Decentralized PKI Authentication Server Self-Signed Certificate
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure authentication systems face challenges in establishing trust between remote devices and relying parties, particularly in environments where network access is limited or unreliable, and there is a risk of device compromise or tampering, such as in mobile or NFC transactions.
Innovation Solution
The system employs a decentralized public key infrastructure using self-signed certificates to securely establish trust by signing authentication requests with a private key and transmitting them over a secure communication channel, ensuring the authenticity of the relying party and authentication client through cryptographic verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional trust mechanisms like X.509 certificates are used, then security and trust establishment are improved, but device complexity and overhead increase
Solution Approach 1:
The patent extracts the trust establishment process from the complex X.509 certificate infrastructure and implements a simplified alternative using self-signed certificates. The authentication server generates its own self-signed certificate containing its public key, eliminating the need for certificate authorities, certificate chains, and complex validation logic while maintaining security through cryptographic verification
Solution Approach 2:
The patent uses self-signed certificates that are self-contained and self-validating, replacing expensive and complex X.509 certificate infrastructure. The self-signed certificate serves as a complete trust anchor without requiring external validation infrastructure, reducing overhead and complexity
2Reliability
If secure communication channels are established using traditional protocols, then authentication security is improved, but network accessibility and flexibility are reduced
Solution Approach 1:
The patent segments the trust establishment process into two independent parts: (1) the authentication server's self-signed certificate that proves its identity, and (2) the cryptographic verification performed by the authentication client. This segmentation allows the system to work with simple certificate exchange over basic network connections without requiring complex protocol infrastructure
Solution Approach 2:
The authentication server performs self-validation through its self-signed certificate, which contains its own public key and signature. The authentication client independently verifies the certificate without needing external certificate authorities or complex protocol handshakes, enabling flexible network accessibility
3Reliability
If cryptographic verification is performed for each authentication request, then security against tampering is improved, but processing time increases
Solution Approach 1:
The authentication server generates its self-signed certificate in advance, containing its public key and digital signature. This preliminary preparation allows the authentication client to perform fast verification by simply checking the signature against the embedded public key, without needing to perform complex cryptographic operations during the actual authentication request processing
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A system, method and machine readable medium are described for establishing trust using secure communication protocols by generating a communication at an authentication server directed to a client device having authenticators; signing the first communication using a key of a self-signed certificate from a decentralized public key infrastructure (PKI); establishing a first channel with an app on the client device using a communication infrastructure; transmitting the first communication with the signature to the app over the first channel; establishing a second channel with an authentication client on the client device using a trusted secure communication infrastructure; transmitting a second key of the self-signed certificate from the decentralized PKI to the authentication client over the second channel; providing the first communication from the app to the authentication client; and the authentication client using the second key to validate the signature generated over the first authentication-related communication with the first key.