Edge Node Cryptographic Signature Verification Across Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network security, verifying cryptographic signatures across different networks is challenging, especially when there is no established public-key infrastructure, as it requires a trust relationship between edge nodes to ensure secure communication and signature validation in inter-network scenarios.
Innovation Solution
Establishing a trust relationship between edge nodes in different networks through certificate exchange, such as using Transport Layer Security (TLS) connections, allows for the verification of cryptographic signatures by including or referencing the signature within the token or its headers, enabling secure token transmission across network boundaries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic signature verification is implemented across different networks without established public-key infrastructure, then security and trust relationship are improved, but system complexity and difficulty of implementation increase
Solution Approach 1:
The patent introduces edge nodes as intermediary entities between different networks. These edge nodes establish trust relationships with each other and act as mediators to verify cryptographic signatures of tokens from remote networks. Instead of requiring direct public-key infrastructure between all networks, the edge nodes serve as trusted intermediaries that can validate signatures, thereby reducing overall system complexity while maintaining security.
Solution Approach 2:
The patent implements preliminary establishment of trust relationships between edge nodes before actual token verification occurs. Edge nodes pre-exchange cryptographic keys and establish mutual trust through certificate exchange or other authentication mechanisms. This preliminary action allows subsequent token verification to proceed efficiently without requiring complex real-time infrastructure setup, resolving the contradiction between security requirements and implementation complexity.
2Reliability
If cryptographic signature verification is performed across network boundaries, then trust relationship between networks is established, but communication overhead and processing time increase
Solution Approach 1:
The patent extracts the cryptographic signature verification process from the main token processing flow by having edge nodes perform verification independently. The signature verification is separated as a distinct step that edge nodes handle using pre-established trust relationships, allowing the core token processing to continue efficiently. This extraction reduces processing time by parallelizing operations and avoiding sequential bottlenecks.
Solution Approach 2:
Edge nodes are designed to autonomously verify cryptographic signatures using their own pre-configured cryptographic keys and trust stores. Rather than requiring centralized verification services or complex inter-node coordination during token processing, each edge node independently performs verification using locally available resources. This self-service approach eliminates communication overhead for verification requests and reduces processing time.
3Reliability
If cryptographic signatures are included in tokens or external headers for cross-network communication, then security is enhanced, but data structure complexity and storage requirements increase
Solution Approach 1:
The patent implements nesting of cryptographic signatures within the token structure itself when possible, or in organized external headers. The signature data is embedded as a nested component within the existing token format, utilizing available fields efficiently. This nesting approach maintains security while minimizing data structure complexity by integrating cryptographic elements into the existing token architecture rather than creating separate complex structures.
Data Source
AI summary
According to an example aspect of the present invention, there is provided an apparatus configured at least to determine whether a cryptographic signature of a token received in the apparatus from a network function consumer is valid, obtain a cryptographic signature of the apparatus of the token responsive to the cryptographic signature of the token being valid, and provide the token to a peer entity of the apparatus, wherein the cryptographic signature of the apparatus is either included into the token or provided in a header external to the token, wherein the peer entity is comprised in a second network, different from a first network where the apparatus is comprised in. The request may serve a user equipment, directly or indirectly.