Security Token Storage Reduction via Certificate Identity Extraction

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In complex computer systems, security tokens face storage limitations due to the need to store multiple certificates and private keys, exceeding the capacity of typical 5K byte tokens, which is undesirable for cost and security reasons, especially in large enterprises.

Innovation Solution

Implementing a method to store only a portion of a security certificate, such as an identity reference like an issuer name and serial number, to index and retrieve the private key identifier, reducing the storage size requirements and eliminating the need for full certificate storage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If full security certificates are stored on tokens, then security verification can be performed, but storage capacity is exceeded

Engineering Contradiction:

Improvesecurity verificationVSAvoidstorage capacity

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent extracts only the essential identity portion (issuer name and serial number) from the full security certificate, storing only this extracted subset on the token while keeping the complete certificate on external storage media. This extraction principle resolves the contradiction by retaining sufficient information for security verification while dramatically reducing storage requirements.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent segments the security certificate into two parts: the identity portion stored on the token and the complete certificate stored externally. This segmentation allows the system to distribute storage responsibilities, placing only critical identification data on the token while maintaining full certificate availability for verification purposes.

Inventive Principle:

Principle #1Segmentation

2Adaptability or versatility

If multiple certificates and private keys are stored on tokens, then security for multiple connections is enabled, but token size must be increased

Engineering Contradiction:

Improvesecurity for multiple connectionsVSAvoidtoken size

Core Design Contradiction:

Adaptability or versatilityVSVolume of stationary object

Solution Approach 1:

The patent extracts only the identity portion from each certificate needed for multiple connections, storing these compact identifiers on the token while maintaining full certificate storage externally. This enables support for multiple connections and certificates without proportionally increasing token size.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent moves the storage of complete certificates from the token dimension to an external storage dimension, allowing the token to remain compact while still supporting multiple certificates through external association. This dimensional shift resolves the conflict between supporting multiple connections and maintaining small token size.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

3Ease of operation

If full certificates are stored on tokens, then certificate verification is straightforward, but storage costs increase

Engineering Contradiction:

Improvecertificate verificationVSAvoidstorage costs

Core Design Contradiction:

Ease of operationVSQuantity of substance

Solution Approach 1:

The patent extracts the essential verification elements (issuer name and serial number) onto the token, enabling efficient verification operations. The complete certificate remains stored externally where it can be retrieved when needed for full verification, thus maintaining ease of operation while minimizing token storage requirements and associated costs.

Inventive Principle:

Principle #2Taking out (Extraction)

4Quantity of substance

If identity portion only is stored on token, then storage size is reduced, but retrieval process requires additional steps

Engineering Contradiction:

Improvestorage sizeVSAvoidretrieval process

Core Design Contradiction:

Quantity of substanceVSLoss of time

Solution Approach 1:

The patent performs preliminary action by pre-storing the identity portion (issuer name and serial number) on the token before verification is needed. This allows the system to quickly retrieve the relevant certificate from external storage using the pre-stored identity as a key, thereby minimizing retrieval time despite the two-step process.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The identity portion stored on the token serves as an intermediary that bridges the gap between the token's limited storage and the external certificate repository. This intermediary enables efficient lookup and retrieval of complete certificates without requiring the token to store all certificate data, thus balancing storage size reduction with acceptable retrieval performance.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS8813243B2Reducing a size of a security-related data object stored on a token

Publication Date: 2014.08.19 RED HAT INC

AI summary

Embodiments of the present invention provide a method and system, including a client and security token, for reducing a size of a security-related object stored in the token. The object is stored in a storage structure that is indexed according to an identity reference to a certificate associated with the object and a private key identifier identifying a private key assigned to an owner of the token. A request to access an encrypted data object results in accessing the private key identifier in the storage structure using only the identity reference as an index.