Dynamic Certificate Update Without Session Termination

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network communication systems face challenges in updating certificate revocation lists (CRLs) without terminating existing secure communication sessions, which limits flexibility and productivity.

Innovation Solution

Implementing an SSL emulation environment that allows for the mapping of multiple APIs within the network stack, enabling the creation of a second context for updating CRLs during active sessions, ensuring that communication sessions are not interrupted.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the computing device updates certificate lists and CRLs in files or databases, then the certificate information is refreshed, but all current network communication sessions are terminated

Engineering Contradiction:

Improvecertificate information validityVSAvoidnetwork communication continuity

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent segments the certificate validation process by maintaining separate contexts for different communication sessions. Each session can have its own context with its own certificate information, allowing selective updating without affecting all sessions. The system divides the monolithic certificate store into session-specific contexts that can be independently managed.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements dynamic context switching where the computing device can transition between different contexts during runtime. When a CRL update is received, the system dynamically creates a new context with the updated certificate information and switches active sessions to this new context, rather than forcing a static update that terminates all sessions.

Inventive Principle:

Principle #15Dynamics

2Reliability

If the computing device terminates current network communication sessions to update certificate information, then the certificate revocation list is updated, but user control over update timing is lost

Engineering Contradiction:

Improvecertificate revocation list accuracyVSAvoiduser control over update timing

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent implements preliminary action by receiving and storing the updated CRL in advance, creating a new context with the updated information before any sessions need to be updated. This allows the system to prepare the updated certificate information ready for immediate use, giving administrators control over when updates are applied without forcing immediate session termination.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements self-service by automatically managing context transitions when CRL updates are received. The computing device autonomously creates new contexts, updates certificate information, and manages session transitions without requiring manual intervention or forcing session terminations, thereby maintaining both reliability and user control.

Inventive Principle:

Principle #25Self-service

3Adaptability or versatility

If multiple API versions are mapped in the network stack, then compatibility with different software applications is improved, but system complexity increases

Engineering Contradiction:

ImproveAPI version compatibilityVSAvoidemulation environment structure

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent introduces an emulation environment as an intermediary layer between the operating system's native SSL/TLS implementation and applications requiring different API versions. This intermediary translates and adapts API calls between different versions, providing compatibility without requiring multiple independent implementations, thus managing complexity while maintaining versatility.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The emulation environment is designed to be universal, capable of supporting multiple API versions and SSL/TLS protocol variations through a single unified implementation. This multi-functional approach allows the system to handle diverse application requirements without proportionally increasing complexity, as the emulation layer provides a consistent interface that adapts to different needs.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS8032742B2Dynamic updating of trusted certificates and certificate revocation lists in a computing system

Publication Date: 2011.10.04 UNISYS CORP

AI summary

This application generally describes techniques for dynamically updating trusted certificates and CRLs, generally referred to herein as certificate information. That is, techniques are described for updating trusted certificates and CRLs without terminating existing communication sessions. An exemplary method includes the steps of receiving an initial configuration that includes a trusted certificate authority, receiving certificate information that includes a certificate revocation list (CRL) and a first certificate from the trusted certificate authority, storing the certificate information in the configuration, initiating a communication session for an application, receiving an update to the certificate information, and updating the configuration to reflect the update to the certificate information without terminating the communication session. A computing device may receive the update to the certificate information from a user, as well as receiving a command from the user to apply the update to the certificate information to current communication sessions.