Edge Network Key Management Delegation in Degraded Mode
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multiple access edge computing systems, user mobility issues arise when an edge network operates in degraded mode, preventing new users without certificates from the central or local certification authorities from accessing resources, especially in scenarios where communication between edge networks is lost.
Innovation Solution
A method that allows temporary user enrollment by generating ephemeral keys derived from administrator keys, enabling local certification authorities to issue certificates for new users in degraded mode, ensuring traceability and separate management of parent and child certificates for revocation purposes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a local CA is created in each edge network to enable degraded mode operation, then the system can operate independently when disconnected from the central CA, but new users cannot access resources because they do not have certificates issued prior to the communication breakdown
Solution Approach 1:
The patent implements preliminary action by having the local CA pre-generate and store certificate signing requests (CSRs) and corresponding public keys before disconnection occurs. When a new user needs access in degraded mode, the local CA can immediately sign certificates using pre-stored private keys without needing to communicate with the central CA, thus enabling both degraded mode operation and new user access simultaneously
2Adaptability or versatility
If certificates are issued by the central CA before disconnection, then users have valid certificates for authentication, but the system cannot accommodate new users who arrive after the communication breakdown
Solution Approach 1:
The patent applies segmentation by dividing the certificate authority functionality into central CA and local CA components. The local CA is empowered with its own private key and certificate signing capability, allowing it to independently issue certificates to new users in degraded mode. This segmentation enables the system to maintain certificate validity while accommodating new user enrollment without requiring central CA communication
3Reliability
If the system requires centralized certificate management, then security and traceability are maintained, but the system becomes dependent on continuous communication with the central CA
Solution Approach 1:
The patent implements the nested doll principle by creating a hierarchy where the local CA's public key is signed by the central CA, forming a nested trust structure. The local CA contains its own key pair and certificate signing capability (inner layer), while being validated by the central CA's signature (outer layer). This nested structure enables communication independence for degraded mode operation while maintaining security and traceability through the hierarchical validation chain
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This multiple access edge computing system (10) includes: a key management infrastructure (20) having a central instance on a core network (12) and a local instance on a peripheral network (16); a user/administrator (U3) on the peripheral network, storing a key pair (K_U3, k_U3) and a certificate (Certif_U3) signed by the central instance, and having the privilege of being promoted to administrator in case of operation in degraded mode of the peripheral network; a server (S2) on the edge network storing a public key (K_ACL2) of the local instance, the user/administrator being able to enroll a temporary user (U4) by generating a pair of ephemeral keys (EK_U4, Ek_U4), requesting certification of the pair of ephemeral keys from the local instance and transmitting the pair of ephemeral keys and the generated ephemeral certificate (ECertif_U4) to the temporary user to allow him to access a service of the server.