Information Security Device for Secure Key Pair Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for generating key pairs and transmitting public keys or request files in PKI systems are insecure, as they do not adequately protect against key theft or replacement during the client-side generation and network transmission, particularly due to vulnerabilities in non-secured environments.
Innovation Solution
A method involving an information security device that generates a key pair with a non-exportable private key, creates authentication information for the public key, and transmits this information along with the public key to ensure verification and prevent tampering, using either asymmetric or symmetric algorithms, ensuring the security of key pair generation and transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If key pair generation is performed on the client side, then convenience and speed are improved, but security deteriorates due to potential key theft or replacement by hackers
Solution Approach 1:
The patent extracts the private key generation and storage process from the general client environment into a dedicated information security device. This separation isolates the sensitive key generation operations from potentially compromised client systems, allowing convenient key pair generation while ensuring private key security through dedicated hardware protection.
Solution Approach 2:
The information security device acts as an intermediary between the user and the PKI system. It mediates the key pair generation process by providing a secure environment for private key creation and storage, while still allowing public key extraction and certificate request generation, thus balancing convenience and security.
2Productivity
If public key and request file are transmitted over the network, then certificate issuance process is completed, but security deteriorates due to potential interception and replacement by hackers
Solution Approach 1:
The patent applies preliminary anti-action by having the information security device sign the request file with the private key before transmission. This pre-signing creates a cryptographic binding that prevents hackers from intercepting and replacing the request file or public key, as any modification would invalidate the signature. The security measure is applied in advance to counter potential network attacks.
Solution Approach 2:
The information security device performs preliminary actions by generating authentication information for the public key and signing the request file before they leave the secure environment. This ensures that when the data is transmitted over the network, it already contains cryptographic proof of its authenticity, enabling the CA to verify integrity without requiring additional secure transmission mechanisms.
Data Source
AI summary
A method for generating a key pair and transmitting a public key or request file of a certificate in security is provided. Usually, when a user applies for a certificate, a public-private key pair is always generated by a client side; the public key is combined with the user information to form the certificate; the CA's signature enables validity of user's certificate. However, in other cases, the client side is not a perfectly secure environment, so the private key of the user generated from the client side may be filched by a hacker, or may be replaced by a forged public key. On this occasion, the hacker can disguise the user without being detected. The method of the present invention is to use an information security device to generate a public-private key pair, the private key is saved within the information security device; the public key can be exported; and the information security device can generate authentication information for verifying the public key. The CA can determine whether the public key is generated by the information security device or not by verifying the authentication information. By the method provided by the present invention, the security of online transactions can be ensured effectively.