Digital Certificate Issuance via Multiple Independent Verifications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional digital certificate issuance systems are vulnerable to hacking, allowing hackers to generate counterfeit certificates, which can compromise the security of web transactions by posing as legitimate websites.
Innovation Solution
Implementing multiple independent verifications of an entity's identity through the use of a notary or multiple Certificate Authorities (CAs) to generate and sign certificates, ensuring that the identity claim is validated independently before a certificate is issued, and utilizing contact information stored with the web site to prevent fraudulent changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single Certificate Authority (CA) is used to issue digital certificates, then the certificate issuance process is simple and efficient, but the system becomes vulnerable to hacking and counterfeit certificate generation
Solution Approach 1:
The patent divides the single CA verification system into multiple independent CAs, each performing separate verification. Instead of one centralized point of failure, the system now has multiple distributed verification points, where each CA independently validates the certificate signing request before issuance.
Solution Approach 2:
The patent introduces an intermediary notary entity that acts as a mediator between the certificate applicant and the CAs. This notary performs preliminary verification and forwards requests to multiple CAs, adding an intermediate layer of security that prevents direct hacking of the CA system while maintaining structured verification flow.
2Reliability
If multiple independent verifications are implemented through notaries and multiple CAs, then the security against counterfeit certificates is enhanced, but the certificate issuance process becomes more complex
Solution Approach 1:
The notary performs preliminary verification actions before the certificate is issued by the CAs. This includes validating the applicant's identity and forwarding the request to multiple CAs in advance, so that when certificates are issued, the verification work has already been completed, reducing the operational burden during the actual issuance process.
Solution Approach 2:
The patent combines multiple verification functions into a unified notary entity that coordinates with multiple CAs. Instead of having separate complex processes for each CA verification, the notary merges these into a single coordinated workflow that manages multiple verifications systematically.
3Reliability
If contact information stored with the web site is used for verification, then fraudulent changes by hackers are prevented, but additional verification steps increase processing time
Solution Approach 1:
Contact information is stored and verified in advance during the initial registration process. When certificate issuance is requested, this pre-stored information is immediately used for verification without requiring additional real-time validation steps, thus preventing fraud while minimizing time loss.
Solution Approach 2:
The system implements feedback loops where verification results from one CA or notary are immediately communicated to other verifiers. This allows parallel verification processes to be coordinated efficiently, reducing total verification time while maintaining comprehensive security checks on contact information.
Data Source
AI summary
A method includes (a) receiving, at a computing device, a first certificate signing request (1CSR) from a certificate authority (CA), the 1CSR including an embedded second certificate signing request (2CSR), the 2CSR having been received by the CA from an entity seeking a signed certificate from the CA that validates an identity claim made by the entity in the 2CSR, the CA having performed a preliminary verification of the 2CSR prior to embedding it in the 1CSR, (b) verifying that the 1CSR came from the CA, (c) performing a verification procedure on the embedded 2CSR independent of the preliminary verification performed by the CA, to validate the identity claim made by the entity in the 2CSR, and (d) upon successfully validating the identity claim made by the entity in the 2CSR, sending a certificate to the CA, the certificate validating the identity claim made by the entity in the 2CSR.