PKI Authentication Chain for Multi-Party Biometric Trust
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods, particularly in IoT and metaverse environments, are vulnerable to cyber-attacks and require multiple certificates for multi-party transactions, lacking system-wise security and robust biometric-based authentication.
Innovation Solution
A chain of authentication method using public key infrastructure (PKI) that sequentially authenticates multiple parties by generating modified public keys with biometric codes, minimizing the number of certificates required and implementing biometric security at the certificate level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods (ID, password, biometric data) are used, then authentication can be performed, but security is compromised due to ease of loss, theft, or interception
Solution Approach 1:
The patent replaces traditional mechanical authentication systems (physical IDs, passwords, biometric data storage) with a cryptographic system based on public key infrastructure. Instead of storing sensitive authentication data that can be intercepted, the system uses asymmetric cryptography where private keys never leave the user's device and public keys are used for verification, fundamentally changing the authentication mechanism from data-based to key-based security.
Solution Approach 2:
The patent introduces a certificate authority (CA) as an intermediary that issues digital certificates binding public keys to user identities. This intermediary layer enables trusted authentication without requiring direct sharing of sensitive private keys between parties, solving the security problem of key distribution while maintaining authentication reliability.
2Reliability
If PKI-based authentication is implemented for multiple parties, then system-wise security is improved, but the number of required certificates increases
Solution Approach 1:
The patent merges multiple authentication relationships into a single chain of trust structure. Instead of requiring separate certificate pairs for each party relationship, the system creates a sequential chain where each party's public key is signed by the previous party, consolidating multiple authentication credentials into a unified verification process that reduces the total number of certificates needed.
Solution Approach 2:
The patent creates a universal authentication chain that can verify multiple parties through a single verification process. The chained public keys serve multiple functions: they authenticate each individual party, establish trust relationships between all parties in the chain, and enable group verification, replacing what would otherwise require multiple separate authentication mechanisms.
3Reliability
If biometric data is embedded in PKI certificates, then certificate control is strictly improved, but system complexity increases
Solution Approach 1:
The patent embeds biometric data within the PKI certificate structure as a nested element. The biometric template is incorporated into the certificate's distinguished name or extension fields, creating a layered structure where the certificate contains both the public key and the biometric identifier. This nested approach allows strict certificate control through biometric verification while reusing existing certificate infrastructure.
Data Source
AI summary
A method for sequential authentication based on chain of authentication using public key infrastructure (PKI) is provided. The method includes generating, by a user, a first private key and a first public key corresponding to each other; generating, by an nth service provider, an nth private key and an nth public key corresponding to each other; transmitting, from the user to the nth service provider, a level n key; verifying, by the nth service provider, the level n key; generating, by the nth service provider, a level (n+1) key by concatenating the level n key and the nth public key signed with the nth private key; and transmitting, by the nth service provider, the level (n+1) key to the user, where n is a natural number, and when n=1, the level 1 key is the first public key signed with the first private key.