Portable Certificate Enrollment for Secure Device Replacement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing device enrolment and replacement processes in secure networks require involvement of a security administrator, which can be inconvenient and inefficient, especially when timely replacement is necessary and the administrator is unavailable.
Innovation Solution
A method and system that allows a communication device to be enrolled in a secure network using an electronic device as a removable asset, which generates and signs a certificate without direct security administrator intervention, utilizing an intermediary certificate signed by a security server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a security administrator is involved in the device enrolment process to create and validate certificates, then the security and reliability of the network is improved, but the complexity of the enrolment process and the time required for device replacement increases
Solution Approach 1:
The patent segments the certificate authority function into two parts: the security administrator who initially creates the electronic device's certificate, and the electronic device itself which then acts as a portable certificate authority for subsequent devices. This segmentation allows the enrolment process to be divided into an initial setup phase (requiring administrator involvement) and a replacement phase (automated), thereby reducing overall process complexity while maintaining security.
Solution Approach 2:
The electronic device serves as an intermediary between the security administrator and new communication devices during replacement. It holds and transmits the signature capability (certificate authority function) without requiring the administrator's direct involvement in each replacement transaction, thus simplifying the process while preserving security through the intermediary's validated signature.
2Reliability
If a security administrator is required to create and validate certificates for each device replacement, then the security control is improved, but the time required for device replacement and administrative overhead increases
Solution Approach 1:
The security administrator performs preliminary action by creating and configuring the electronic device with certificate authority capabilities before any replacements occur. This advance preparation stores signature algorithms and cryptographic keys in the electronic device, enabling rapid automated certificate creation during replacements without requiring administrator intervention at the time of replacement, thus reducing time loss while maintaining security.
Solution Approach 2:
The electronic device enables self-service by autonomously creating and validating certificates for replacement communication devices using its stored signature capability. The device independently performs certificate authority functions without external administrator involvement during replacements, significantly reducing both time loss and administrative overhead while maintaining security through pre-configured cryptographic validation.
3Speed
If devices are pre-enrolled in stock for timely replacement, then the replacement speed is improved, but the need for secure certificate distribution and management increases complexity
Solution Approach 1:
The electronic device provides universality by serving multiple functions: it acts as a secure storage medium for certificate authority credentials, a portable certificate issuer for multiple communication devices, and a validation authority. This multi-functionality eliminates the need for separate certificate management systems for pre-enrolled devices, reducing overall system complexity while enabling rapid replacement through a single versatile tool.
Data Source
AI summary
Connection authorization from a communication device (CD) to an application server (AS) uses an electronic device (ED) to provide a first dataset to a security server (SS) in response to a first request, the first dataset related to a certificate of the ED. The ED retrieves an intermediary certificate generated by the SS based on the first dataset and signed by the SS. When the ED is connected to a CD intended to be introduced in a secured network, the ED receives a second request from the CD including a second dataset related to a certificate of the CD. The ED then generates a third dataset related to a signature of certificate of the CD and to the intermediary certificate. The ED thereafter sends the third dataset to the CD to obtain authorization to access to the secure network from the AS by using the third dataset.