PKI Event Logging Server for Compromised Key Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In wireless communication networks, it is challenging to determine whether a private key of a subject node has been compromised, as existing PKI schemes rely on secure key storage which is often a weak link, and surreptitious attacks like malware or algorithm attacks can go undetected.
Innovation Solution
A PKI event logging (PEL) server is introduced to confirm the authenticity of PKI transactions by processing and comparing reported transaction event data between a relying node and a subject node, enabling secure communications and detecting compromised private keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional PKI schemes are used with relying nodes validating certificates, then certificate authentication is achieved, but the ability to detect compromised private keys is insufficient
Solution Approach 1:
The system performs preliminary actions by having the relying node log transaction event data before the subject node can potentially compromise its private key. The log contains evidence of past transactions that can be used to detect future compromises. By preparing this evidence in advance and storing it securely, the system enables retroactive detection of key compromises without requiring real-time monitoring that would alert potential attackers.
Solution Approach 2:
The invention introduces an intermediary mechanism - the event logging system with hash value comparison - that mediates between the subject node and relying node to detect private key compromises. Instead of directly monitoring for compromises (which is difficult), the intermediary log comparison system indirectly detects compromises by identifying discrepancies in transaction histories, thereby solving the detection difficulty without requiring direct access to private keys.
2Reliability
If secure key storage is implemented, then private key protection is improved, but the security chain remains vulnerable at weak links
Solution Approach 1:
The system implements feedback by continuously comparing transaction event logs between the subject node and relying node. When a discrepancy is detected (indicating a potential compromise), the system provides feedback to alert the subject node. This feedback loop enables the system to detect surreptitious attacks that occur despite secure storage measures, allowing for timely response to security incidents.
Solution Approach 2:
The relying node performs preliminary logging of all transaction events before any compromise can occur. This preliminary action creates a baseline record that can be compared against the subject node's records later. By establishing this baseline in advance, the system prepares the evidence needed to detect compromises without requiring continuous monitoring that might expose the system to attacks.
3Reliability
If thorough transaction verification is performed, then authentication reliability is improved, but transaction processing time increases
Solution Approach 1:
The invention extracts only the essential verification elements - transaction event log hash values - from the complete transaction records. Instead of verifying entire transaction histories in real-time, the system extracts and compares compact hash representations. This extraction approach maintains authentication reliability while dramatically reducing the time and computational resources required for verification.
Solution Approach 2:
The system performs the computationally intensive logging and hash generation in advance, before the actual transaction verification is needed. By preparing the transaction event logs and their hash values preliminarily, the system eliminates the need for time-consuming real-time analysis during transaction verification, thus maintaining security while reducing verification time.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method and device for confirming authenticity of a public key infrastructure (PKI) transaction event between a relying node and a subject node in a communication network enables improved network security. According to some embodiments, the method includes establishing at a PKI event logging (PEL) server a process to achieve secure communications with the relying node (step 705). Next, the PEL server processes reported PKI transaction event data received from the relying node (step 710). The reported PKI transaction event data describe the PKI transaction event between the relying node and the subject node. The reported PKI transaction event data are then transmitted from the PEL server to the subject node (step 715). The subject node can thus compare the reported PKI transaction event data with corresponding local PKI transaction event data to confirm the authenticity of the PKI transaction event.