ID Token Certificate Validation Using Generation Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Smart cards without internal clocks face challenges in validating certificate validity due to the absence of time specifications, leading to potential security gaps when certificates are compromised, as they remain valid until their predetermined period expires, allowing misuse.
Innovation Solution
Implementing a method using an ID token with a communication interface and memory that verifies certificates by checking the generation identifiers, where the issuing and expiring generations determine validity, allowing for time-independent control and immediate revocation of compromised certificates without external access or revocation lists.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificates are issued with predetermined validity periods for smart cards without internal clocks, then certificate validity can be verified using issue time approximation, but compromised certificates remain valid until their predetermined period expires, creating security gaps
Solution Approach 1:
The patent changes the validity verification parameter from time-based (issue time approximation) to generation-based (sequential generation identifiers). Each certificate contains an issue generation identifier and an expiration generation identifier, allowing the ID token to verify validity by comparing generation numbers rather than approximating time, enabling immediate revocation when generation identifiers advance.
Solution Approach 2:
The patent implements preliminary revocation action by allowing the expiration generation identifier to be set in advance. When a certificate is compromised, the authorization PKI can issue a new certificate with an advanced generation identifier, causing the compromised certificate to expire immediately without waiting for the predetermined validity period to end.
2Object-affected harmful factors
If centralized revocation lists are used to revoke compromised certificates, then certificate revocation can be achieved, but access to centrally managed revocation lists requires significant latency and external server access
Solution Approach 1:
The patent extracts the revocation capability from external centralized systems and embeds it directly into the ID token and certificate structure. The ID token stores a reference value (issue generation identifier of a previously received certificate), enabling local comparison with the certificate's generation identifiers to determine validity, eliminating the need for external revocation list access.
Solution Approach 2:
The ID token performs self-service validity verification by comparing the certificate's issue generation identifier and expiration generation identifier against its stored reference value. This self-contained verification mechanism eliminates dependency on external servers and enables immediate revocation detection without latency.
3Device complexity
If short validity periods are used to circumvent revocation problems in simple smart cards, then certificate revocation becomes unnecessary, but compromised certificates remain valid until their short validity period expires
Solution Approach 1:
The patent changes the validity control mechanism from time-based short validity periods to generation-based identifiers. Each certificate contains issue generation and expiration generation identifiers that allow the ID token to verify validity by comparing generation numbers, enabling both long-term validity and immediate revocation without requiring frequent certificate renewal.
Data Source
Figure 1
Figure 2
Figure 3A~3C
AI summary
The invention relates to a method for verifying the validity of a first certificate (Z, ZX) by means of an ID token (160, 170), the method comprising: - receiving the first certificate (Z, ZX), wherein the first certificate (Z, ZX) has an issue generation identifier (GA, GAX) and an expiration generation identifier (GE, GEX) that define the validity of the first certificate (Z, ZX), wherein a reference value (GR, GRGK) for the validity check is stored in a memory (162, 172) of the ID token (160, 170), - verifying the signature of the first certificate (Z, ZX), - checking the validity of the first certificate (Z, ZX), - checking whether the issue generation (GA, GAX) is more advanced than the reference value (GR, GRGK), - in the event that the issue generation (GA, GAX) is more advanced than the reference value (GR, GRGK) is replacing the reference value (GR, GRGK) with the issue generation identifier (GA, GAX) as the new reference value (GR',GR'GK). By generating and sending a third certificate (Zi') with an issue generation (GAi') that is more advanced than an expiration generation (GEX) of the first certificate (Z, ZX), the first certificate (Z, ZX) can be revoked.