Public-Key Network Address Switching During Certificate Expiry
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network systems that determine network addresses using public keys face challenges in ensuring secure and reliable address determination, particularly when digital certificates expire or are about to expire, leading to potential communication disruptions.
Innovation Solution
A network system where devices can have multiple network addresses and public keys, with mechanisms for notifying and updating routing tables when digital certificate validity expires, using public keys to determine and authenticate network addresses, and managing key and certificate transitions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a device uses a single network address determined from its public key, then the network address determination is simple and secure, but communication disruptions occur when the digital certificate expires
Solution Approach 1:
The patent applies preliminary action by having devices prepare multiple network addresses (first network address from first public key, second network address from second public key) in advance. When the digital certificate for the first public key expires, the device can switch to the second network address without interruption, as it was already prepared and configured. This resolves the contradiction by ensuring communication continuity while managing multiple addresses through proactive preparation rather than reactive response.
Solution Approach 2:
The patent applies parameter changes by transitioning from a single network address configuration to a multi-network address configuration. The device changes the parameter of network address availability from one address to multiple addresses (first network address and second network address), allowing it to adapt when the certificate for the first address expires. This parameter change enables the device to maintain reliable communication while the system manages the increased complexity through structured address management mechanisms.
2Reliability
If a device has multiple network addresses and public keys, then communication continuity is maintained during certificate expiration, but the device must manage multiple keys and addresses
Solution Approach 1:
The patent applies self-service by implementing automated mechanisms that reduce manual key and address management. When the first digital certificate expires, the system automatically notifies the communication partner (second device) and enables automatic switching to the second network address. The device also automatically determines and notifies alternative addresses, eliminating the need for manual intervention in key and address management while maintaining communication continuity.
Solution Approach 2:
The patent applies feedback by implementing notification mechanisms where the first device informs the second device about the expiration of the first digital certificate and the availability of the second network address. This feedback loop ensures that communication partners are aware of the certificate status and can update their routing tables accordingly, simplifying the management process by automating information sharing between devices.
3Reliability
If the system automatically notifies communication partners of certificate expiration, then seamless switching is enabled, but additional notification processing is required
Solution Approach 1:
The patent applies preliminary action by having the first device prepare and store the second network address and second public key in advance, along with configuring the notification mechanism. When certificate expiration occurs, the pre-configured notification system automatically activates, reducing the complexity of real-time processing. The system has already prepared the necessary information and pathways for seamless switching, so the actual notification and transition process is streamlined rather than complex.
Data Source
AI summary
A network system includes a plurality of devices. Each of the plurality of devices includes: a communication unit for performing data communication with another device; and a determination unit that determines a network address of another device based on a public key received from another device. The first device has a first public key and a second public key, and is configured to be able to respond to both an access designating a first network address determined based on the first public key and an access designating a second network address determined based on the second public key.