Certificate Status Caching for Offline Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User devices may be unable to trust the verification of identity certificates when they cannot obtain a Certificate Revocation List (CRL) or query an OCSP responder, leading to potential lockout of authorized users due to wireless network connectivity issues or other access limitations.
Innovation Solution
Implementing a method on user devices to manage identity certificates by storing a status indicator that caches certificate status information, allowing local validation of certificate validity and revocation status, and periodically updating this information even when the device is offline, thereby preventing unauthorized access and ensuring user access to functions and data stores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the user device obtains updated revocation information from a CRL or OCSP responder over a network, then the reliability of certificate verification is improved, but the ease of operation deteriorates due to network connectivity requirements
Solution Approach 1:
The system performs preliminary actions by downloading and caching the Certificate Revocation List (CRL) or OCSP responder responses to local storage before network connectivity is lost. This allows the user device to validate certificates offline using the cached revocation information, eliminating the need for real-time network access during certificate verification.
Solution Approach 2:
The patent introduces an intermediary mechanism (local cache storage) that mediates between the network-based revocation information sources (CRL/OCSP) and the offline certificate validation process. The cached revocation data acts as an intermediary that enables offline verification without direct network connection.
2Ease of operation
If the user device stores and validates certificate status information locally, then the ease of operation is improved by enabling offline access, but the reliability may deteriorate due to potential staleness of cached information
Solution Approach 1:
The system implements dynamic behavior by automatically detecting network connectivity status and adapting its operation accordingly. When network connectivity is available, the system updates the cached revocation information; when connectivity is lost, it switches to offline mode using the cached data. This dynamic adaptation ensures both offline accessibility and up-to-date certificate validation.
Solution Approach 2:
The patent incorporates feedback mechanisms where the system continuously monitors network connectivity status and uses this feedback to determine whether to update cached revocation information or operate in offline mode. The feedback loop ensures that the system maintains the most current revocation data when possible while preserving offline functionality.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for authenticating a user to a user device using two-factor authentication with a certificate. The status of the certificate is stored at the user device such that the stored status is queried during the authentication process. The status is updated as a background operation on the user device on a periodic basis. In the event that the user device fails to obtain updated status information, the frequency at which status update requests are issued by the user device are increased to a predetermined frequency or until a response is received.