Grounded Dense Hash Trees for Certificate Revocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current certificate revocation methods, such as CRLs and OCSP, face challenges with scalability, security, and efficiency due to large digital signatures and computational overhead, especially when dealing with numerous requests and long-term key security requirements.
Innovation Solution
The use of grounded dense hash trees (GDH) is introduced, which starts the hashing process from alternate interior nodes instead of leaves, reducing verification and communication complexity, allowing for simultaneous validation of multiple users with smaller proof sizes that can fit within a single packet.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OCSP is used for on-line certificate status checking, then certificate revocation can be verified, but the digital signature length becomes very long (1024-2048 bits) and computational overhead increases
Solution Approach 1:
The patent segments the certificate validation process by introducing a separate validation server that handles the computationally intensive signature verification, while the certificate authority focuses only on issuing certificates and providing revocation status. This segmentation allows the CA to use shorter signatures while maintaining security through the dedicated validation infrastructure.
Solution Approach 2:
The patent introduces a validation server as an intermediary between the certificate authority and the verifying party. This mediator performs the computationally intensive signature verification and validity checking, reducing the burden on the certificate authority and enabling more efficient certificate status verification without requiring long signatures from the CA.
2Reliability
If a centralized certificate authority handles all requests, then security is maintained through a single signing key, but scalability is limited due to computational burden on a single machine
Solution Approach 1:
The patent segments the certificate authority functions into two separate components: a signing server that maintains the private key and issues certificates, and multiple validation servers that handle verification requests. This segmentation allows the system to maintain security through centralized key management while achieving scalability through distributed validation capacity.
Solution Approach 2:
The patent extracts the computationally intensive signature verification function from the certificate authority and places it in separate validation servers. This extraction allows the CA to remain secure and centralized while the validation workload is distributed across multiple servers, significantly improving request handling capacity.
3Reliability
If certificate revocation lists are distributed periodically, then replay attacks are prevented, but communication and verification costs increase
Solution Approach 1:
The patent extracts the revocation status information from the traditional CRL format and integrates it directly into the OCSP response mechanism. This extraction eliminates the need for separate CRL distribution while maintaining protection against replay attacks through the timestamped OCSP responses that include revocation status.
Solution Approach 2:
The patent merges the certificate revocation status verification with the OCSP online checking mechanism. Instead of maintaining separate CRL distribution infrastructure, the revocation status is combined with the OCSP response, reducing communication overhead while maintaining security against replay attacks through the integrated validation process.
Data Source
AI summary
Revocation of digital certificates in a public-key infrastructure is disclosed, particularly in the case when a certificate might need to be revoked prior to its expirations. For example, if an employee was terminated or switched roles, his current certificate should no longer be valid. Accordingly, novel methods, components and systems are presented for addressing this problem. A solution set forth herein is based on the construction of grounded dense hash trees. In addition, the grounded dense hash tree approach also provides a time-communication tradeoff compared to the basic chain-based version of NOVOMODO, and this tradeoff yields a direct improvement in computation time in practical situations.