Local OCSP Agent Caching to Reduce Certificate Validation Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for determining digital certificate validity, such as OCSP, often experience delays due to network latency when a browser application requests a certificate status response from a certificate authority, leading to inefficiencies in receiving validity messages.
Innovation Solution
A method where a local agent application on a client computer pre-populates a cache with certificate status validity messages from a certificate authority and intercepts browser requests to provide cached responses, reducing the need for direct communication with the CA and minimizing latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a browser application requests certificate status responses directly from a certificate authority, then the certificate validity can be determined, but network latency causes substantial delays in receiving responses
Solution Approach 1:
The agent application proactively requests and caches certificate status responses from the certificate authority in advance, before the browser application needs them. This preliminary action stores valid responses locally so when the browser makes a request, the response is already available, eliminating network latency delays.
Solution Approach 2:
The agent application acts as an intermediary between the browser application and the certificate authority. It intercepts requests from the browser, retrieves cached responses locally, and delivers them to the browser, thereby mediating the communication to eliminate direct network latency issues.
2Loss of time
If a local agent application intercepts and serves cached OCSP responses, then response time is reduced, but the system complexity increases
Solution Approach 1:
The agent application performs multiple functions: it requests certificate status responses from the CA, caches them locally, intercepts browser requests, and delivers responses. By combining these functions into a single agent component, the patent reduces overall system complexity while maintaining fast response times.
Solution Approach 2:
The agent application automatically manages its own cache, intercepting requests and serving responses without requiring modification of the browser application or manual intervention. This self-service capability simplifies the architecture by making the agent independent and autonomous.
3Loss of energy
If OCSP responses are cached locally, then network communication is reduced, but cache management complexity increases
Solution Approach 1:
The agent application autonomously manages its own cache without external intervention. It automatically determines when to request new responses, stores them locally, and serves them to the browser, eliminating the need for complex external cache management systems.
Solution Approach 2:
The agent proactively requests and caches certificate status responses in advance, preparing them for future browser requests. This preliminary caching action reduces network communication by having responses ready locally when needed.
Data Source
AI summary
Techniques are disclosed for locally distributing online certificate status protocol (OCSP) responses to a client computer. A certificate authority (CA) proactively sends OCSP responses to an agent application (e.g., an antivirus application configured to handle OCSP responses) residing in the client computer. The agent application stores the OCSP responses in a cache. Thereafter, when a browser application sends an OCSP request to the CA, the agent application intercepts the request and determines whether a corresponding OCSP response is locally cached. If so, the agent application sends the cached OCSP response to the browser application. If not, the agent application retrieves the corresponding OCSP response from the CA and sends the response to the browser application.