Offline Authentication Key Rotation via Local Public Key Stores
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems face challenges in managing public-private keys, especially when private keys need to be retired or compromised, particularly for customer systems not connected to a network, requiring manual distribution of new public keys for verification.
Innovation Solution
The authentication server generates multiple public-private key pairs and distributes public keys to customer systems, which store them locally. These systems use one of the public keys to verify digitally signed challenges, allowing the authentication server to switch private keys without distributing new public keys to isolated customer systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the authentication system uses a single public-private key pair for authentication, then the authentication process is simple and efficient, but the system cannot update keys without manual distribution to all customer systems
Solution Approach 1:
The authentication system segments the key management by maintaining multiple public-private key pairs (first key pair, second key pair, etc.) instead of using a single key pair. This allows the system to distribute public keys to customer systems in advance and update authentication keys without requiring manual redistribution, thereby improving adaptability while managing complexity through structured key rotation protocols
Solution Approach 2:
The authentication system performs preliminary action by generating and distributing multiple public keys to customer systems before key updates are needed. Customer systems store these public keys locally and use them to verify digital signatures. When the authentication server needs to update keys, it simply stops using the old private key and begins using a new one, while customer systems already have the corresponding new public key stored, enabling seamless key rotation without manual intervention
2Reliability
If the authentication server distributes new public keys to all customer systems when updating keys, then key security is maintained, but customer systems without network connectivity cannot receive updates
Solution Approach 1:
The authentication system performs preliminary action by distributing multiple public keys to customer systems in advance, including future key pairs. Customer systems store these public keys locally in their key stores. When the authentication server needs to update keys, it simply begins using a new private key while customer systems already have the corresponding new public key stored, enabling seamless key rotation without requiring network connectivity at the time of key update
Solution Approach 2:
The authentication system makes the public key distribution mechanism universal by allowing customer systems to receive and store multiple public keys that can serve different purposes: verifying current signatures, verifying future signatures after key rotation, and providing backup verification capabilities. This multi-functionality ensures that key updates work reliably regardless of network connectivity status
3Adaptability or versatility
If the system stores multiple public keys locally in customer systems, then key updates can occur without network connectivity, but the local key store size increases
Solution Approach 1:
The authentication system applies partial action by distributing only the necessary number of public keys to customer systems - typically one or two future key pairs in addition to the current key. This provides sufficient capability for key updates and offline operation without excessively increasing the local key store size. The system balances the quantity of stored keys against the requirement for offline key update capability
Data Source
AI summary
Provided are a computer program product, system, and method for using public keys provided by an authentication server to verify digital signatures. A plurality of public keys from a plurality of public-private key pairs and stored in a local key store. A request is received to access computational resources in the system. A challenge is returned in response to the request. A response to the challenge is received comprising a purported digitally signed challenge. A determination is made as to whether the purported digitally signed challenge is verified using a first public key of the public keys in the local key store. A determination is made as to whether the purported digitally signed challenge is verified using a second public key of the public keys in the local key store in response to determining that the first public key did not verify the purported digitally signed challenge.