Digital Identity Authentication via Intermediary Validation Database
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital identity authentication methods, particularly those using Public Key Infrastructure (PKI), are vulnerable to man-in-the-middle attacks and certificate substitution, leading to authentication gaps that can compromise secure communication channels.
Innovation Solution
A mechanism that authenticates digital identities by associating them with multiple identities and context information in dynamic databases, allowing for validation across different systems and contexts, and enabling the invalidation of previously authenticated identities when inconsistencies are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PKI certificates are used for digital identity authentication, then authentication can be established, but the system becomes vulnerable to man-in-the-middle attacks and certificate substitution
Solution Approach 1:
The patent introduces a certificate validation mechanism that acts as an intermediary between the PKI certificate and the authentication process. This validator checks whether the certificate is currently valid by consulting a validation database, preventing attackers from using substituted certificates even if they pass basic PKI verification. The intermediary layer adds a security checkpoint that blocks man-in-the-middle attacks without disrupting legitimate authentication.
Solution Approach 2:
The system performs preliminary validation of certificates before allowing authentication to proceed. The validation database pre-stores information about valid certificates and their status, enabling the validator to quickly determine whether a presented certificate is authentic and currently valid. This preliminary check prevents compromised or substituted certificates from being accepted, addressing the vulnerability to certificate substitution attacks.
2Reliability
If additional authentication vectors are added to close the authentication gap, then security is improved, but system complexity increases
Solution Approach 1:
The patent segments the authentication process into distinct components: the original PKI verification step and the new certificate validation step. The validation mechanism is separated into a standalone validator component that queries a separate validation database. This segmentation allows the additional security check to be added without fundamentally restructuring the existing PKI authentication flow, managing complexity by creating modular, independent validation logic.
Solution Approach 2:
The certificate validator serves as an intermediary component that bridges the PKI authentication system and the security validation requirements. Rather than embedding validation logic throughout the authentication system, the intermediary validator集中izes the additional security checks in a single, manageable component. This reduces overall system complexity by creating a clear separation between authentication functionality and validation functionality.
Data Source
AI summary
In a preferred embodiment of the invention, an authenticating device (22) receives a first digital identity (43) and a second digital identity (63). The authenticating device (22) uses the second digital identity (63) as a key to a Identity Association Database (24) to retrieve a database entry (33). If the database entry (33) shows an association between the first digital identity (43) and the second digital identity (63), the digital identities are valid and an indication (72) of the validation of existence of association between first digital identity and second digital identity (96) is made by the authenticating device (22).