OIDC Server Trusted Certificate Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The high cost and complexity of deploying certificate management functions (CMFs) for providing trusted certificates to devices, especially during onboarding, pose a challenge for implementing secure two-way authentication between client applications and application servers, making it difficult for software applications to justify the expense and user interaction required.
Innovation Solution
A method is introduced that allows for the establishment of two-way authentication using self-signed certificates generated by client applications or CMF-provided certificates, with an OpenID Connect (OIDC) server validating authentication credentials and provisioning cryptographic identifiers into a list of trusted certificates, enabling secure connections between client applications and application servers without the need for a CMF.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a certificate management function (CMF) is deployed to provide trusted certificates to devices, then security is improved, but cost and deployment complexity increase significantly
Solution Approach 1:
The patent introduces an OpenID Connect (OIDC) server as an intermediary between the client application and the application server. The OIDC server validates authentication credentials and provisions cryptographic identifiers into a list of trusted certificates, eliminating the need for direct CMF deployment on each device while maintaining security.
Solution Approach 2:
The client application generates its own self-signed certificate using a public-private key pair and presents it to the OIDC server for validation. This self-service approach allows devices to obtain trusted certificates without requiring complex CMF deployment infrastructure.
2Reliability
If a CMF is deployed for certificate management, then trusted certificates are provided to devices, but onboarding complexity and user interaction requirements increase
Solution Approach 1:
The client application autonomously generates its own self-signed certificate and authentication credentials without requiring user interaction or complex onboarding procedures. The application simply presents these credentials to the OIDC server for validation.
Solution Approach 2:
The client application performs preliminary actions by generating its own certificate and authentication credentials before connecting to the application server. This eliminates the need for post-deployment certificate provisioning and simplifies the onboarding process.
3Device complexity
If self-signed certificates are used without CMF, then cost and complexity are reduced, but security may be compromised
Solution Approach 1:
The OIDC server acts as a trusted intermediary that validates the self-signed certificates issued by client applications. By verifying authentication credentials and provisioning cryptographic identifiers into a centralized list of trusted certificates, the OIDC server ensures security without requiring complex CMF infrastructure.
Data Source
AI summary
A process for establishing a future 2-way authentication between a client application and an application server. In operation, an OIDC server receives a request from the client application to establish a secure connection from the client application. The request includes a certificate generated using a public-private key pair associated with the client application or a user, and authentication credentials associated with the client application or the user. The OIDC server establishes that the authentication credentials are valid, and provisions a cryptographic identifier of the certificate associated with the request to a list of trusted certificates. The OIDC server then provides one or more application servers with access to the list of trusted certificates to enable the application servers to authenticate the client application based on verifying that cryptographic identifier of the certificate presented by the client application is provisioned into the list of trusted certificates.