Digital Certificates With Embedded Signed Claims for Node Trust

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Certificates in massively distributed systems can become out of synchronization due to varying propagation speeds, leading to security vulnerabilities and trust issues as they flow through untrusted intermediaries.

Innovation Solution

Embedding signed security claims in digital certificates at their source, ensuring verification and synchronization across nodes, thereby maintaining trust from user to remote site.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If certificates are distributed throughout a massively distributed system, then communication coverage is improved, but synchronization between nodes deteriorates due to varying propagation speeds

Engineering Contradiction:
Improvecommunication coverageVSAvoidsynchronization between nodes
Core Design Contradiction:
Adaptability or versatilityVSStability of the object's composition

Solution Approach 1:

The patent applies preliminary action by embedding signed claims directly into the certificate at the point of issuance. This pre-configuration ensures that all nodes receive the same authenticated claims simultaneously with the certificate, eliminating subsequent synchronization issues. The claims are digitally signed by the certificate authority before distribution, so verification can occur immediately without requiring real-time updates or coordination between nodes.

Inventive Principle:
Principle #10Preliminary action

2Adaptability or versatility

If certificates flow through untrusted intermediaries, then distribution flexibility is improved, but security deteriorates due to potential vulnerabilities

Engineering Contradiction:
Improvedistribution flexibilityVSAvoidsecurity
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The patent applies preliminary anti-action by digitally signing the claims with the certificate authority's private key before the certificate leaves the issuing system. This pre-established cryptographic protection prevents any intermediary from modifying the claims, as any alteration would invalidate the digital signature. The verification process using the certificate authority's public key provides immediate authentication, blocking potential security threats before they can affect the system.

Inventive Principle:
Principle #9Preliminary anti-action

3Adaptability or versatility

If claims are updated in a distributed system, then adaptability is improved, but synchronization deterioration occurs as different nodes receive updates at different speeds

Engineering Contradiction:
Improveclaims update capabilityVSAvoidsynchronization delay
Core Design Contradiction:
Adaptability or versatilityVSLoss of time

Solution Approach 1:

The patent eliminates synchronization delays by embedding the claims directly into the certificate structure at issuance. When claims need to be updated, a new certificate with the updated claims is issued, and nodes simply replace the old certificate with the new one. This approach avoids the complexity of incremental updates and ensures all nodes have identical claims simultaneously, as the entire claim set travels with the certificate in a single atomic operation.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentUS20260019414A1Dynamic attachment of secure properties to machine identity with digital certificates
Publication Date: 2026.01.15 MICROSOFT TECHNOLOGY LICENSING LLC
  • US20260019414A1 patent drawing
  • US20260019414A1 patent drawing
  • US20260019414A1 patent drawing

AI summary

Technology is shown for dynamically attaching secure properties to an identity certificate. Claims determining secure properties for an identity are signed and embedded in an identity certificate. Both the identity certificate and the signed claims in the certificate are verified. When a service request is received from the identity, the signed claims from the identity certificate are checked to determine if the request is permitted. If the request is permitted, then the service request is processed. Some examples involve creating claims determining the secure properties for the remote machine, signing the claims to create the signed claims, distributing the signed claims to a certificate authority, embedding the signed claims in the remote machine identity certificate, and distributing the remote machine identity certificate. The claims can be embedded in the certificate as X.509 properties.