TLS Authentication Using Verifiable Credentials and VP Proofs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Transport Layer Security (TLS) protocols rely on X.509 certificates for authentication, which are inflexible and require extensions for additional information, limiting decision-making during authentication.
Innovation Solution
Integrate Verifiable Credentials (VC) with TLS to provide a more flexible approach for adding additional information, allowing issuers to include any relevant data in VCs without modifying the TLS protocol, and use VC, presentation metadata, and VP proof for authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If X.509 certificates are used for TLS authentication, then authentication security is maintained, but flexibility for adding additional information is limited
Solution Approach 1:
The patent segments the authentication information into two distinct parts: the traditional X.509 certificate containing basic identity verification data, and a separate Verifiable Credential (VC) containing additional flexible information. This segmentation allows each component to serve its specific purpose without forcing modifications to the rigid X.509 structure, thereby improving flexibility while maintaining certification security.
Solution Approach 2:
The patent introduces Verifiable Credentials as an intermediary component that bridges the gap between traditional X.509 certificate authentication and the need for flexible additional information. The VC acts as a mediator that carries supplementary data (such as device capabilities, service subscriptions, or contextual information) without interfering with the established TLS handshake protocol, thus resolving the contradiction between maintaining security and adding flexibility.
2Loss of information
If extensions are added to X.509 certificates for additional information, then authentication decision-making is improved, but certificate complexity and incompatibility increase
Solution Approach 1:
The patent extracts the additional authentication information from the X.509 certificate structure and places it into separate Verifiable Credential objects. This extraction prevents the certificate from becoming overly complex or incompatible with existing systems, while still making the additional information available for authentication decision-making. The VC can be independently verified and does not require modifying the established X.509 format.
Solution Approach 2:
The Verifiable Credential is designed as a universal container that can hold various types of additional information (device capabilities, service subscriptions, contextual data, etc.) without requiring different certificate formats. This multi-functional approach allows a single VC structure to serve multiple authentication scenarios, improving adaptability while maintaining compatibility with the existing TLS framework.
3Adaptability or versatility
If new credential types are supported in TLS, then authentication versatility is improved, but protocol complexity increases
Solution Approach 1:
The patent implements a dynamic credential type indication mechanism where the TLS client and server can negotiate and indicate support for different credential types (X.509, VC, or combinations) during the handshake process. This dynamic approach allows the protocol to adapt to different credential types without requiring rigid pre-definition of all possible types, thereby improving versatility while controlling protocol complexity through flexible, on-demand negotiation.
Data Source
AI summary
Methods and devices for supporting authentication of a first Transport Layer Security (TLS) device, wherein a second TLS device receives from the first TLS device a message indicative of the credential type that the first TLS devices will provide to be authenticated, i.e., Verifiable Credential (VC)-based certificate. The second TLS device then receives, from the first TLS device, a first VC and a first Verifiable Presentation (VP) proof which the second TLS device uses for authenticating the first TLS device.