Distributed Hash Table Implicit Certificate Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing public key infrastructure in the Internet of Things (IoT) relies on centralized certification authorities, which can be unreliable and unsuitable for devices with limited resources, and traditional asymmetric cryptosystems are too resource-intensive for IoT applications.
Innovation Solution
A method for managing implicit certificates using a distributed hash table, where each node in the network stores and manages a portion of the certificates, ensuring high security and independence from a single authority, utilizing elliptic curve cryptography and a chaining mechanism to reinforce authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If centralized certificate authorities are used to manage implicit certificates, then certificate management is simplified and standardized, but security and independence are compromised due to single-point failure and trust concerns
Solution Approach 1:
The patent segments the centralized certificate authority function into multiple distributed indexing nodes that collectively manage implicit certificates. Each node stores and manages a portion of the certificates in the distributed hash table, eliminating the single-point failure issue while maintaining standardized management procedures across the network.
Solution Approach 2:
The patent introduces indexing nodes as intermediaries between nodes seeking certificates and the distributed hash table storage. These indexing nodes facilitate certificate management operations while distributing the trust model across multiple independent entities rather than relying on a single centralized authority.
2Reliability
If traditional asymmetric cryptosystems like RSA are used, then security is provided through established algorithms, but resource consumption exceeds the capabilities of IoT devices with limited memory and computing resources
Solution Approach 1:
The patent changes the cryptographic parameters from traditional RSA key sizes (2048 bits or larger) to elliptic curve cryptography with much smaller key sizes (256 bits). This parameter change maintains equivalent security levels while reducing memory usage and computational requirements to levels suitable for resource-constrained IoT devices.
Solution Approach 2:
The patent employs implicit certificates that are smaller and more efficient than traditional X.509 certificates, enabling lightweight authentication suitable for IoT environments where resources are limited and devices may be disposable or have constrained lifecycles.
3Ease of operation
If all implicit certificates are stored in a single location managed by one authority, then retrieval is simplified, but the system becomes vulnerable to attacks and single-point failures
Solution Approach 1:
The patent segments the certificate storage across multiple indexing nodes in a distributed hash table structure. Each node stores a portion of the implicit certificates, and the distributed architecture provides redundancy and resistance to attacks while maintaining efficient retrieval through hash-based lookup mechanisms.
Solution Approach 2:
The patent implements local caching of frequently accessed certificates at indexing nodes, optimizing retrieval speed for local queries while the distributed structure provides security against remote attacks. Each node has specialized local knowledge of the certificates it stores, improving both retrieval efficiency and security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for managing implicit certificates for elliptic curve encryption (ECQV). The implicit certificates are stored in different network nodes according to a distributed hash table (DHT), rather than with a single certificate authority. The implicit certificate of the public key associated with a node is obtained by chaining elementary certification operations with a series of indexing nodes in the network. This chaining of elementary certification operations strengthens the authentication of the network nodes.