearby nodes, reducing network latency while maintaining security through distributed validation capability across the network

Inventive Principle:

Principle #1Segmentation

2Loss of time

If services are distributed across multiple geographically distributed servers, then network latency is reduced, but system complexity and messaging overhead increase

Engineering Contradiction:

Improvenetwork latencyVSAvoidsystem complexity

Core Design Contradiction:

Loss of timeVSDevice complexity

Solution Approach 1:

The patent implements preliminary credential validation at the time of credential generation. The credential contains pre-computed validation data that allows any node to validate it without requiring real-time communication with the issuing node, eliminating ongoing messaging overhead and simplifying the distributed system operation

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent creates self-contained credential copies that can be validated independently at any node. Each credential contains all necessary validation information, allowing nodes to validate credentials locally without needing to contact the issuing node, thereby reducing system complexity and messaging requirements

Inventive Principle:

Principle #26Copying

3Adaptability or versatility

If credentials are validated over extended periods, then service flexibility is improved, but security risks increase

Engineering Contradiction:

Improveservice flexibilityVSAvoidsecurity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent implements dynamic credential validation where the validity period and validation requirements can be configured per credential. Credentials can be set with specific time limits, usage counts, or condition-based validity, allowing the system to adapt security parameters to specific service requirements while maintaining security through cryptographic validation

Inventive Principle:

Principle #15Dynamics

4Reliability

If secure storage of service instance records is maintained for exceptionally large numbers of instances, then data reliability is improved, but system resources and storage demands increase

Engineering Contradiction:

Improvedata reliabilityVSAvoidsystem resources

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent extracts the validation capability from centralized storage requirements. By embedding all necessary validation information within the credential itself, the system eliminates the need to store and retrieve service instance records from centralized databases, dramatically reducing storage demands while maintaining data reliability through self-contained credential validation

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS12537665B2Data management and encryption in a distributed computing system based on a service request

Publication Date: 2026.01.27 MASTERCARD INT INC

AI summary

A method of providing a secure service at a computing node for a requesting party external to the computing node is described. The following steps are taken at the computing node. A service request comprising a request to generate a credential is received from a requesting party. The computing node generates the credential and obtains service-related information. A clear message part is created comprising service-identifying information. A checksum is then created from at least a part of the service-identifying information and from at least a part of the credential and the service-related information. The credential, the service-related information and the checksum are then encrypted to form an encrypted message part. A message comprising the clear message part and the encrypted message part is then sent to the requesting party. Methods for providing secure services to validate the credential and to obtain the service-related information are also described, as is computing apparatus adapted to perform all these methods.