Certificate Revocation List Partitioning for PKI Performance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large Certificate Revocation Lists (CRLs) in public key infrastructures lead to decreased performance due to increased bandwidth and computational resource usage, as all certificates issued by a Certificate Authority (CA) point to a single CRL, resulting in a growing list that burdens verification applications.
Innovation Solution
Implementing a CRL partitioning system where certificates are distributed across multiple partition CRLs, with certificates issued before a certain initial time assigned to a legacy CRL and those issued afterward assigned to specific partition CRLs, allowing for controlled CRL size management without requiring new cryptographic keys or certificates, and using statistical distribution formulas to assign certificates to partition CRLs based on factors like time or serial number.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If all certificates issued by a CA point to a single CRL, then certificate verification is simplified, but the CRL grows large causing decreased performance due to increased bandwidth and computational resource usage
Solution Approach 1:
The patent divides a single large CRL into multiple smaller partitioned CRLs (PCRLs), each containing a subset of revoked certificates. Certificates are assigned to specific PCRLs based on a partitioning function that uses the certificate serial number and a partition count parameter. This segmentation reduces the size of each individual CRL file, improving download speed and verification performance while maintaining the ability to check all revoked certificates across the partitioned set.
2Reliability
If the CRL grows over time to include more revoked certificates, then more certificates can be revoked and tracked, but bandwidth and computational resources required to download and process the CRL increase
Solution Approach 1:
By partitioning the CRL into multiple smaller files, the system maintains the ability to track all revoked certificates (reliability) while reducing the bandwidth and computational resources needed for each individual CRL download and processing operation. The partitioning function distributes certificates across multiple files, so each file is smaller and requires fewer resources to handle.
Solution Approach 2:
The patent introduces a new dimension to CRL organization by using a partitioning function that maps certificate serial numbers to specific partition indices. This creates a multi-dimensional structure where certificates are organized not just by revocation status but also by their partition assignment, enabling efficient distribution across multiple files and reducing the resource burden on any single file.
3Productivity
If certificates are distributed across multiple partition CRLs, then CRL size is controlled and performance is improved, but the system complexity increases with multiple CRL files to manage
Solution Approach 1:
The system segments the CRL into multiple partitioned files organized in a predictable naming convention (e.g., using hash-based partition indices). This segmentation improves performance by reducing file sizes while the systematic organization method keeps management complexity manageable through consistent naming and indexing rules that simplify lookup and maintenance operations.
Data Source
AI summary
Certificates issued by a CA are distributed across multiple CRLs. Each certificate issued by the CA is assigned to a specific CRL, and the address of that CRL is written to the appropriate field of the certificate, such that an authenticating application can subsequently determine if the certificate is revoked. When the CA revokes a specific one of the issued certificates, it determines to which CRL the revoked certificate is assigned, and updates the specific CRL accordingly. In some embodiments, a single one of the multiple CRLs is active for assignment of certificates at any given time, and each certificate issued by the CA is assigned to the currently active CRL. In other embodiments, assignments of issued certificates are distributed between different ones of a pre-determined number of multiple CRLs by applying a statistical distribution formula to each issued certificate to determine a corresponding target CRL.