Merging Browser and Server Certificates for Multi-Provider Identity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity protocols restrict users to a single identity provider, leading to single points of failure and inability to directly authenticate between users, making it difficult to replace identities without losing connections or verifying new identities cryptographically.
Innovation Solution
A method and system for creating a certificate that allows users to have multiple identities certified by multiple identity providers, using Extended Pretty Good Privacy (E-PGP) certificates to merge browser-signed and server-signed certificates across different identity providers, enabling cross-certification and alias management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If users are tied to a single identity provider, then the authentication process is simplified, but the system becomes vulnerable to single points of failure and lacks flexibility
Solution Approach 1:
The patent merges multiple identity provider certificates into a single consolidated certificate that contains authentication paths from multiple identity providers. This allows users to authenticate through any of their enrolled identity providers while maintaining a unified certificate structure, thereby increasing adaptability without proportionally increasing complexity.
Solution Approach 2:
The consolidated certificate serves multiple functions: it can be used for authentication with any enrolled identity provider, it provides fallback paths when primary providers are unavailable, and it enables cross-provider verification. This multi-functionality resolves the contradiction by making the system adaptable to multiple identity providers while keeping the certificate management approach unified and manageable.
2Reliability
If identity protocols support only one verification path per identity, then the authentication process is straightforward, but the system lacks redundancy and resilience
Solution Approach 1:
The system preliminarily establishes multiple verification paths within the certificate during the enrollment phase, before any authentication failures occur. By pre-configuring multiple identity provider paths in the consolidated certificate, the system ensures reliability and redundancy are available when needed, without requiring complex real-time decision-making during authentication.
Solution Approach 2:
The verification path selection is made dynamic, allowing the system to adaptively choose which identity provider path to use based on availability and current conditions. The consolidated certificate contains multiple paths that can be dynamically selected during authentication, providing reliability without requiring all paths to be actively managed simultaneously, thus avoiding excessive complexity.
3Adaptability or versatility
If users want to replace their identity, then they gain flexibility, but current protocols make it difficult to maintain connections between old and new identities
Solution Approach 1:
The patent implements a nested structure where new identity certificates can be embedded within or linked to existing consolidated certificates. When a user replaces their identity, the new identity information is nested within the existing certificate structure, maintaining the connection between old and new identities while enabling flexibility. This nested approach allows identity transition without requiring complete re-issuance or breaking existing authentication paths.
4Adaptability or versatility
If multiple identities are certified by multiple identity providers, then cross-certification and alias management are enabled, but the certificate structure becomes more complex
Solution Approach 1:
The patent merges multiple identity provider certificates into a single consolidated certificate that contains authentication paths from multiple identity providers. This merging process systematically combines the cryptographic elements and verification paths from different providers into a unified structure, enabling cross-provider authentication while managing complexity through a standardized merge procedure.
Solution Approach 2:
The consolidated certificate structure is designed to be universal, accommodating certificates from different identity providers with a common format and verification mechanism. This universality allows cross-provider authentication without requiring provider-specific handling logic, thereby enabling adaptability while controlling complexity through a unified certificate structure.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for creating a certificate to authenticate a user identity at a web browser includes receiving a login request including a first user identity for a user and generating a first browser-signed certificate using public and secret keys associating the first user identity to the web browser. The first browser-signed certificate is sent to a first identity provider server and in response a first server-signed certificate is received from the first identity provider server. The first server-signed certificate associates the first user identity to the first identity provider server. A final certificate is generated by merging the first browser-signed certificate with the first server-signed certificate.