Local Trusted Environment for Certificate Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure communication protocols, such as SSL/TLS and OCSP, face challenges in managing large Certificate Revocation Lists (CRLs) and high signaling costs, especially in Machine-2-Machine (M2M) communication, where energy-efficient transmission is crucial, and ensuring security without relying on a trusted third party for certificate validation.
Innovation Solution
Implementing a local trusted environment within the client, such as a Trusted Execution Environment (TEE) or Local Online Certificate Status Protocol (LOCSP), to cache and verify certificates locally, reducing the need for frequent updates and network communication, while maintaining security through secure launching of remote virtual machines and digital signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Certificate Revocation Lists (CRLs) are used to manage certificate validity, then certificate trust verification is improved, but the size of CRLs grows large and requires frequent updates, increasing network traffic and energy consumption
Solution Approach 1:
The patent segments the monolithic CRL into individual certificate validity information stored in a database. Instead of maintaining one large CRL file that grows with the number of revoked certificates, the system stores validity information for each certificate separately, allowing selective retrieval of only the specific certificate validity data needed, thus avoiding transmission of entire large CRL files.
Solution Approach 2:
The system performs preliminary actions by pre-storing certificate validity information in a database before it is needed. The validity information is prepared and stored in advance, allowing the client to retrieve only the specific certificate validity data required without waiting for CRL generation or transmission, reducing network traffic and energy consumption.
2Reliability
If Online Certificate Status Protocol (OCSP) is used for real-time certificate verification, then certificate status freshness is improved, but signaling costs and network traffic increase considerably
Solution Approach 1:
The patent extracts the essential certificate validity verification function from the OCSP protocol framework. Instead of using the full OCSP protocol with its associated signaling overhead, the system extracts only the core functionality of verifying certificate validity by checking against stored validity information, eliminating unnecessary protocol messaging and reducing energy consumption.
Solution Approach 2:
The client performs self-service by locally retrieving and caching certificate validity information from a database. Instead of continuously querying external OCSP servers for each certificate verification, the client serves itself by checking locally stored validity data, reducing network signaling and energy consumption while maintaining verification capability.
3Reliability
If short-lived certificates are used to balance security and update frequency, then certificate validity is improved, but the complexity of regularly distributing and re-issuing certificates increases
Solution Approach 1:
The system performs preliminary action by pre-storing certificate validity information in a database before certificates need to be verified. This pre-stored information remains valid until the stored validity period expires, eliminating the need for frequent certificate re-issuance and distribution. The validity information is prepared in advance and can be retrieved on demand without complex distribution mechanisms.
4Loss of energy
If caches are used to reduce OCSP traffic, then network traffic is reduced, but security is compromised as normal caching does not provide the required security
Solution Approach 1:
The patent introduces a trusted database as an intermediary between the client and certificate validity verification. Instead of using simple caching that compromises security, the system uses a secure database that acts as a trusted mediator, storing certificate validity information in a secure manner. The database provides authenticated access to validity data, maintaining security while enabling local verification without continuous network traffic.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A technique for enabling a client to provide a server entity is disclosed. In method aspects, a first method is performed in the client and comprises the steps of providing the client with a secure trusted environment, the environment being trusted by the client and by at least one third party, and accommodating, in the secure trusted environment, at least a local portion of the server entity, the server entity being configured to handle one or more server requests from the client, and data required by the server entity so as to handle the server request. A second method is performed in a server and comprises the steps of providing, for the secure trusted environment of the client, the environment being trusted by the client and by the at least one third party the at least local portion of the server entity, and the data.