Wireless PKI Key Registration via Hash Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Wireless PKI environments, existing methods for PKI key registration are vulnerable to Man-In-The-Middle attacks and require users to physically visit a certification authority for key generation and registration, which is inconvenient and insecure, especially when pre-generated keys are not registered until needed.
Innovation Solution
A method where a client generates or requests registration of a key pair, using first and second information to form a registration request, with a verifying code determined via hashing, and only the verifying code and public key are sent to the registration server, minimizing data transmission and securing the process against attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the user brings the terminal to the certification authority for key generation and registration, then the registration is reliable and trustworthy, but the process is inconvenient and requires physical presence
Solution Approach 1:
The system enables self-service key registration where the terminal autonomously generates keys and registers them with the certification authority without requiring user physical presence. The terminal performs key generation, hashing, and registration operations locally, then communicates only necessary data (hash code and public key) to the certification authority, allowing remote and convenient registration while maintaining security through cryptographic verification.
2Reliability
If the transmission connection between terminal and certification authority is not secured, then Man-In-The-Middle attacks are possible and identity information can be stolen, but securing the transmission connection is not always possible
Solution Approach 1:
The system extracts and transmits only the essential cryptographic elements (hash code and public key) needed for registration, removing sensitive information such as private keys and personal identity data from the transmission process. This minimization of transmitted data reduces the attack surface and makes the system more resilient to interception, as captured data cannot be used without the corresponding private key.
Solution Approach 2:
The hash code acts as an intermediary that binds the terminal's identity information to its public key without exposing either directly. The certification authority verifies the hash code against stored terminal identifiers to authenticate the registration request, enabling secure verification over potentially insecure channels without requiring complex encryption protocols.
3Reliability
If all key information is transmitted between client and registration server, then complete registration data is provided, but the risk of data interception and system load increase
Solution Approach 1:
The system extracts only the necessary registration elements (hash code and public key) from the complete key information set and transmits them to the certification authority. Sensitive data including private keys, personal identification information, and other non-essential elements are retained locally or discarded, significantly reducing the amount of data exposed to potential interception while maintaining registration functionality.
Data Source
Figure 1A~2
Figure 3~6B
AI summary
The invention relates to method (100a) and system for a secure PKI (Public Key Infrastructure) key registration process in a WPKI (Wireless PKI) environment comprising a registration server and client provided with a key pair. Especially the invention relates to a registration method, where a registration request for a public key of said key pair is formed (110) using second and only part of the first information provided to a client in separated communication connections. The formed registration request comprising the public key is then provided with a verifying code determined (112) over the request to the registration server in order to register said public key.