Authentication System Using CRL Version Inversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication systems for home electric appliances and controllers do not effectively guarantee the validity of devices connected to networks, leading to potential unauthorized access and information leakage, as they rely on outdated certificate revocation lists and lack robust validation mechanisms.
Innovation Solution
An authentication method that involves a device and a controller storing and comparing certificate revocation lists, where the server judges the controller as unauthorized if the age-identifying information in the device's list is older than the server's list, ensuring up-to-date validation and preventing unauthorized access by distributing updated certificate revocation lists through alternative controllers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional PKI authentication with CRL is used to guarantee device validity, then device authentication is provided, but the system cannot detect unauthorized controllers because devices rely on outdated CRL information from controllers
Solution Approach 1:
Instead of the device obtaining CRL information from the controller (traditional direction), the invention inverts the flow by having the device send its CRL information to the server, which then verifies it against the server's authoritative CRL. This inversion allows the server to detect unauthorized controllers by identifying discrepancies in CRL versions.
Solution Approach 2:
The server provides feedback to the device about whether the controller is authorized by comparing CRL versions. When the server detects that a controller is unauthorized (based on outdated CRL information), it notifies the device, enabling the device to disconnect from the unauthorized controller. This feedback mechanism closes the authentication loop.
2Ease of operation
If devices obtain CRL information from controllers, then authentication is simplified, but unauthorized controllers can distribute outdated CRL information undetected
Solution Approach 1:
The server acts as an intermediary that mediates between the device and controller authentication. Instead of the device directly trusting the controller's CRL information, the server verifies the controller's authorization by comparing CRL versions and provides authoritative verification to the device, maintaining authentication simplicity while adding reliability.
3Reliability
If the server stores and compares CRL versions, then unauthorized controllers can be detected, but additional communication overhead and processing time are required
Solution Approach 1:
The server performs partial verification by comparing only the CRL version information (age-identifying information) rather than verifying the entire CRL content. This partial action approach provides sufficient authorization verification while minimizing additional processing time and communication overhead.
Data Source
Figure 1
Figure 2
Figure 3~5
AI summary
In an authentication method according to the present disclosure, (1) a piece of device transmits device history information with a CRL added thereto (hereinafter, device history information with added CRL) to a controller, (2) the controller transmits the device history information with added CRL to a server, and (3) if the version of the CRL included in the device history information with added CRL is older than the version of the CRL stored on the server, the server judges that the controller is unauthorized.