Multi-party Digital Signature Key Validity Overlap
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital signature techniques fail to provide high-level assurance of data trustworthiness on mobile devices, especially in isolated environments without real-time access to certificate revocation information, and do not effectively account for multiple authorities or improper authority actions.
Innovation Solution
A method for multiple party digital signatures that establishes overlapping or disjoint validity ranges for keys, allowing certificates to be signed and verified only if the ranges overlap, ensuring that multiple parties independently verify data blocks and regenerate keys to prevent compromise, thereby maintaining trustworthiness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a single private key is used to sign data blocks, then the signing process is simple and efficient, but the system becomes vulnerable to compromise and lacks robustness
Solution Approach 1:
The patent divides the signing function into multiple independent key pairs, where each key pair can independently sign data blocks. This segmentation allows the system to maintain high signing efficiency through parallel operations while improving security robustness, as compromise of one key does not affect the others.
Solution Approach 2:
The patent assigns different validity ranges to different key pairs, allowing each key to have specialized characteristics suited to specific time periods or conditions. This enables the system to optimize for both efficiency (by using appropriate keys for specific tasks) and reliability (by limiting the impact of any single key compromise).
2Reliability
If certificate revocation information is accessed in real-time, then the system can respond to key compromises, but isolated environments without network access cannot verify revocation status
Solution Approach 1:
The patent establishes validity ranges for keys in advance, before any compromise occurs. These pre-defined ranges allow the system to operate in isolated environments without real-time revocation checks, while still providing compromise response capability through the structured key management system that tracks validity periods.
Solution Approach 2:
The patent implements a dynamic key management system where keys have time-bound validity ranges. This allows the system to adapt to different operational contexts (connected or isolated environments) by using keys appropriate to the current time period, maintaining both security response capability and operational flexibility.
3Duration of action of stationary object
If multiple key pairs with overlapping validity ranges are used, then the system provides continuous signing capability, but key management complexity increases
Solution Approach 1:
The patent segments the key management into distinct key pairs with clearly defined validity ranges. This segmentation enables continuous signing capability across different time periods while managing complexity through structured organization of keys, where each key's responsibility is clearly bounded by its validity range.
Solution Approach 2:
The patent implements periodic key usage patterns where keys are activated and deactivated based on their validity ranges. This periodic action ensures continuous signing capability as keys transition in and out of validity periods, while the systematic nature of these transitions helps manage key management complexity through predictable patterns.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments describe a system and/or method for multiple party digital signatures. According to a first aspect a method comprises establishing a first validity range for a first key, establishing a first validity range for at least a second key, and determining if the validity range of the first key overlaps the first validity range of the at least a second key. A certificate is signed with the first validity range of the first key and the first validity range of the at least a second key if the validity ranges overlap. According to another embodiment, signage of the certificate is refused if the first validity range of the first key does not overlap with the first validity range of the at least a second key.