Self-Signed Certificate Generation via Password Verifier Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods in computer networks are vulnerable to man-in-the-middle attacks and lack effective user authentication, particularly in ad hoc networks without a central authority, leading to weak security and complex certificate management.
Innovation Solution
A decentralized PKI system that uses a unique password to generate self-signed certificates, securely binding the public key and password through a one-way function, ensuring only the certificate owner can enroll devices and authenticate securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional certificate-based authentication is used, then security against MITM attacks is improved, but device complexity and certificate management burden increase
Solution Approach 1:
The patent extracts the password verification function from the device itself and relocates it to the remote server. The device only stores the password hash, while the server performs the actual verification. This separation removes the need for complex local certificate management on devices while maintaining security against MITM attacks through centralized verification.
Solution Approach 2:
The patent creates a universal authentication mechanism where a single password-based system serves multiple functions: user authentication, device enrollment authorization, and TLS certificate validation. This multi-functional approach eliminates the need for separate certificate management systems while providing comprehensive security across different authentication scenarios.
2Ease of operation
If decentralized certificate generation is implemented, then ease of operation is improved, but reliability may worsen due to lack of central authority
Solution Approach 1:
The patent performs preliminary password hash generation and storage on the server before any device enrollment or authentication occurs. This pre-established trust anchor allows devices to be enrolled and authenticated without requiring a central certificate authority during operation, combining decentralized ease of use with reliable pre-configured verification.
3Ease of operation
If password verification is performed locally on devices, then ease of operation is improved, but security enforcement becomes weak and unreliable
Solution Approach 1:
The patent introduces a remote server as an intermediary that performs the critical password verification function. Instead of devices verifying passwords locally (which is easy but insecure), or requiring full certificate management (which is secure but complex), the server acts as a mediator that centralizes verification while allowing devices to operate with simplified local storage of password hashes.
Data Source
Figure 1~2
Figure 3
AI summary
A device (110, 120) receives (S202) a password from a user, obtains (S204) a public key for a cryptographic algorithm for the device, obtains (S206) a password verifier by applying a one-way function to a combination of a unique identifier, the password and the public key, generates (S208) the certificate comprising the unique identifier, the public key and the password verifier, signs (S21 0) the certificate using a private key corresponding to the public key thereby obtaining a self-signed certificate, and outputs the self-signed certificate. Also provided is the device.