Certificate Revocation List Extensions for Selective Certificate Revocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing certificate revocation methods lack flexibility in determining the validity of electronic certificates, particularly in scenarios involving multi-certificates with common serial numbers, leading to the unintended revocation of both classical and post-quantum cryptography certificates.
Innovation Solution
A revocation determination method that utilizes extension regions in the certificate revocation list (CRL) to identify electronic certificates by referencing serial numbers and condition information items, allowing for more precise determination of validity or invalidity based on specific criteria such as signature algorithms and reasons for revocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If certificate revocation is determined only by serial number matching in the CRL, then the verification process is simple and fast, but it lacks flexibility and causes unintended revocation of multiple certificates with common serial numbers
Solution Approach 1:
The patent segments the certificate identification process by dividing the identification criteria into multiple components: serial number, signature algorithm type, and other distinguishing features. This segmentation allows the system to move from a single coarse-grained identifier (serial number only) to multiple fine-grained identifiers, enabling selective revocation of specific certificates while maintaining others with the same serial number.
Solution Approach 2:
The patent applies local quality by making the revocation determination process certificate-specific rather than blanket. By incorporating signature algorithm type and other distinguishing features into the matching criteria, the system can apply different revocation rules to different certificates based on their specific characteristics, even when they share the same serial number.
2Adaptability or versatility
If extension regions with condition information items are added to the CRL, then flexibility in certificate validity determination is improved, but the data structure and processing complexity increase
Solution Approach 1:
The patent makes the CRL data structure universal by designing extension regions that can accommodate multiple types of condition information items. Rather than creating separate structures for different revocation scenarios, the extension regions provide a flexible framework that can handle various conditions (signature algorithm type, key usage, etc.) within a unified structure, reducing overall system complexity.
Solution Approach 2:
The patent adds another dimension to the CRL data structure by incorporating extension regions that provide additional attributes beyond the basic serial number. This dimensional expansion transforms the CRL from a simple list of serial numbers to a multi-attribute structure, enabling more nuanced revocation decisions without fundamentally redesigning the entire system.
3Measurement precision
If multiple condition information items are used to determine certificate validity, then precision in identifying specific certificates is improved, but the determination process becomes more complex
Solution Approach 1:
The patent introduces dynamics into the revocation determination process by making the matching criteria adaptable. The system can dynamically adjust which condition information items are applied based on the certificate type and revocation context. This dynamic approach allows the system to maintain high precision when needed while simplifying the process when fewer distinctions are necessary.
Data Source
AI summary
A revocation determination method involves acquiring an electronic certificate, acquiring a certificate revocation list including one or more invalid certificates that are revoked electronic certificate, and determining, based on a serial number and one or more condition information items, whether the acquired electronic certificate is valid or invalid, the serial number being included in the acquired certificate revocation list, the one or more condition information items being indicated in one or more extension regions included in the acquired certificate revocation list.