Endpoint Device Validation Rules for Multi-System Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing endpoint devices rely on cryptographic verification, which can be compromised by a single compromised signing system, leading to untrustworthy requests, thus compromising security.
Innovation Solution
Implementing a validation rule system that requires requests to be signed with at least two different keys from separate signing systems, ensuring diversity and reducing the likelihood of compromise by requiring multiple systems to be hacked.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic verification with a single signing system is used, then the operation is simple and fast, but the security is compromised when that single system is breached
Solution Approach 1:
The patent divides the single signing system into multiple independent signing systems (first signing system, second signing system, etc.). Each system signs requests independently, and the endpoint device must validate signatures from multiple systems. This segmentation ensures that compromise of one system does not compromise overall security, directly resolving the contradiction between security and complexity.
Solution Approach 2:
The patent implements pre-validation rules that require multiple signatures before a request is processed. The endpoint device stores validation rules that specify required signature counts and source diversity. This beforehand cushioning creates a security buffer that prevents unauthorized requests even if some signing systems are compromised, addressing the security-reliability contradiction.
2Reliability
If multiple signing systems are required for validation, then the trustworthiness of requests is enhanced, but the validation process becomes more complex
Solution Approach 1:
The patent establishes validation rules in advance that define the required signature structure (minimum number of signatures, required diversity of signing systems). These rules are configured before runtime, allowing the endpoint device to automatically validate requests without complex real-time decision-making. This preliminary configuration reduces operational complexity while maintaining high trustworthiness requirements.
Solution Approach 2:
The patent uses signature copies from multiple independent signing systems. Instead of implementing complex validation logic, the system simply requires that the request contain multiple signature copies from different signing systems. The endpoint device validates by checking the presence and authenticity of these signature copies, simplifying the validation process while enhancing trustworthiness.
3Object-affected harmful factors
If multiple keys from separate signing systems are required, then the difficulty of compromise increases, but the processing overhead increases
Solution Approach 1:
The patent segments the signature validation into independent checks for each signing system. The endpoint device checks signatures from the first signing system, then checks signatures from the second signing system, and so on. This segmented approach allows parallel processing of signature validations, reducing overall processing time while maintaining the security benefit of multiple keys from separate systems.
Data Source
AI summary
Methods and systems for validating requests for endpoint devices are disclosed. The requests may be signed by one or more signing systems according to a set of validation rules for the endpoint device. The set of validation rules may indicate that requests may be valid if signed using at least two different keys. The validation rules may be determined prior to onboarding the endpoint device and may be included in an ownership voucher for the endpoint device. Therefore, request may be serviced if signatures associated with the request meet the validation rules.