Digital Identity Verification via Cryptographic Signature Chains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Public Key Infrastructure (PKI) approaches for ensuring digital identity legitimacy rely on trusted Certificate Authorities, which introduce risks, costs, and complexities, and are challenging to manage when keys or certificates are compromised, often requiring widespread certificate revocation.
Innovation Solution
A system that generates digital identifiers with independently verifiable public keys, sequence numbers, and signatures, allowing for cryptographic proof of identity and recovery without relying on a central authority, using a chain of digital identifiers to maintain legitimacy and security through micro-ledgers and cryptographic traceability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a trusted certificate authority (CA) is used to attest to the legitimacy of a certificate and public key, then the legitimacy of digital identity is ensured, but the system introduces risks, costs, and complexities associated with central authority management
Solution Approach 1:
The patent extracts the trust verification function from a central CA and embeds it directly into the certificate structure through cryptographic signatures. Each certificate contains its own verification mechanism (public key and signature) that can be independently validated without requiring ongoing interaction with a central authority, thus eliminating the management complexity of CAs while maintaining reliability
Solution Approach 2:
The certificate structure enables self-verification where the certificate itself contains all necessary information (public key, signature, sequence number) to prove its legitimacy. The system serves its own verification needs through cryptographic proof embedded in the certificate, eliminating dependence on external CAs and their associated complexities
2Reliability
If a public key infrastructure (PKI) implementation is used to ensure digital identity legitimacy, then trustworthiness is established, but discovery of compromised keys or certificates is difficult and requires widespread certificate revocation
Solution Approach 1:
The patent incorporates a sequence number in each certificate that preliminarily establishes a chronological order of certificate issuance. This allows the system to pre-establish a verification mechanism where the most recent certificate in the sequence automatically supersedes previous ones, enabling quick detection and response to compromised keys without difficult discovery processes
Solution Approach 2:
The cryptographic signature chain creates a feedback mechanism where each certificate's validity can be verified against its predecessor in the sequence. If a compromised key is detected, the feedback through the signature verification process immediately identifies the point of compromise in the sequence, enabling targeted revocation rather than widespread certificate updates
3Reliability
If certificate revocation is performed to respond to compromised keys, then security is maintained, but the process requires updating widespread intermediate certificates which is complex and time-consuming
Solution Approach 1:
The patent segments the certificate validation process into independent, localized verification steps using cryptographic signatures and sequence numbers. Each certificate can be validated independently against its immediate predecessor in the sequence, allowing revocation to be handled at the specific point of compromise rather than requiring system-wide updates of all intermediate certificates
Solution Approach 2:
The sequence number mechanism creates a dynamic certificate structure where validity is determined by the most recent entry in the sequence. This dynamic approach allows the system to automatically respond to compromised keys by simply issuing a new certificate with a higher sequence number, eliminating the static, time-consuming process of updating widespread intermediate certificates
Data Source
AI summary
In one embodiment, a device identifies, for an existing digital identifier, a public key, a sequence number, and a signature. The device forms a new digital identifier that includes the public key, the sequence number, and the signature identified by the device for the existing digital identifier. The device signs the new digital identifier with a new signature using a private key. The device uses the new digital identifier to prove legitimacy of data associated with the new digital identifier.