Distributed Crypto Module White List Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for managing user enrollment in distributed security systems are either cumbersome, requiring manual account creation and removal on each node, or inefficient, relying on computational overhead from certification agents and blacklists for access control.
Innovation Solution
A system and method for automatically expanding and managing white lists among nodes, allowing trusted public keys to be shared and updated without human interaction, enabling seamless node enrollment and revocation with minimal impact on data processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual account creation and removal is performed on each node, then security control is maintained, but operational complexity and time consumption increase significantly
Solution Approach 1:
A centralized enrollment service acts as an intermediary between nodes and users. The service maintains a centralized whitelist and coordinates with array members to add or remove accounts automatically, eliminating manual intervention on each node while maintaining security control through centralized authorization.
Solution Approach 2:
The patent combines multiple account management operations (verification, whitelist updating, notification to array members) into a single centralized enrollment service. This consolidation reduces the time required for account management while maintaining security through coordinated control.
2Reliability
If certification agents and blacklists are used for access control, then security is maintained, but computational overhead increases
Solution Approach 1:
The patent extracts the complex certification agent and blacklist mechanisms from the access control process and replaces them with a simpler whitelist-based system. The enrollment service maintains a positive list of authorized public keys, eliminating the need for computational certificate validation and blacklist checking at each access point.
Solution Approach 2:
Instead of using complex cryptographic certification structures, the patent uses simplified public key copies stored in a whitelist. Each node stores copies of authorized public keys and uses direct comparison for authentication, reducing computational overhead while maintaining security.
3Measurement precision
If white lists are manually updated on each node, then security accuracy is maintained, but operational complexity increases
Solution Approach 1:
The centralized enrollment service acts as an intermediary that maintains the master whitelist and automatically distributes updates to all array members. This eliminates manual whitelist updates on each node while maintaining accuracy through centralized control and automatic propagation of changes.
Solution Approach 2:
The enrollment service performs preliminary verification and whitelist updates before notifying array members. By preparing the whitelist changes centrally and then distributing them automatically, the system maintains accuracy while reducing operational complexity compared to manual updates on each node.
Data Source
AI summary
An apparatus and method for managing the distribution and expansion of public keys held by a group or array of systems in white lists. The addition of a new system to the array entails a manual input to authorize the introduction of the new system to one trusted system in the array. After the introduction the new system is trusted by the one member and the white list of the one member is loaded into the white list of the new system. The new system then requests joining each of the other systems in the array. For each system in the array asked by the new system, the systems in the array ask if any other systems in the array already trust the new member. In response, a system of the array that trusts the new system responds by sending its white list (containing the public key of the new system) to the requesting system. Eventually the public key of the new system is in the white lists of all the systems in the array. In practice this trusts expansion occurs in the background with respect to running applications.