Secure Element Certificate Caching for Faster Trusted Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure elements in transaction systems face challenges in maintaining security and reliability while managing longer certificate chains and complex certification schemes, often leading to increased transaction times and resource demands.
Innovation Solution
Implementing a secure element with dynamic verification data that stores certificate references and verified data elements in a non-volatile memory, allowing for selective verification and reducing the need for repeated certificate checks, thereby enhancing security and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate chains are lengthened and certification schemes are made more complex to improve security, then security level is improved, but transaction time and resource consumption increase
Solution Approach 1:
The secure element performs certificate verification in advance during transaction setup, storing the verified results. During the actual transaction, the pre-verified certificates are reused, eliminating the need for repeated verification and thus reducing transaction time while maintaining security
Solution Approach 2:
The verification result (verified public key) is copied and stored in the secure element's memory. Instead of重新 verifying certificates in each transaction, the system uses this copied verified data, significantly reducing the computational overhead and time for subsequent transactions
2Reliability
If certificate chains are lengthened and certification schemes are made more complex to improve security, then security level is improved, but resource consumption increases
Solution Approach 1:
The computationally intensive certificate verification is performed once in advance, before the actual transaction. This preliminary verification consumes resources upfront, but the results are cached and reused, dramatically reducing resource consumption during the frequent actual transactions
Solution Approach 2:
The secure element autonomously manages the verification data storage and retrieval internally. The device serves itself by maintaining a cache of verified certificates and automatically using them without requiring external verification resources, reducing overall system resource consumption
3Reliability
If multiple certificates are verified in certificate chains to improve security, then security level is improved, but device complexity increases
Solution Approach 1:
The complex certificate chain verification process is extracted and separated from the main transaction flow. The verification is performed as a distinct preliminary step, and only the essential verified result (public key) is retained for use in transactions, simplifying the overall system architecture
Solution Approach 2:
The verified public key acts as an intermediary between the complex certificate chain and the simple transaction authentication process. Instead of dealing with multiple certificates directly during transactions, the system uses this single verified public key as a mediator, greatly simplifying the verification process
Data Source
AI summary
A secure element of a transaction system includes multiple transaction partners. The secure element includes a communication unit configured to receive at least one certificate from a current transaction partner; a certificate verification unit set up to verify the received certificate and to generate a verified data element, where the verification unit uses verification data stored in a non-volatile memory of the secure element; and a transaction unit that uses the verified data element provided by the certificate verification unit in a current transaction within the system. The verification data stored in the non-volatile memory includes dynamic verification data. This dynamic verification data includes at least two records of previous transactions conducted by the secure element in the system. These records are stored in the non-volatile memory and each contain a certificate reference of at least one previous certificate received and verified in earlier transactions.