Secure Messaging Component Centralized Certificate Signing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In secure messaging environments, the existing use of digital certificates requires each participant to have their own certificate and private key, leading to high costs, administrative overhead, and resource burdens, especially when dealing with a large number of potential recipients, which can compromise the security and efficiency of message distribution.

Innovation Solution

Implementing a secure messaging component that uses a single or shared secured digital certificate with an associated private key to digitally sign and encrypt messages on behalf of users, reducing the need for individual user certificates and keys, and allowing encryption and decryption to be performed centrally for multiple recipients.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If each participant has their own digital certificate and private key, then message authentication and encryption are enabled, but costs and administrative overhead increase significantly

Engineering Contradiction:

Improvemessage authenticationVSAvoidcertificate management

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

Multiple user certificates are merged into a single secured digital certificate that is stored and managed by the secure messaging component. This consolidation eliminates the need for individual certificate management for each user while maintaining the ability to authenticate and encrypt messages for multiple recipients.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The single secured digital certificate serves multiple functions: it can authenticate and encrypt messages for any number of recipients in the recipient list. The certificate is universally applicable across all messaging operations within the system, replacing the need for multiple specialized certificates.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Reliability

If individual user certificates are used for each recipient, then message security is maintained, but the number of certificates and keys increases leading to resource burdens

Engineering Contradiction:

Improvemessage securityVSAvoidnumber of certificates

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

Instead of maintaining separate certificates for each user, the system merges multiple certificate functions into a single secured digital certificate that is shared and managed by the secure messaging component, dramatically reducing the total number of certificates required.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The single secured digital certificate is copied and used for multiple recipients without creating additional unique certificates. The same certificate instance serves multiple encryption and authentication operations across different recipients.

Inventive Principle:

Principle #26Copying

3Ease of operation

If multiple private keys are distributed to users, then individual message protection is enabled, but security is compromised due to increased access points

Engineering Contradiction:

Improveindividual message protectionVSAvoidsecurity exposure

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The private key is extracted from user control and centralized within the secure messaging component. Users no longer possess or manage private keys directly; instead, the secure messaging component securely holds the private key and performs encryption operations on behalf of users, eliminating security exposure from distributed key management.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The secure messaging component acts as an intermediary between users and the private key. It manages the secured digital certificate and private key, performing encryption and signing operations without exposing the private key to users, thus maintaining security while enabling individual message protection.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Adaptability or versatility

If each user manages their own certificate, then autonomy is maintained, but administrative overhead and costs increase

Engineering Contradiction:

Improveuser autonomyVSAvoidoperational efficiency

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The secure messaging component provides self-service functionality by automatically managing the secured digital certificate, selecting appropriate recipients, and performing encryption operations without requiring manual certificate management from users. This automation maintains operational flexibility while eliminating administrative overhead.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS10178084B2Generalized certificate use in policy-based secure messaging environments

Publication Date: 2019.01.08 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Within a secure messaging environment, a determination is made that a request to send a message has been generated by a message sender. A message protection policy configured to process the message within the secure messaging environment is identified. The message protection policy specifies that, within the secure messaging environment, a secured digital certificate, other than a digital certificate of the message sender, is configured with an associated private key to digitally sign the message on behalf of the message sender. Based upon the message protection policy, a determination is made to digitally sign the message using the private key of the secured digital certificate. The message is signed on behalf of the message sender using the private key of the secured digital certificate.