Certificate Authentication via DID Without Private Key Sharing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In the current Internet environment, the private keys of X.509 certificates are often shared with content delivery networks (CDNs), violating the principle of safe key management and leading to issues with certificate validity verification and transparency in TLS handshakes.

Innovation Solution

A method and system that uses decentralized identifiers (DIDs) to manage authentication information independently of certificate authorities (CAs), allowing certificate subjects to autonomously manage their private keys and delegate authentication without exposing them, by inserting identifier information into certificates and verifying ownership through external storage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If private keys are shared with CDN for service delegation, then service provision capability is improved, but security of private key management deteriorates

Engineering Contradiction:

Improveservice provision capabilityVSAvoidsecurity of private key management

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces a public key as an intermediary that decouples the private key from the CDN. The origin server keeps its private key secure while sharing only the public key with the CDN, allowing service delegation without exposing sensitive authentication information. This mediator (public key) enables communication and authorization between the origin server and CDN without requiring private key exposure.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If private keys are kept secure without exposure, then security is improved, but ability to delegate authentication authority deteriorates

Engineering Contradiction:

ImprovesecurityVSAvoidability to delegate authentication authority

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent segments the authentication credentials into two separate components: private key (kept secure by origin server) and public key (shared with CDN for delegation). This segmentation allows the origin server to maintain security while still enabling authentication delegation through the public key, which can be freely distributed to authorized entities like CDN without compromising the private key.

Inventive Principle:

Principle #1Segmentation

3Ease of operation

If traditional PKI certificate structure is used with public keys, then certificate verification is simplified, but transparency and traceability of certificate usage deteriorates

Engineering Contradiction:

Improvecertificate verificationVSAvoidtransparency and traceability

Core Design Contradiction:

Ease of operationVSLoss of information

Solution Approach 1:

The patent embeds additional transparency information (origin server identifier, CDN identifier, issuance timestamp, expiration timestamp) within the certificate structure itself. This nested information allows verification systems to not only verify the cryptographic validity of the certificate but also trace its provenance, usage context, and temporal validity, enhancing transparency without complicating the basic verification process.

Inventive Principle:

Principle #7Nested doll (Nesting)

Data Source

PatentUS12513007B2Method of managing authentication information of certificate independently of certificate authority

Publication Date: 2025.12.30 ELECTRONICS & TELECOMM RES INST

AI summary

A method of managing authentication information of a certificate independently of a certificate authority (CA) is provided. The method includes issuing a certificate, into which identifier information instead of a public key is inserted, to an origin server by using the CA and reading an identifier document from an external storage by using user equipment on a basis of the identifier information received from the origin server and verifying the certificate with the public key included in the identifier document.