PKI Signature Revocation via Serial Number Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing public key infrastructure (PKI) systems lack a method to effectively revoke individual digital signatures, leading to issues when a private key is compromised, as all signatures generated with the compromised key must be reissued and re-distributed, which is inefficient and insecure.
Innovation Solution
Introducing a signature serial number system that allows for the revocation of specific digital signatures within a digital certificate, enabling individual signature revocation without the need to reissue or re-distribute all signatures associated with the compromised key, using a trusted signature database and revocation flags to manage signature states.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all signatures are reissued when a private key is compromised, then security is improved, but operational overhead and time consumption increase significantly
Solution Approach 1:
The patent segments the revocation process by introducing signature-specific serial numbers that allow individual signatures to be revoked independently. Instead of revoking all signatures associated with a compromised private key, the system can selectively revoke only those specific signatures that were unauthorized, thereby reducing the time and operational overhead while maintaining security.
2Reliability
If all signatures are reissued when a private key is compromised, then security is improved, but operational complexity increases
Solution Approach 1:
The patent introduces a segmented approach where each signature has its own serial number stored in a database. This allows the system to manage and revoke individual signatures without affecting others, reducing operational complexity compared to reissuing all signatures. The database structure enables efficient tracking and selective revocation of only compromised signatures.
3Productivity
If individual signature revocation is implemented, then operational efficiency is improved, but system complexity increases
Solution Approach 1:
The patent uses a database to store copies of signature serial numbers and their revocation status. This copying mechanism allows the system to efficiently track and revoke individual signatures without complex real-time validation logic. The database acts as a centralized repository that simplifies the revocation process while enabling individual signature management.
4Reliability
If a comprehensive signature tracking system is implemented, then signature revocation capability is improved, but information storage requirements increase
Solution Approach 1:
The patent stores only essential information (signature serial numbers and revocation status) in a database rather than storing complete signature data. This selective copying approach provides comprehensive signature tracking capability while minimizing data storage requirements by storing only the minimum necessary information for revocation purposes.
Data Source
AI summary
In one implementation, a public key infrastructure utilizes a two stage revocation process for a set of data. One stage authenticates or revokes the set of data based on the status of the digital signature and another stage authenticates or revokes the set of data based on the status of an individual signature by the digital certificate. For example, a digital certificate based is assigned a certificate number. A serial number is assigned for a signature for the set of data as signed by the digital certificate. A data transmission, data packet, or install package includes the set of data, the certificate number and the serial number. Therefore, individual instances of the signature may be revoked according to serial number.