Root Certificate Verification in Service Handshake Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mechanisms for authenticating applications to access services offered by service entities, such as print devices, are complex, resource-intensive, and cumbersome, involving multiple hashing and digital signature generations, which complicates the process of controlling which applications can utilize these services.
Innovation Solution
The proposed solution involves an initial registration phase where applications create a private-public key pair, generate a self-signed root certificate, and obtain a client certificate, which is then used for authentication during a handshake session adhering to security protocols like TLS or SSL, allowing only whitelisted applications to access services by verifying the presence of the corresponding root certificate at the service entity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication mechanisms are used for applications to access services, then security control is achieved, but the authentication process becomes complex and resource-intensive
Solution Approach 1:
The patent merges the authentication process with the existing service access handshake session. Instead of implementing separate authentication steps, the solution integrates certificate verification into the normal service request flow, allowing security control to be achieved without adding complex separate authentication procedures. The service entity verifies the application's certificate during the handshake session, combining security verification with routine access control.
2Ease of manufacture
If multiple hashing and digital signature generations are implemented for authentication, then application authorization is controlled, but the authentication process becomes cumbersome
Solution Approach 1:
The patent implements preliminary action by having applications obtain certificates during the installation phase from trusted sources. This pre-authentication approach means that when the application accesses services, the verification is already in place through the installed certificate, eliminating the need for complex real-time authentication operations. The certificate is prepared in advance and automatically presented during service access.
3Productivity
If certificate verification is performed during handshake session, then authentication steps are reduced, but security vulnerability risks increase
Solution Approach 1:
The patent uses trusted certificate authorities as intermediaries to vouch for application identities. Instead of direct verification between service entities and applications, the certificate authority acts as a trusted mediator that has already validated the application's credentials. This intermediary approach maintains security by relying on pre-validated certificates while simplifying the authentication process during service access.
Data Source
AI summary
Examples for authenticating applications to allow access to a service being offered by a service entity, are described. In one example, a request from an application for accessing services is received over a handshake session adhering to a security protocol. It is determined whether a root certificate corresponding to the application is installed in the service entity. Based on the determination, the request is authenticated to allow access to the services. The authenticating is performed in the handshake session.