Internet Hinting Service for Accelerated Certificate Validation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current methods for establishing secure communications channels are inefficient due to the need to verify certificates by contacting certificate authorities, which can be time-consuming, especially over high-latency or low-bandwidth connections.

Innovation Solution

An Internet hinting service provides certificate information, allowing browsers to validate certificates locally without contacting the certificate authority, by receiving hint information that includes certificate status, which can be cached for future use, thereby reducing the need for external validation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If certificate verification is performed by contacting certificate authority, then certificate validity can be confirmed, but communication establishment time increases

Engineering Contradiction:
Improvecertificate validity confirmationVSAvoidcommunication establishment time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The system performs certificate status checking in advance by contacting the certificate authority before the actual communication occurs. The obtained certificate status information is cached and reused for subsequent communications, eliminating the need for repeated verification requests and reducing establishment time while maintaining reliability

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The system distributes certificate status information locally to client devices through caching mechanisms. Each device maintains local copies of certificate status data, allowing verification to be performed locally without repeated network contacts with the certificate authority, thus reducing communication time while preserving verification accuracy

Inventive Principle:
Principle #3Local quality

2Reliability

If certificate status checking is performed over high-latency connections, then secure communication can be established, but performance deteriorates

Engineering Contradiction:
Improvesecure communication establishmentVSAvoidcommunication performance
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

Certificate verification is performed in advance before actual communication needs occur. The system proactively checks certificate status and caches the results, so that when communication is needed over high-latency connections, the verification has already been completed locally, eliminating performance degradation from repeated network round-trips

Inventive Principle:
Principle #10Preliminary action

3Reliability

If repeated certificate verification requests are sent, then certificate validity can be continuously confirmed, but network bandwidth is consumed

Engineering Contradiction:
Improvecertificate validity confirmationVSAvoidnetwork bandwidth consumption
Core Design Contradiction:
ReliabilityVSLoss of energy

Solution Approach 1:

The system caches certificate status information locally at client devices and uses this cached data for verification purposes. This eliminates the need for repeated network requests to the certificate authority, significantly reducing network bandwidth consumption while maintaining continuous certificate validity confirmation through local cache updates

Inventive Principle:
Principle #3Local quality

Data Source

PatentEP3342126B1Acceleration of online certificate status checking with an internet hinting service
Publication Date: 2020.09.16 VIASAT INC
  • EP3342126B1 patent drawingFigure 1
  • EP3342126B1 patent drawingFigure 2
  • EP3342126B1 patent drawingFigure 3

AI summary

Examples for acceleration of online certificate status checking with an Internet hinting service are disclosed. For example, one method includes receiving, by a computing device from a hinting server, hint information comprising certificate information; receiving, from a remote computing device, a certificate in response to a request to establish secure communications with the remote computing device; and determining a validity of the certificate based on the certificate information.