Centralized Digital Certificate Revocation Service
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Clients face cumbersome and delayed processes when verifying digital certificate revocations due to the need to maintain and regularly update local revocation lists from multiple certificate authorities, which can lead to honoring revoked certificates until the lists are updated.
Innovation Solution
A centralized service that allows clients to query for revocation status in real-time by connecting to multiple revocation information repositories through providers, eliminating the need for local lists and enabling easy addition of new repositories.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If clients maintain local revocation lists from multiple certificate authorities, then they can verify certificate revocation status, but the process becomes cumbersome and delayed requiring regular updates
Solution Approach 1:
The patent introduces a centralized revocation service as an intermediary between clients and multiple certificate authorities. This service maintains connections to multiple CAs and provides revocation status information to clients on demand, eliminating the need for clients to directly manage local revocation lists from multiple CAs. The intermediary handles the complexity of accessing multiple CA revocation databases while providing simple query interfaces to clients.
Solution Approach 2:
The revocation service is designed to serve multiple certificate authorities through a single unified interface. Instead of requiring clients to maintain separate revocation lists for each CA, the service provides universal access to revocation information from multiple CAs through one service point, reducing the complexity of managing multiple independent revocation verification processes.
2Reliability
If clients use local revocation lists, then they can determine certificate revocation status, but latency increases until lists are updated
Solution Approach 1:
The revocation service implements a feedback mechanism where clients can query the current revocation status of certificates in real-time. The service maintains continuous connections to CA revocation databases and provides up-to-date information immediately upon query, eliminating the latency associated with periodic local list updates. This feedback approach ensures clients always have current revocation information without requiring manual list refreshing.
Solution Approach 2:
The system transitions from static local revocation lists that require periodic updates to a dynamic query-based approach. Clients can request current revocation status information on-demand from the service, which fetches the latest information from CA databases in real-time. This dynamic approach eliminates the fixed update cycles of local lists and provides immediate access to current revocation data.
3Adaptability or versatility
If clients manage revocation lists from multiple CAs, then they can verify all certificate types, but administrative burden increases
Solution Approach 1:
The revocation service acts as an intermediary that handles the administrative burden of managing multiple CA revocation lists. The service maintains the complexity of connecting to and querying multiple CA databases internally, while presenting a simplified interface to clients. This eliminates the need for clients to perform administrative tasks such as updating and synchronizing multiple local revocation lists from different CAs.
Solution Approach 2:
The patent merges the functionality of managing revocation lists from multiple different CAs into a single unified service. Instead of requiring clients to maintain separate revocation lists for each CA, the service combines access to multiple CA revocation databases into one consolidated interface, simplifying the administrative task of managing revocation information across multiple certificate authorities.
Data Source
AI summary
A revocation determination service determines for a client whether a particular digital certificate as issued by a particular certificate authority (CA) has been revoked by such CA. In the service, an engine receives a query from the client, where the query identifies the particular certificate and the CA that issued the particular certificate. At least one provider is resident at the service, where each provider corresponds to a revocation information repository and represents the corresponding repository at the service, and connects to the corresponding repository. Each repository has revocation information from at least one CA. A configuration store includes a configuration information record corresponding to each provider resident at the service. Each configuration information record includes an identification of the provider and of each CA that the repository corresponding to such provider has revocation information for.