OCSP Caching for PKI Authorization Attribute Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Public Key Infrastructure (PKI) systems require frequent updates of identity certificates when authorization attributes change, leading to increased operational costs and the need for constant connectivity to backend infrastructure for authenticating both identity and authorization attributes.
Innovation Solution
Implementing a method where a certificate subject periodically obtains and caches its certificate status and authorization attributes from an OCSP server, allowing the relying party to verify these attributes without needing connectivity to the backend infrastructure, using an authorization request and response extension within the OCSP protocol.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If identity certificates are updated frequently to reflect authorization attribute changes, then authorization accuracy is improved, but operational cost increases
Solution Approach 1:
The patent separates identity verification from authorization attribute verification. Identity certificates remain stable and infrequent, while authorization attributes are independently cached and validated through OCSP responses. This segmentation allows authorization attributes to be updated without requiring new identity certificates, reducing operational costs while maintaining authorization accuracy.
Solution Approach 2:
The patent implements preliminary caching of authorization attributes and OCSP responses at the relying party before they are needed. By pre-caching these attributes locally, the system avoids frequent real-time updates and backend connectivity requirements, reducing operational costs while ensuring accurate authorization verification when needed.
2Reliability
If identity certificates are updated frequently to reflect authorization attribute changes, then authorization accuracy is improved, but system complexity increases
Solution Approach 1:
The patent divides the authentication system into distinct components: identity certificates that remain stable, authorization attributes that are independently managed, and OCSP responses that provide validation. This segmentation simplifies the overall system by allowing each component to be managed separately with different update frequencies, reducing system complexity while maintaining authorization accuracy.
Solution Approach 2:
The patent introduces OCSP responses as an intermediary mechanism between identity certificates and authorization attributes. This intermediary allows the relying party to verify authorization attributes without requiring updates to identity certificates, simplifying the system architecture by decoupling these two functions.
3Reliability
If continuous connectivity to backend infrastructure is maintained for authentication, then authentication reliability is improved, but operational cost increases
Solution Approach 1:
The patent implements preliminary caching of OCSP responses and authorization attributes at the relying party before they are needed for authentication. By pre-caching this data locally, the system maintains authentication reliability without requiring continuous backend connectivity, significantly reducing operational costs associated with constant network connections.
Solution Approach 2:
The patent enables the relying party to self-verify authorization attributes using locally cached OCSP responses and authorization attributes. This self-service capability eliminates the need for continuous backend infrastructure connectivity, maintaining authentication reliability while reducing operational costs.
4Reliability
If continuous connectivity to backend infrastructure is maintained for authentication, then authentication reliability is improved, but system complexity increases
Solution Approach 1:
The patent implements preliminary caching of OCSP responses and authorization attributes at the relying party before they are needed for authentication. By pre-caching this data locally, the system maintains authentication reliability without requiring continuous backend connectivity, significantly reducing operational costs associated with constant network connections.
Solution Approach 2:
The patent enables the relying party to self-verify authorization attributes using locally cached OCSP responses and authorization attributes. This self-service capability eliminates the need for continuous backend infrastructure connectivity, maintaining authentication reliability while reducing operational costs.
Data Source
AI summary
A relying party obtains a certificate of a certificate subject and acquires a status information object for the certificate. The relying party validates the certificate using information in the status information object and compares authorization attributes present in the status information object with policy attributes associated with the requested service. A policy attribute is a set of constraints used by the relying party to determine if the authorization attributes associated with the certificate subject are sufficient to allow the certificate subject to access the requested service. If the authorization attributes present in the status information object match the policy attributes associated with the requested service, the relying party may grant the certificate subject access to the requested service.