Terminal Certificate Provisioning via Secondary-Key Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing methods for configuring digital certificates in C-V2X systems are costly, inflexible, and lack secure implementation, requiring high investment and network modifications, and the Generic Bootstrapping Architecture (GBA) solution is cumbersome and lacks flexibility in security compliance.
Innovation Solution
A method and apparatus for configuring terminal devices that generate and encrypt certificate requests using secondary keys, enabling secure communication with servers without modifying production lines or relying on professional organizations, allowing for 'one-click' digital certificate configuration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If offline digital certificate configuration is used during vehicle production, then security of digital certificates is improved, but manufacturing complexity and investment costs increase significantly
Solution Approach 1:
The terminal device autonomously completes digital certificate configuration by performing authentication with the authentication server, obtaining security parameters, and configuring certificates without external intervention. This eliminates the need for specialized offline production lines and professional security organizations, resolving the contradiction between security and manufacturing complexity.
Solution Approach 2:
The patent replaces the physical/mechanical offline certificate filling process with an automated network-based authentication and configuration system. The terminal device uses network communication to authenticate with the server and automatically receive security parameters, substituting the manual offline process with an automated electronic system that maintains security while reducing complexity.
2Adaptability or versatility
If standard GBA method is used for online certificate configuration, then deployment flexibility is improved, but network operation and maintenance costs increase due to requiring NAF/AP network elements for each CA server
Solution Approach 1:
The authentication server performs multiple functions including authentication, security parameter generation, and certificate configuration delivery in a single unified system. This consolidates what would otherwise require separate NAF/AP network elements for each CA server, reducing network complexity and operation costs while maintaining online configuration flexibility.
Solution Approach 2:
The patent merges the authentication function and certificate configuration function into a single integrated process through the authentication server. Instead of requiring separate GBA authentication and separate certificate provisioning systems, the server combines these functions, eliminating the need for multiple NAF/AP elements and reducing operational overhead.
3Ease of operation
If existing GBA solution is implemented, then online certificate configuration capability is improved, but security compliance flexibility deteriorates as NAF/AP is developed according to communication industry standards that may not comply with C-V2X security requirements
Solution Approach 1:
The authentication server implements security parameters and protocols specifically tailored for C-V2X applications, rather than using generic communication industry standards. This allows the system to maintain online configuration ease while achieving specific C-V2X security compliance through localized security parameter generation and customization.
Solution Approach 2:
The system dynamically generates and configures security parameters specific to C-V2X requirements during the authentication process. The authentication server can adapt security parameters, algorithms, and protocols to match C-V2X security standards, providing both ease of operation and security compliance flexibility through parameter customization.
4Reliability
If digital certificates are configured offline during production, then certificate security is ensured, but time consumption and deployment difficulty increase
Solution Approach 1:
The terminal device performs authentication and obtains security parameters in advance before actual certificate configuration is needed. The authentication server prepares security parameters ahead of time, and the device configures certificates automatically during initial setup or before use, eliminating the need for time-consuming offline production processes while maintaining security.
Data Source
AI summary
A configuration method includes: the terminal device generating a second key on the basis of a first key, and performing encryption and/or integrity protection on a certificate request message on the basis of the second key; and sending a first request message, the first request message comprising the certificate request message encrypted and/or integrity-protected via the second key.