TLS Authentication Delegation Without CA Key Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The TLS protocol does not account for intermediate entities like content delivery networks (CDNs), leading to security risks and compliance issues due to the sharing of private keys, and the revocation of X.509 certificates is cumbersome and inefficient.
Innovation Solution
A TLS-based authentication method that allows the authentication subject to manage, delegate, and revoke TLS authentication keys without the intervention of a certificate authority, using delegated data and proof data stored on a web server, and verified by a browser.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS communication is performed directly between browser and web server, then data security is improved, but it cannot accommodate intermediate entities like CDN
Solution Approach 1:
The patent introduces delegated proof data as an intermediary mechanism that enables CDN and other intermediate entities to participate in TLS authentication without compromising the end-to-end security. The web server generates delegated proof data that intermediaries can use to verify authentication, allowing them to function as trusted parties while maintaining security.
2Adaptability or versatility
If private keys are shared with CDN for authentication, then adaptability to intermediate entities is improved, but data security deteriorates
Solution Approach 1:
The patent segments the authentication function by separating the private key (held by the web server) from the authentication proof (generated and stored as delegated proof data). This allows the CDN to access and use the delegated proof data for authentication without obtaining the private key, thus maintaining security while enabling CDN support.
3Reliability
If X.509 certificate revocation is performed through certificate authority, then authentication security is maintained, but the process becomes cumbersome and inefficient
Solution Approach 1:
The patent enables the web server to perform certificate revocation self-service by deleting delegated proof data from its storage without requiring certificate authority intervention. This allows rapid revocation of authentication credentials for specific CDNs or intermediaries, significantly improving efficiency while maintaining security through proper deletion of authentication proofs.
Data Source
AI summary
A transport layer security (TLS)-based authentication method according to the present invention includes: receiving, in a web server, a certificate for TLS authentication issued from a certificate authority on a web server; transmitting a delegated request from the web server to a delegated entity; receiving, in the web server, a public key among a public key-private key pair generated by the delegated entity in response to the delegated request; generating, in the web server, delegated data based on the public key; generating, in the web server, delegated proof data of the same version as the delegated data; storing, in the web server, the delegated proof data in a delegated proof data storage; and transmitting the certificate and delegated data from the web server to the delegated entity.