Distributed Ledger Certificate Authentication for Tamper-Resistant Servers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing X.509 certificate systems face issues with immutability, availability, and certificate history, leading to security vulnerabilities and database inconsistencies, which compromise network security.
Innovation Solution
A distributed ledger-based system for publishing and authenticating issuer and server certificates, ensuring immutability and availability by allowing only authorized servers to add or remove certificates, leveraging a decentralized ledger for secure and transparent certificate management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If X.509 certificates are used for mutual authentication, then certificate exchange and verification can be achieved, but certificate immutability is compromised due to hacker attacks and tampering
Solution Approach 1:
A blockchain-based intermediary system is introduced between the certificate authority and the verifying parties. The blockchain ledger serves as a trusted mediator that stores certificate hashes and issuance records in an immutable manner, preventing hackers from tampering with certificate data while maintaining the authentication functionality of X.509 certificates
2Reliability
If every server maintains its own certificate database, then certificate availability can be maintained, but inconsistency among certificate databases occurs
Solution Approach 1:
Multiple distributed certificate databases are merged into a single unified blockchain ledger that is replicated across all participating servers. This combination approach ensures that all servers access the same certificate data from a shared source of truth, eliminating inconsistency while maintaining availability through the distributed nature of the blockchain network
3Quantity of substance
If X.509 certificate databases are used, then certificate storage can be achieved, but certificate history including additions and revocations is absent
Solution Approach 1:
The blockchain system performs preliminary actions by maintaining a complete, chronological record of all certificate events (issuance, revocation, updates) in an immutable ledger from the moment they occur. This preliminary recording ensures that no certificate history information is lost, as every transaction is permanently stored and can be traced back to its origin
Data Source
AI summary
Disclosed are methods and systems for publishing transactions for adding and removing roles and certificates to and from a distributed ledger and for authenticating certificates of two connected servers. The roles specify what server with the roles can publish what types of transactions for certificates and roles. When a role is requested, two transactions for adding the role and an issuer certificate are published to the distributed ledger. When a certificate of a server without any role is requested, only a transaction for adding the certificate is published to the distributed ledger. All the transactions are published through operation among a certificate-requesting server, a certificate-issuing server, and a distributed ledger network maintaining the distributed ledger. Two connected servers can verify authenticity of their counterpart's identities with the certificate retrieved from the distributed ledger and having the benefits of certificate immutability and availability of the distributed ledger technology.