Cryptographic Bridge for Centralized PKI Key Management

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional PKI architectures require maintaining digital certificates at various enterprise levels, exposing enterprises to operational risk and necessitating frequent certificate updates and reprovisioning, which complicates management and security.

Innovation Solution

A secure microservice interface layer that manages cryptographic keys centrally, eliminating local storage of digital certificates and public/private keys at the application level, and automates periodic certificate updates through a custom interface layer.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If digital certificates are maintained at various enterprise levels, then applications can perform digital signature and decryption operations, but the enterprise is exposed to ongoing operational risk and requires frequent certificate updates and reprovisioning

Engineering Contradiction:

Improvecertificate managementVSAvoidoperational risk

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

A centralized certificate management service is introduced as an intermediary between applications and the certificate authority. This service handles all certificate operations (issuance, renewal, revocation) centrally, eliminating the need for applications to maintain certificates locally and reducing operational risk while simplifying management.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The certificate management functionality is extracted from individual applications and consolidated into a centralized service. Applications no longer store or manage their own certificates but instead obtain them on-demand from the centralized service, eliminating local certificate storage and associated risks.

Inventive Principle:

Principle #2Taking out (Extraction)

2Adaptability or versatility

If applications maintain local digital certificates and public keys, then they can independently perform cryptographic operations, but the system complexity increases and security is compromised

Engineering Contradiction:

Improveindependent operationVSAvoidsystem complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The centralized certificate management service automatically handles all certificate-related operations including issuance, storage, renewal, and revocation. Applications simply make requests to the service and receive the necessary certificates without managing them locally, reducing system complexity while maintaining operational independence.

Inventive Principle:

Principle #25Self-service

3Reliability

If certificates are updated periodically, then security is maintained, but applications must reprovision the authorization server with new public keys

Engineering Contradiction:

ImprovesecurityVSAvoidmanagement efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The centralized certificate management service continuously monitors certificate status and automatically handles renewals. When a certificate expires or needs renewal, the service proactively manages the process and notifies relevant systems, eliminating manual intervention and maintaining security without reducing productivity.

Inventive Principle:

Principle #23Feedback

4Ease of operation

If applications store private keys locally, then they can perform digital signatures, but security is exposed to potential breaches and operational risks

Engineering Contradiction:

Improvedigital signature capabilityVSAvoidsecurity exposure

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The centralized certificate management service acts as a secure intermediary that issues and manages private keys. Applications receive encrypted private keys from the service rather than storing them locally, reducing security exposure while maintaining the ability to perform digital signatures.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

Private keys are encrypted before being provided to applications, and the encryption keys are managed securely by the centralized service. This beforehand protection cushioning ensures that even if applications lose access to their private keys, the encrypted versions cannot be compromised, maintaining security while enabling operational capability.

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

Data Source

PatentUS12425194B2Cryptographic bridge for securing public key infrastructure (PKI)

Publication Date: 2025.09.23 BANK OF AMERICA CORP

AI summary

Systems, methods, and apparatus are provided for customizing PKI with a secure interface layer that limits digital certificate access. The secure microservice interface may receive a call from an authorized application for digital signature of an identification token. An API may obtain an application-specific private key from a digital certificate management system and encrypt the private key for the application. The secure microservice interface may receive a call from a central server for decryption of the digitally signed identification token. An API may obtain an application-specific public key from the digital certificate management system and convert the public key to a format compatible with the identification token for the central server. The secure microservice interface may renew the digital certificate with the relevant certification authority on a periodic basis.