Certificate Revocation List Compression via Hierarchical Key Trees
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In public key cryptosystems, managing large numbers of certificates issued to entities in networks like Intelligent Transportation Systems leads to unmanageable certificate revocation lists, requiring significant processing resources and potentially compromising privacy when secret values are added.
Innovation Solution
A certificate authority constructs a key tree using a secret value and randomly selected hash functions, generating certificates from leaf nodes, and updates the revocation list by storing derived secret keys and indices, reducing the list size and maintaining privacy by unlinking certificates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a certificate authority issues tens of thousands of certificates to entities in networks like vehicular networks, then the entity can change the certificate in use on a frequent basis to protect privacy or identity, but the certificate revocation list becomes unmanageably large and requires significant processing burden to verify certificates
Solution Approach 1:
The patent divides the large set of certificates into hierarchical groups using a key tree structure. Instead of managing tens of thousands of individual certificates, the system segments them into subsets identified by group keys at different levels of the tree. When revocation is needed, only the relevant group keys need to be updated and included in the CRL, dramatically reducing the list size while maintaining the ability to revoke specific certificates or groups efficiently.
Solution Approach 2:
The patent introduces a hierarchical dimension to certificate management by organizing certificates in a key tree structure with multiple levels. This transforms the flat, one-dimensional CRL approach into a multi-dimensional hierarchy where certificates are grouped by common ancestors. The CRL then operates in this hierarchical space, storing revocation information at appropriate levels rather than listing every individual certificate, thus reducing complexity while preserving verification capability.
2Reliability
If a certificate authority manages a certificate revocation list containing all revoked certificates, then certificate validity can be verified, but the processing burden and resources required increase significantly
Solution Approach 1:
The patent extracts and stores only the essential revocation information at hierarchical levels rather than extracting and storing every individual revoked certificate. By computing and storing group keys and their associated revocation status at each level of the key tree, the system extracts the minimum necessary information needed for verification. This allows verifying entities to check certificate validity by traversing the hierarchical structure and checking only the relevant group keys, significantly reducing processing burden while maintaining reliable verification.
3Loss of energy
If a certificate authority groups certificates into subsets and uses global validity notification, then resources needed for notification are reduced, but if even just one certificate within a subset is revoked, the global validity notification cannot be used and plurality of notifications must be used
Solution Approach 1:
The patent performs preliminary organization of certificates into a key tree structure with pre-computed group keys at each level before any revocation occurs. This preliminary hierarchical arrangement enables efficient revocation handling by allowing the system to quickly identify which group keys need updating when a certificate is revoked. The pre-established hierarchy allows the system to maintain global validity notifications at appropriate levels, only breaking them down to finer granularity when actually needed, thus reducing overall notification resources while managing complexity through the pre-organized structure.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Apparatuses and methods for certificate generation, certificate revocation and certificate verification are provided. The certificate generation and revocation apparatus includes: a key set computation unit receiving a secret value and a hash function set and generating a key set of an entity; a hash function unit generating the hash function set; a certificate generation unit generating certificates corresponding to the public/private key pairs and the key set; a certificate revocation unit acquiring derived secret key corresponding to a revoked certificate set and updating a certificate revocation list; and a certificate revocation list broadcast unit broadcasting the certificate revocation list; wherein the secret value corresponds to a root of a key tree, wherein the key set is generated by leaves of the key tree, wherein each node of the key tree is generated by a randomly selected hash function.