Machine Identity Certificates with Embedded Signed Security Claims

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Digital certificates in massively distributed systems face issues with security vulnerabilities and synchronization discrepancies due to changes in claims propagating at different speeds, leading to inconsistent security data across nodes.

Innovation Solution

Embedding signed security claims in digital certificates at their source, ensuring verification and synchronization, allowing trust to flow from the user to a remote site, and maintaining consistent security properties across nodes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If digital certificates are distributed throughout a massively distributed system, then certificate coverage and authentication capability are improved, but synchronization consistency deteriorates as changes in claims propagate at different speeds across nodes

Engineering Contradiction:

Improvecertificate authentication capabilityVSAvoidsynchronization consistency

Core Design Contradiction:

ReliabilityVSStability of the object's composition

Solution Approach 1:

The patent segments the certificate data structure into multiple independent components: the certificate body containing static identification information, and separate claims containing dynamic security properties. This segmentation allows different parts of the certificate to be updated independently, resolving the contradiction by enabling claim updates without requiring full certificate redistribution across all nodes.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements preliminary action by pre-signing claims with cryptographic signatures before distribution. This pre-signing allows receiving nodes to verify claim authenticity and detect modifications without needing real-time communication with the issuing node, ensuring synchronization consistency while maintaining broad certificate distribution.

Inventive Principle:

Principle #10Preliminary action

2Adaptability or versatility

If security claims are updated in distributed certificates, then security control flexibility is improved, but vulnerability to interception and modification increases during propagation

Engineering Contradiction:

Improvesecurity control flexibilityVSAvoidinterception and modification vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary action by pre-signing security claims with cryptographic signatures before they are distributed across the network. This pre-signing ensures that any subsequent interception or modification attempts can be detected through signature verification, thus maintaining security control flexibility while preventing vulnerabilities during propagation.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent converts the potential harm of claim modification into a benefit by using cryptographic signatures. Any attempted modification of claims during propagation automatically invalidates the signature, transforming a security vulnerability into a detectable security feature that alerts receiving nodes to the tampering attempt.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

3Speed

If nodes maintain local copies of certificates for fast access, then operation speed is improved, but data freshness deteriorates as nodes may have outdated claims

Engineering Contradiction:

Improveoperation speedVSAvoiddata freshness

Core Design Contradiction:

SpeedVSLoss of information

Solution Approach 1:

The patent segments certificate data into static certificate bodies that can be cached locally for fast access, and dynamic claims that are verified through cryptographic signatures. This segmentation allows nodes to maintain local copies of the certificate structure for speed while ensuring data freshness through signature verification, as any outdated claims would have invalid signatures.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements feedback through cryptographic signature verification at each node. When a node receives or caches claims, it verifies the signature to confirm the claims are current and unmodified. This feedback mechanism ensures data freshness without requiring continuous synchronization, allowing nodes to maintain local copies for fast operation.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12425389B2Dynamic attachment of secure properties to machine identity with digital certificates

Publication Date: 2025.09.23 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Technology is shown for dynamically attaching secure properties to an identity certificate. Claims determining secure properties for an identity are signed and embedded in an identity certificate. Both the identity certificate and the signed claims in the certificate are verified. When a service request is received from the identity, the signed claims from the identity certificate are checked to determine if the request is permitted. If the request is permitted, then the service request is processed. Some examples involve creating claims determining the secure properties for the remote machine, signing the claims to create the signed claims, distributing the signed claims to a certificate authority, embedding the signed claims in the remote machine identity certificate, and distributing the remote machine identity certificate. The claims can be embedded in the certificate as X.509 properties.