Nested Identity Data Packaging for Secure PKI Delivery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current digital security mechanisms, particularly in Public Key Infrastructure (PKI) systems, face challenges in ensuring the privacy, authenticity, and integrity of identity data during transfer over networks, especially at intermediate stages, which can lead to data tampering and unauthorized access.
Innovation Solution
A method is introduced that securely delivers identity data units by generating a public key bound to a customer, creating a unique symmetric key, encrypting identity data units with this key, and packaging them with a digital signature for secure transmission, ensuring multiple layers of protection and verification upon receipt.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If identity data is transferred over the network using conventional PKI mechanisms, then the data can be delivered to the customer, but the privacy, authenticity and integrity of the identity data cannot be ensured at intermediate stages of the delivery process
Solution Approach 1:
The patent implements nested encryption by placing the identity data inside an encrypted container, which is itself protected by a symmetric key, which in turn is protected by asymmetric encryption. Multiple layers of digital signatures are also nested within the package structure, creating a nested doll-like protection mechanism that ensures security at each intermediate stage while maintaining manageable complexity through systematic organization.
Solution Approach 2:
The identity data is segmented into discrete identity data units, each independently packaged and protected. The delivery mechanism is segmented into distinct operational phases: package generation with multiple encryption layers, secure transmission, and verification upon receipt. This segmentation allows each component to be optimized independently while collectively providing comprehensive security.
2Reliability
If multiple layers of encryption and packaging are applied to identity data units, then security is improved, but the processing time and computational resources increase
Solution Approach 1:
The symmetric key is generated and the initial encryption of identity data units is performed in advance during the package generation phase, before transmission begins. The container is prepared with all necessary digital signatures and encryption layers pre-applied. This preliminary action reduces the computational burden and time required during the actual transmission and initial verification stages, as the heavy encryption work is already completed.
Solution Approach 2:
A symmetric key acts as an intermediary between the identity data and the final recipient. The symmetric key efficiently encrypts the identity data units, while asymmetric encryption serves as an outer protective layer. This intermediary approach allows the system to benefit from both symmetric encryption speed and asymmetric encryption security, optimizing the balance between security and processing efficiency.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method is provided for securely delivering identity data units over a communications network to a client device. The method includes receiving a selection from a customer identifying a final zipped package to be unpacked. The final zipped package is unpacked to obtain a common package and a digital signature file signed by an entity generating identity data requested by the customer. The digital signature in the digital signature file is verified and the common package is unpacked to obtain a plurality of outer packages and an encrypted symmetric key. The symmetric key is decrypted with a private key associated with the customer and each of the outer packages is decrypted with the symmetric key to obtain a plurality of identity data units.