Distributed Certificate Validation for Secure HTTPS Connections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current TLS/SSL protocols rely on a single Certificate Authority (CA) for trust, making them vulnerable to security lapses due to potential CA compromises or misuse, leading to unreliable secure connections.
Innovation Solution
Implementing a distributed certificate validation model that uses multiple Certificate Validator Organizations (CVOs) to validate certificates, allowing domain owners to set assurance levels and requiring multiple valid certifications for secure connections, thereby reducing reliance on a single CA.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single Certificate Authority (CA) is used for trust verification, then the connection establishment process is simple and fast, but the system becomes vulnerable to security lapses due to potential CA compromises or misuse
Solution Approach 1:
The patent divides the single CA trust model into multiple independent Certificate Validator Organizations (CVOs). Each CVO independently validates certificates, and a certificate must be validated by a threshold number of CVOs to establish trust. This segmentation eliminates the single point of failure while maintaining a manageable validation process through modular, independent validators.
Solution Approach 2:
The patent introduces Certificate Validator Organizations (CVOs) as intermediary entities between the certificate authority and the client. These CVOs act as mediators that independently verify certificate validity and provide an additional layer of trust verification, preventing direct reliance on a single CA while maintaining a structured validation process.
2Reliability
If multiple Certificate Validator Organizations (CVOs) are used to validate certificates, then security assurance is enhanced through distributed validation, but the connection establishment process becomes more complex and time-consuming
Solution Approach 1:
The patent implements a threshold-based validation system where a certificate must be validated by a specific number of CVOs (e.g., 2 out of 3) rather than requiring all CVOs to validate it. This partial action approach provides sufficient security assurance without requiring complete validation from every validator, thereby reducing the time penalty while maintaining robust security.
Solution Approach 2:
The patent performs certificate validation by multiple CVOs during the TLS handshake process itself, integrating the validation into the existing connection establishment flow. By performing validation preliminarily during the handshake rather than as a separate post-handshake step, the system minimizes additional time overhead while ensuring security verification occurs before secure communication begins.
3Reliability
If a distributed certificate validation model is implemented, then reliance on a single point of failure is reduced, but the system requires coordination among multiple validators increasing operational complexity
Solution Approach 1:
The patent designs Certificate Validator Organizations (CVOs) with universal validation capabilities that can verify certificates from multiple CAs using the same validation logic and threshold rules. This multi-functionality allows any CVO to independently perform the complete validation process, eliminating the need for specialized coordination mechanisms and simplifying operational management while maintaining distributed trust.
Data Source
AI summary
Systems and methods for establishing a secure connection between a client computing device and a server hosted website. The method includes requesting an HTTPS connection with a server hosted website. The method further includes receiving a certificate from the server hosted website. The certificate is signed by a certificate authority and certificate validators. The method also includes delivering the certificate to each of the certificate validators. The method further includes receiving a certificate status for each of the certificate validators. Each certificate status indicates whether the certificate is valid or has been revoked. The method also includes determining a quantity of valid certificate statuses received from the certificate validators. The method further includes establishing the HTTPS connection with the server hosted website in response to determining that the quantity of valid certificate statuses meets or exceeds an assurance quantity threshold or a Transmission Layer Security Level of Assurance (“TLS-LoA”).