CRL Generation Sub-System Offloading CA Load
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The generation of certificate revocation lists (CRLs) is a resource-intensive process for Certificate Authority (CA) systems, consuming significant resources and impacting performance due to the slow and time-consuming nature of database-based generation and the high resource usage of encoding data from the CA's cache.
Innovation Solution
A sub-system with separate resources is used to generate CRLs, offloading the process from the main CA system, utilizing a cache to store and update revocation data, and a CRL manager module to generate CRLs independently, thereby reducing the burden on the CA system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If CRL is generated from database, then data accuracy is ensured, but generation speed is slow and time-consuming
Solution Approach 1:
The patent pre-loads certificate data into a cache memory before CRL generation is needed. This preliminary action stores frequently accessed certificate data in a faster storage medium, so when CRL generation is required, the system can quickly retrieve data from the cache rather than querying the slow database, thus improving generation speed while maintaining data accuracy through controlled updates.
Solution Approach 2:
The patent introduces a cache memory as an intermediary between the database and the CRL generation process. This intermediary layer holds copies of certificate data, allowing the generation process to access data quickly without directly querying the database. The cache acts as a buffer that mediates between the need for fast access and the need for accurate, up-to-date data from the database.
2Speed
If CRL is generated from CA cache, then generation speed is improved (100 times faster), but resource consumption of CA sub-system increases significantly
Solution Approach 1:
The patent divides the CRL generation function into a separate, dedicated sub-system that is independent from the main CA sub-system. This segmentation allows the CRL generation process to use its own resources (separate cache and processing units) without consuming the main CA sub-system's resources, thus achieving fast generation speed while preventing resource exhaustion of the primary system.
Solution Approach 2:
The patent extracts the CRL generation function from the main CA sub-system and places it in a separate dedicated sub-system. This extraction removes the resource-intensive encoding and generation processes from the main system, allowing the main CA sub-system to focus on certificate issuance and management while the dedicated sub-system handles CRL generation with its own allocated resources.
3Device complexity
If main CA sub-system handles both CRL generation and CA management functions, then system complexity is reduced, but performance of CA sub-system deteriorates due to resource burden
Solution Approach 1:
The patent segments the CA system into functionally independent sub-systems: the main CA sub-system for certificate management and a separate CRL generation sub-system. This functional segmentation improves performance by allowing each sub-system to specialize in its specific tasks without resource contention, while the overall system complexity remains manageable through clear interface definitions and modular architecture.
Data Source
AI summary
A server computing system initiates a first sub-system to generate a certificate revocation list (CRL) using resources that are separate from resources of a second sub-system that performs certificate authority (CA) management functions other than generating a CRL. The first sub-system receives a command from the second sub-system to update revocation data in a cache that is coupled to the first sub-system and generates a CRL using the updated revocation data in the cache. The first sub-system provides the CRL to the second sub-system.