Encrypting Web Service Bypasses PKI Certificate Costs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing Public Key Infrastructure (PKI) systems require users to undergo a verification process to obtain a valid certificate, which is costly and not economically viable for independent users, limiting their ability to securely share sensitive information over insecure networks.
Innovation Solution
A method and system that utilize a trusted Encrypting Web Service (EWS) to encrypt and decrypt information, allowing users to securely share sensitive data over insecure networks by using a secure communication link and authorization information, without the need for a certificate service, enabling open authentication providers to verify user identities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PKI systems are used to securely share sensitive information, then data security is improved, but the verification process becomes costly and complex for independent users
Solution Approach 1:
The patent extracts the certificate authority verification function from the encryption process itself. Instead of requiring users to obtain certificates from CAs before encrypting data, the system separates the identity verification step (performed by open authentication providers) from the encryption/decryption step (performed by the EWS), eliminating the need for traditional PKI certificates in the encryption flow
Solution Approach 2:
The patent introduces open authentication providers as intermediary services that verify user identities and provide authentication tokens. These providers act as mediators between users and the EWS, replacing the traditional CA certificate verification mechanism with a more accessible authentication approach that doesn't require users to undergo complex certificate enrollment processes
2Reliability
If traditional PKI certificate services are used, then identity verification is reliable, but the cost becomes prohibitive for independent users
Solution Approach 1:
The patent enables users to self-verify their identities through open authentication providers that they already use (such as email providers or social media platforms). Instead of paying for external certificate services, users leverage their existing authentication accounts to obtain tokens that prove their identity to the EWS, making the verification process free and self-service oriented
Solution Approach 2:
The patent replaces expensive, long-term digital certificates with short-lived authentication tokens that are inexpensive to generate. These tokens are created on-demand by authentication providers and can be discarded after use, eliminating the recurring costs associated with certificate renewal while maintaining verification reliability
Data Source
AI summary
A data encryption service is provided over the Internet. Users specifying only authorized users' identity information can share encrypted information without sharing passwords or accessing public key certificates. A user sends data to be encrypted to a trusted EWS, along with authorization information. An encrypted data envelope including signed encrypted data blocks, authorization information, and a digital signature is returned to the user. When a second user attempts to access the data inside the encrypted data envelope, it is transmitted to the EWS. If the EWS authenticates the second user, determines that tampering has not occurred, and verifies the second user's identity against the authorization information in the data envelope, then the data are returned. The encrypted data envelope can be expressed as a raw byte stream or encoded within an HTML file to enable browser-based data envelope submission and retrieval.