Terminal IP Address Verification via Certificate Authority
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing number of attacks on DNS servers, particularly those using virtual servers with frequently changing IP addresses, compromises the security of data transmission by potentially providing fake IP addresses, leading to insecure communication.
Innovation Solution
A control method where a terminal apparatus requests a certificate from a CT log server, determines the certificate authority, and then obtains the IP address directly from the certificate authority server instead of relying on the DNS server, thereby avoiding obtaining a fake IP address.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS server is used to obtain IP address, then data transmission can be performed, but security is compromised due to potential fake IP addresses from attacks
Solution Approach 1:
The patent introduces a certificate authority (CA) as an intermediary between the terminal apparatus and the DNS server. The CA issues certificates that contain verified IP address information, allowing the terminal to obtain reliable IP addresses through certificate verification rather than direct DNS queries, thus preventing fake IP address attacks while maintaining data transmission capability
Solution Approach 2:
The patent implements preliminary action by having the DNS server or certificate authority pre-verify and pre-store accurate IP address information in certificates before the terminal needs to access the destination server. The terminal then retrieves and verifies these pre-verified IP addresses from certificates, ensuring security before data transmission begins
2Reliability
If DNSSEC is implemented to prevent fake IP addresses, then security is improved, but management costs increase due to signature key management
Solution Approach 1:
The patent extracts the IP address verification function from the DNSSEC signature key management system and relocates it to the certificate authority's certificate issuance process. The CA incorporates verified IP address information directly into certificates during issuance, eliminating the need for terminal apparatuses to manage DNSSEC signature keys while maintaining security against fake IP addresses
Solution Approach 2:
The patent uses certificate copies containing IP address information as alternative to DNSSEC signature key management. Instead of managing cryptographic signature keys for DNSSEC, the system uses copied and verified IP address information embedded in certificates, simplifying the management process while maintaining the ability to prevent fake IP address attacks
Data Source
AI summary
A control method implemented by a computer which is configured to be operated as a terminal apparatus, the control method including: transmitting, from the terminal apparatus to a first management server, a first request for transmission of a certificate of a first server, the first server being one of a plurality of servers, the first management server being configured to manage certificates for the plurality of servers; in response to the transmitting of the first request, receiving the certificate of the first server from the first management server; in response to the receiving of the certificate, determining a certificate authority by using information included in the received certificate, the certificate authority being a server from which the received certificate has been issued; and transmitting, from the terminal apparatus to the determined certificate authority, a second request for transmission of first address information on the first server.