Certificate Revocation List Compression for Embedded Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in managing large data sizes of certificate revocation lists (CRLs), particularly in embedded devices with limited storage capacity, which can hinder the efficient verification of revoked certificates.
Innovation Solution
The system employs a management device to generate and transmit a CRL that consolidates consecutive serial numbers into a reduced data format, allowing efficient storage and verification of revoked server certificates using a root certificate, thereby reducing the overall data size of the CRL.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If consecutive serial numbers are recorded individually in the revocation list, then the completeness of revocation information is improved, but the data size of the revocation list increases
Solution Approach 1:
The patent merges consecutive serial numbers into a single recorded entry by storing only the first and last serial numbers of a consecutive sequence, along with a flag indicating consecutiveness. This combining approach reduces the number of individual records while maintaining the ability to identify all revoked certificates in the sequence, thereby reducing data size without compromising revocation information completeness.
Solution Approach 2:
The patent changes the representation parameter of serial numbers from individual discrete entries to a compressed format that groups consecutive numbers. By introducing a consecutiveness flag and storing only boundary values (first and last serial numbers), the system transforms the data structure to achieve compact representation while preserving the full revocation information for the entire consecutive sequence.
2Quantity of substance
If the data size of the revocation list is reduced, then the storage capacity requirement is improved, but the verification efficiency may deteriorate
Solution Approach 1:
The patent segments the revocation list into two distinct types of entries: individual serial number records and consecutive serial number records (marked with a flag). This segmentation allows the system to efficiently differentiate between single revoked certificates and ranges of consecutive revoked certificates during verification, enabling optimized search and comparison operations that maintain high verification efficiency despite the compressed format.
Solution Approach 2:
The patent creates a compressed copy of the revocation list that represents consecutive serial numbers through a condensed format (first serial number, last serial number, and consecutiveness flag) rather than storing each number individually. This copying approach preserves all necessary verification information while significantly reducing the data volume, thus maintaining verification efficiency with smaller data structures.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An information processing system (10) includes: an information terminal (20); a management device (30); and a control device (50). The management device (30) includes: an information processor (32) that issues a server certificate to the information terminal (20), and generates a CRL that is a list of a serial number of a revoked server certificate; and a communicator (31) that transmits the server certificate issued to the information terminal (20), and transmits the revocation list generated to the control device (50). The information processor (32) performs a first process of recording, in a predetermined form, consecutive serial numbers in the CRL to reduce a data size of the CRL compared to when the consecutive serial numbers are recorded individually.