Distributed CA Nodes for Offline V2X PKI Certificate Issuance

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In vehicle-to-everything (V2X) networks, vehicles often face challenges in obtaining public key infrastructure (PKI) certificates when they are offline relative to the centralized certificate issuing entity, due to lack of access or network unavailability, which can lead to security vulnerabilities.

Innovation Solution

A peer-to-peer wireless communication network is established, where certificate authority nodes generate and transmit PKI certificates based on public key information received from applicant nodes, using a common generator matrix and random values to ensure secure issuance and encryption, even when the vehicle is offline.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a centralized certificate issuing entity is used to issue PKI certificates, then certificate issuance follows conventional protocols and maintains centralized control, but vehicles cannot obtain certificates when offline or when the centralized entity is unavailable

Engineering Contradiction:

Improvecertificate issuance reliabilityVSAvoidoffline certificate issuance capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The centralized certificate authority is segmented into multiple distributed CA nodes that can independently issue certificates. Each CA node maintains the ability to verify applicant identity and issue valid certificates autonomously, eliminating the single point of failure and enabling offline certificate issuance while maintaining security through distributed consensus mechanisms

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A distributed network of CA nodes acts as intermediaries that can issue certificates when the primary centralized authority is unavailable. These intermediary CAs are pre-configured with cryptographic materials and can operate autonomously to issue certificates during offline scenarios, then synchronize with the centralized authority when connected

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If PKI certificates are issued through a centralized entity requiring cellular network access, then network security and control are maintained, but communication breakdowns or network capacity issues prevent certificate issuance

Engineering Contradiction:

Improvecertificate issuance accessibilityVSAvoidcertificate availability

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

CA nodes perform preliminary configuration with cryptographic materials, validation rules, and issuance protocols before offline operation is needed. This pre-preparation enables them to immediately issue certificates when connected, without requiring real-time communication with the centralized authority, thus ensuring continuous availability

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system dynamically switches between centralized and decentralized operational modes. When the centralized authority is accessible, normal protocol is used; when unavailable, the system dynamically activates the distributed CA nodes to handle certificate issuance, adapting to network conditions in real-time

Inventive Principle:

Principle #15Dynamics

3Adaptability or versatility

If a peer-to-peer distributed network is used for certificate issuance, then offline certificate issuance is enabled and system availability improves, but network complexity and cryptographic operation complexity increase

Engineering Contradiction:

Improveoffline operation capabilityVSAvoidnetwork architecture complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

Each CA node in the distributed network is designed to perform multiple functions: validating applicant identity, generating cryptographic key pairs, issuing certificates, and synchronizing with other nodes. This multi-functionality reduces the need for specialized components and simplifies the overall network architecture despite the distributed nature

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Reliability

If distributed CA nodes use generator matrices and random values for certificate generation, then security against man-in-the-middle attacks is enhanced, but computational requirements and processing time increase

Engineering Contradiction:

Improvesecurity integrityVSAvoidcomputational power

Core Design Contradiction:

ReliabilityVSPower

Solution Approach 1:

The system uses partial cryptographic operations where CA nodes perform essential security-critical computations (key generation, signature creation) using generator matrices and random values, while relying on pre-computed cryptographic materials and cached validation data to reduce real-time computational burden, achieving adequate security without excessive processing requirements

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11576037B2Issuing offline PKI certificates in distributed V2X network

Publication Date: 2023.02.07 HUAWEI TECH CO LTD

AI summary

Method and system for issuing public key infrastructure (PKI) certificates in a peer-to-peer wireless communication network, comprising generating, at a first certificate authority (CA) node in the peer-to-peer communication network, a PKI certificate based on public key information received from an applicant node in the peer-to-peer wireless communication network; and transmitting the PKI certificate generated by the first CA node to the applicant node using the peer-to-peer wireless communication network.