Mobile Credential Revocation Through Localized Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing credential revocation systems are slow, expensive, and not scalable, leading to potential misuse of revoked credentials due to time delays in distributing revocation lists.
Innovation Solution
A credential management system that selectively validates and invalidates credentials based on external and internal events, using cryptographically independent primary and associated credentials, allowing for rapid and localized revocation without relying on centralized revocation mechanisms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized revocation mechanisms (CRL distribution) are used, then credential revocation can be achieved, but the system becomes slow and expensive with time delays
Solution Approach 1:
The patent divides the centralized revocation system into distributed components. Each access control system maintains its own local credential status information, eliminating the need for centralized CRL distribution. This segmentation allows immediate local validation without waiting for centralized updates, resolving the time delay problem while maintaining revocation effectiveness.
Solution Approach 2:
The system performs preliminary actions by having access control systems proactively request and store credential status information before verification is needed. Credential status is cached locally in advance, so when verification occurs, the system can immediately check local records without time-consuming network requests, eliminating the time delay inherent in centralized CRL distribution.
2Speed
If frequent CRL distribution is implemented to reduce time delays, then revocation speed improves, but system cost and complexity increase
Solution Approach 1:
The patent extracts the credential status information from the centralized CRL distribution mechanism and places it directly at the access control systems. Instead of repeatedly distributing CRLs, the status information is obtained once and stored locally, eliminating the need for frequent distributions and reducing system complexity while maintaining fast revocation speed.
Solution Approach 2:
The system creates local copies of credential status information at each access control system. These copies are maintained and updated without requiring frequent centralized distribution. The copying approach allows immediate local verification, achieving fast revocation speed while avoiding the complexity of frequent CRL distribution infrastructure.
3Reliability
If centralized credential validation is used, then credential status can be verified, but the system becomes expensive and not scalable
Solution Approach 1:
The patent segments the centralized validation authority into distributed validation capabilities at each access control system. Each system independently validates credentials using locally stored status information, eliminating the bottleneck of centralized validation. This segmentation enables the system to scale horizontally by simply adding more access control systems without increasing centralized processing load, thereby improving productivity and scalability while maintaining validation accuracy through local enforcement of credential status.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
The invention is directed to a method of managing validity status of at least one of a plurality of associated credentials, comprising: providing a credential manager that selectively validates a particular one of the associated credentials for at least one device by validating a corresponding primary credential that is cryptographically independent from the plurality of the associated credentials, wherein the plurality of the associated credentials are deemed invalid when the corresponding primary credential is invalid; and the at least one device invalidating the particular one of the associated credentials while other ones of the plurality of the associated credentials and the corresponding primary credential remain valid. Further, the invention is directed to a computer software that manages validity status of at least one of a plurality of associated credentials, as well as a respective validation system.