Certificate Revocation List Processing via Stream Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The generation and processing of certificate revocation lists (CRLs) are memory-intensive and time-consuming, leading to unacceptable delays in secure transaction processing due to the need to load and modify large in-memory structures and digital signatures.
Innovation Solution
A method that processes CRLs by identifying and applying modifications through sequential streams, eliminating the need to load all entries into memory and re-encode each entry, thereby reducing memory and processing requirements by streaming modified header, entries, and trailer portions with a new digital signature.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If all CRL entries are loaded into memory to build an in-memory data structure for rapid searching, then search speed is improved, but memory consumption increases significantly
Solution Approach 1:
The patent divides the CRL processing into two distinct passes: a first pass to determine the length difference, and a second pass to generate the modified CRL. This segmentation allows the system to process the CRL stream without loading all entries into memory simultaneously, thus reducing memory consumption while maintaining processing efficiency.
Solution Approach 2:
The patent performs preliminary actions by first calculating the length difference in a separate first pass before generating the modified CRL. This preliminary determination of the length difference allows the system to allocate appropriate buffer sizes and process the CRL stream efficiently without requiring all entries to be in memory at once.
2Reliability
If the entire CRL is processed by a signature algorithm to generate a digital signature, then certificate authentication is ensured, but processing time increases significantly
Solution Approach 1:
The patent segments the CRL modification process into distinct phases: identifying modifications, determining length difference, and generating the new digital signature only for the modified portions. This segmentation reduces the amount of data that needs to be processed by the signature algorithm compared to re-signing the entire CRL, thus reducing processing time while maintaining authentication reliability.
Solution Approach 2:
The patent extracts and processes only the modified portions of the CRL rather than the entire CRL. By identifying and isolating the specific changes (additions, deletions, or modifications of CRL entries), the system applies the signature algorithm only to the necessary portions, significantly reducing processing time while ensuring the modified CRL remains authenticated.
3Reliability
If modifications are made to the CRL by processing the entire CRL through signature algorithms, then the CRL remains authenticated, but the modification process becomes equally or more time-consuming than reading the CRL
Solution Approach 1:
The patent performs preliminary identification of modifications and calculation of the length difference before generating the new digital signature. This preliminary processing allows the system to prepare the modified CRL data in advance, so that the signature algorithm only needs to process the final modified structure rather than the entire original CRL, significantly improving modification efficiency.
Solution Approach 2:
The patent creates a modified version of the CRL by copying and processing only the necessary portions. Instead of working with the entire CRL structure throughout the modification process, the system copies and processes only the affected entries and their associated metadata, reducing the computational burden of the signature generation process while maintaining authentication integrity.
Data Source
AI summary
Efficient certificate revocation list (CRL) processing is disclosed. A desired modification to an encoded CRL is determined. A computing device sequentially processes, during a first pass, a first CRL stream comprising the CRL to identify a CRL length difference between the CRL and a modified CRL based on the desired modification. The computing device sequentially processes, during a second pass, a second CRL stream comprising the CRL. The computing device, during the second pass, streams a modified encoded header portion to a modified CRL stream that identifies a new length of the modified CRL based on the length difference, streams a modified encoded CRL entries portion comprising a plurality of CRL entries to the modified CRL stream that contains the desired modification, and streams a modified encoded trailer portion to the modified CRL stream that contains a new digital signature based on the desired modification.