Digital Provisioning Token for Secure Document Issuance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods face challenges in providing digital documents in a cryptographically secure manner for mobile devices, particularly in ensuring authorization and secure linkage to the terminal device.
Innovation Solution
A method using a digital provisioning token that includes a hash value generated from a combination of a data element and a salt value, signed with an issuer service's signature key, to validate and link the document to a terminal device, ensuring secure issuance and preventing reuse.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a digital document is issued with cryptographic binding to a terminal device, then security and authorization verification are improved, but device complexity and processing requirements increase
Solution Approach 1:
A provisioning token is generated in advance containing a hash value of the data element and salt value combination. This token is signed by the issuer service and stored on the terminal device before the actual document issuance, preparing the cryptographic verification mechanism ahead of time to reduce complexity during the issuance process
Solution Approach 2:
A provisioning token serves as an intermediary element that carries the cryptographic binding information between the issuer service and the terminal device. The token includes a hash value that mediates the verification process, allowing secure document issuance without requiring complex real-time cryptographic operations at the point of issuance
2Measurement precision
If salt values are stored in a database for hash validation, then cryptographic verification accuracy is improved, but security risks from potential data breaches increase
Solution Approach 1:
The system changes the state of the salt value parameter from persistent storage to temporary usage. Salt values are used during hash validation and then deleted, transforming them from a static database entry to a transient parameter that exists only during the verification process
Solution Approach 2:
Salt values are discarded after use in the hash validation process. The provisioning token mechanism allows the salt value to be recovered temporarily for verification, used to validate the hash, and then permanently deleted from the database, ensuring it cannot be misused in future attacks
3Reliability
If provisioning tokens are validated with signature verification, then authorization reliability is improved, but processing time increases
Solution Approach 1:
The provisioning token is signed by the issuer service in advance using a signature key. This preliminary signing action allows the terminal device to verify authorization locally using the public key, eliminating the need for time-consuming real-time communication with the issuer service during document issuance
Solution Approach 2:
The provisioning token contains a copy of the signed authorization information that can be verified independently. Instead of repeatedly querying the issuer service for validation, the system uses the copied signed data in the token, which can be verified quickly using standard cryptographic signature verification algorithms
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for issuing a digital document (172) using a digital provisioning token (170). The provisioning token (170) entitles the holder to receive the digital document (172) to be issued on an end device (150) and to cryptographically link it to the end device (150) during the issuance process. The method comprises, via a first server (100) of the issuing service, receiving an issuance request for the document (172) to be issued from an end device (150) of a requester, receiving the provisioning token (170) from the end device (150), validating the provisioning token (170), issuing the document (172), and sending the issued document (172) to the end device (150).