Digital Certificate Pointer to Remote Usage Store
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing and updating digital certificates across multiple systems is cumbersome for Certificate Authorities (CAs) and network services, particularly due to the difficulty in maintaining Certificate Revocation Lists (CRLs) and updating validity ranges, which can lead to inefficiencies in network security.
Innovation Solution
Implementing a remote certificate information store that allows digital certificates to include pointers to external locations for validity and usage information, enabling centralized management and updates without modifying the certificates installed on distributed systems, using a chain of trust and cryptographic signatures for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital certificates include embedded validity range and usage information, then certificate verification is self-contained and reliable, but managing and updating this information across multiple systems becomes cumbersome and complex
Solution Approach 1:
The patent divides the certificate information into two segments: the digital certificate itself (containing only the public key and identity information) and the usage information (validity range, restrictions, etc.) stored separately in a database. This segmentation allows the certificate to remain simple while verification reliability is maintained through separate usage checks.
Solution Approach 2:
The patent introduces an intermediary database system that stores usage information and provides it to verifying systems. This intermediary eliminates the need to embed usage information in each certificate, simplifying certificate management while maintaining verification reliability through the intermediary's centralized control.
2Reliability
If Certificate Revocation Lists (CRL) are maintained to manage revoked certificates, then security is improved by preventing use of revoked certificates, but the CRL becomes large and difficult for both CA and network services to manage
Solution Approach 1:
The patent extracts the revocation status information from the traditional CRL structure and integrates it into the separate usage information database. This allows revocation checking to be performed through the same streamlined mechanism used for validity range checks, eliminating the need to maintain separate large-scale CRL distributions.
Solution Approach 2:
The patent merges the functionality of CRL maintenance with the usage information database. Instead of maintaining separate CRL structures across multiple systems, the revocation status is stored and managed in the same centralized database that holds validity range and usage restrictions, simplifying overall management.
3Reliability
If digital certificates are updated by obtaining new certificates from CA and reinstalling them on multiple systems, then certificate validity is maintained, but the process is time-consuming and reduces productivity
Solution Approach 1:
The patent performs preliminary action by storing all possible usage information (validity ranges, restrictions, revocation status) in the centralized database before they are needed. When updates are required, only the database needs to be modified, not the certificates themselves, allowing rapid updates without time-consuming reinstallation processes.
Solution Approach 2:
The patent uses copying by having verifying systems retrieve usage information from the centralized database rather than embedding it in each certificate. This allows all systems to access updated usage information simultaneously without requiring certificate reissuance or reinstallation, dramatically improving update efficiency.
Data Source
AI summary
Digital certificates include pointers to remote certificate information stores that maintain usage information associated with digital certificates. The pointers provide a mechanism for enabling the remote certificate information stores to be queried for usage information associated with a particular digital certificate. The usage information can be used to determine a validity of the digital certificate.