Virtual CCID Interface Expansion for Multi-Certificate PIV
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing PIV applications are limited to supporting a default number of certificates, requiring additional drivers that cause compatibility issues and resource occupancy, complicating the operating process.
Innovation Solution
A method and apparatus that utilize a virtual machine to power up multiple CCID interfaces, manage instruction data caching, and perform USB interruption processes to support an increased number of certificates without additional drivers, simplifying the operating process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If the number of certificates supported by PIV application is increased beyond 4, then more certificates can be supported, but an extra driver is needed to be installed which causes compatibility problem and occupies resource
Solution Approach 1:
The patent divides the certificate handling into two segments: certificates within the first 4 are handled by the default driver, while certificates beyond 4 are handled by a virtual machine that creates additional CCID interfaces. This segmentation allows the system to support multiple certificates without requiring users to install additional drivers manually.
Solution Approach 2:
The patent introduces a virtual machine as an intermediary layer between the host computer and the PIV application. This virtual machine creates virtual CCID interfaces that allow the application to access multiple certificates without requiring additional physical drivers to be installed on the host system.
2Quantity of substance
If the number of certificates supported by PIV application is increased beyond 4, then more certificates can be supported, but resource of the host computer is occupied
Solution Approach 1:
The patent segments resource consumption by having the virtual machine handle only the additional certificates beyond the first 4, rather than requiring the entire system to support all certificates simultaneously through additional drivers. This reduces the overall resource footprint on the host computer.
Solution Approach 2:
The patent creates virtual copies of CCID interfaces through the virtual machine, allowing multiple certificates to be accessed without duplicating the full driver stack for each certificate. The virtual interfaces reuse the existing driver infrastructure while providing access to additional certificates.
3Quantity of substance
If the number of certificates supported by PIV application is increased beyond 4, then more certificates can be supported, but operating process becomes more complicated
Solution Approach 1:
The virtual machine automatically manages the creation and configuration of virtual CCID interfaces for additional certificates without requiring user intervention. The system self-configures to handle certificates beyond the first 4, maintaining operational simplicity for the user.
Solution Approach 2:
The virtual machine provides a universal interface that handles both the default 4 certificates and additional certificates through the same mechanism. Users interact with the system uniformly regardless of how many certificates are loaded, as the virtual machine transparently manages the additional interfaces.
Data Source
AI summary
Method for increasing a number of certificates, in which a data endpoint address is set to be an endpoint address of a Chip/Smart Card Interface Devices (CCID) interface that receives instruction data, so Application Protocol Data Unit (APDU) data used for authentication of a Personal Identity Verification (PIV) application of a key device are obtained and sent to the PIV application. The PIV application calls an Application Programming Interface (API) interface to obtain a CCID interface number, obtains a PIV device certificate number according to a general device certificate number in the APDU data and the CCID interface number, obtains a PIV certificate according to the PIV device certificate number, and operates according to the PIV certificate to obtain operation results returned by a virtual machine of the key device to an upper computer according to the data endpoint address. The method overcomes limitation of the number of certificates.