Centralized Server Authentication for Digital Product Signing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing authentication processes for digitally encoded products face challenges in securing sensitive information, particularly in environments where multiple individuals need access, leading to increased security risks and complex management due to the sharing of private keys and passwords, which can result in unauthorized use and proliferation of sensitive information.
Innovation Solution
A method and system where a client system requests authentication from a server system, which verifies the request and uses stored sensitive information to certify the product's origin, eliminating the need for sharing sensitive information and allowing centralized control and tracking of usage, while supporting unattended authentication processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the private key is shared among multiple persons to enable collaborative authentication, then the accessibility and ease of operation are improved, but the security and reliability deteriorate due to uncontrolled dissemination of sensitive information
Solution Approach 1:
The private key is segmented into multiple separate key fragments distributed to different authorized persons. No single person possesses the complete private key, thereby maintaining security while enabling collaborative access. The key fragments can be reassembled only when needed for authentication operations.
Solution Approach 2:
A secure key management server acts as an intermediary between authorized persons and the authentication process. The server stores the complete private key securely and manages the distribution of key fragments to authorized users, eliminating the need for direct sharing while maintaining accessibility.
2Reliability
If the private key access is controlled strictly to maintain security, then the reliability is improved, but the ease of operation deteriorates due to complex access management and password sharing requirements
Solution Approach 1:
A key management server serves as an intermediary that handles all access control operations. Authorized persons interact with the server rather than directly with the private key, simplifying their操作流程 while the server enforces security policies, manages authentication logs, and controls key fragment distribution.
Solution Approach 2:
The system enables self-service authentication where authorized users can independently request and use key fragments through the key management server without requiring manual password sharing or complex coordination with other users, thereby simplifying operations while maintaining security.
3Reliability
If multiple digital certificates with corresponding private keys are created for different teams, then the control of private key access is improved, but the device complexity and loss of information increase due to proliferation of sensitive information
Solution Approach 1:
Instead of creating multiple complete private keys for different teams, the system segments a single private key into multiple fragments distributed to different teams. This reduces the number of certificates needed while maintaining the ability to control access at the fragment level, thereby reducing complexity and the amount of sensitive information to manage.
Solution Approach 2:
A single private key serves multiple teams and functions through fragment distribution, eliminating the need for separate certificates for each team. The key management server provides universal access control for all authorized users across different departments, reducing the overall number of certificates and simplifying management.
4Ease of operation
If the password for private key access is distributed to all authorized persons, then the ease of operation is improved, but the loss of information increases due to uncontrolled dissemination of sensitive information
Solution Approach 1:
The password is segmented into multiple key fragments distributed to different authorized persons. No single person receives the complete password, preventing uncontrolled dissemination while still enabling access when fragments are reassembled through the key management server. This eliminates the loss of information problem associated with password sharing.
Solution Approach 2:
The key management server acts as an intermediary that receives key fragments from authorized users and reassembles them to access the private key. Users do not need to share or know each other's passwords, as the server mediates the authentication process, thereby preventing the dissemination of sensitive password information while maintaining ease of operation.
Data Source
AI summary
A method and a corresponding system for authenticating software products are proposed. A digital certificate (260) and a corresponding private key (265) required to sign each product are stored on a server computer. Whenever a user needs to sign a product, he/she logs on a client computer and transmits a corresponding request to the server computer. The server computer verifies whether the request has been received from an authorized subject; for example, an address of the client computer and an identifier of the user are compared with a predefined list (245). If the result of the verification is positive, the product is signed and returned to the client computer. For this purpose, a script (250) called on the server computer includes either an instruction passing the access password to a signing tool (255) as a parameter or an instruction causing the signing tool (255) to import the access password from a registry of the server computer.