Certificate Revocation Shards for Resource-Constrained Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Resource-constrained devices, such as IoT or firmware-based systems, face challenges in certificate revocation validation due to the accumulation of large certificate revocation lists (CRLs) without a trusted real-time clock, exceeding their processing and memory capabilities.
Innovation Solution
A certificate revocation architecture that partitions revocation data into fixed-maximum-size shards using issuance time as a grouping criterion, enabling verification without a complete revocation list, facilitated by a broker and verifier interaction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a complete certificate revocation list is maintained for secure certificate validation, then certificate security is improved, but memory and processing requirements exceed the capabilities of resource-constrained devices
Solution Approach 1:
The patent divides the complete certificate revocation list into multiple shards, each containing a subset of revoked certificate identifiers. Instead of maintaining the entire CRL in memory, resource-constrained devices only need to store and process relevant shards, dramatically reducing memory and processing requirements while maintaining security through selective validation.
2Measurement precision
If a trusted real-time clock is implemented for accurate certificate validation, then validation accuracy is improved, but device complexity and resource requirements increase beyond constraints
Solution Approach 1:
The patent extracts the time-trust functionality from the resource-constrained device and relocates it to a trusted broker or server. The broker maintains accurate time information and uses it to determine which certificate shards are relevant, allowing the device to operate without a trusted real-time clock while still achieving accurate validation through the broker's time-based shard selection.
3Adaptability or versatility
If offline operation is supported for bandwidth-limited scenarios, then operational flexibility is improved, but access to complete revocation information is limited
Solution Approach 1:
The patent performs preliminary actions by pre-computing and distributing multiple certificate shards beforehand to resource-constrained devices during initial provisioning or periodic updates. This allows the devices to operate offline for extended periods, performing certificate validation using the pre-loaded shards without needing continuous network access, while still maintaining access to comprehensive revocation information across the full set of shards.
Data Source
AI summary
It is provided an apparatus comprising interface circuitry, machine-readable instructions, and processing circuitry to execute the machine-readable instructions. The machine-readable instructions include instructions to issue a certificate, wherein the certificate is configured to authenticate an identity of a requester to a verifier. The machine-readable instructions further include instructions to obtain revocation data comprising identifiers of previously issued certificates that have been revoked. The machine-readable instructions further include instructions to generate a plurality of revocation data shards based on the revocation data, each revocation data shard covering a respective issuance time range and comprising identifiers of revoked certificates issued within that respective time range. The machine-readable instructions further include instructions to provide the plurality of revocation data shards to a broker configured to perform communication between the requester and the verifier.