Pre-encoding Cached Certificate Revocation Lists

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional identity management systems face inefficiencies in publishing certificate revocation lists (CRLs), as they often engage directory servers for extended periods, especially when CRLs are large, due to the need for frequent encoding and transmission of un-encoded information.

Innovation Solution

Implementing a CRL pre-encoder that periodically searches and encodes un-encoded information in cached CRLs, using standards like Distinguished Encoding Rules (DER) of the Abstract Syntax Notation One (ASN.1) for efficient transmission over networks, reducing the time required to generate and publish CRLs.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If CRLs are published frequently with un-encoded information, then certificate revocation status is kept current, but directory server engagement time increases significantly

Engineering Contradiction:

Improvecertificate revocation status currencyVSAvoiddirectory server engagement time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The CRL pre-encoder performs encoding operations in advance, during idle periods or low-traffic times, so that when CRL publication is needed, the encoded data is already prepared and ready for immediate transmission, eliminating the need for time-consuming encoding during publication events

Inventive Principle:

Principle #10Preliminary action

2Loss of information

If CRL encoding is performed at publication time, then data freshness is maintained, but system productivity decreases due to processing delays

Engineering Contradiction:

ImproveCRL data freshnessVSAvoidCRL generation and publication efficiency

Core Design Contradiction:

Loss of informationVSProductivity

Solution Approach 1:

Encoding is performed preliminarily and periodically on cached CRL data during low-utilization periods, creating pre-encoded versions that can be rapidly published without real-time encoding delays, thus maintaining both data freshness and system productivity

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements periodic encoding of CRL data at scheduled intervals during idle periods, rather than performing encoding on-demand at publication time, which smooths out processing loads and maintains consistent system performance

Inventive Principle:

Principle #19Periodic action

3Reliability

If large CRLs are transmitted frequently, then complete revocation information is provided, but network bandwidth consumption increases

Engineering Contradiction:

Improverevocation information completenessVSAvoidnetwork bandwidth consumption

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The CRL data is pre-encoded and cached in advance, allowing the system to serve pre-prepared encoded versions during publication events, reducing the computational and network overhead associated with real-time encoding and transmission of large CRL datasets

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS8745380B2Pre-encoding a cached certificate revocation list

Publication Date: 2014.06.03 RED HAT INC

AI summary

A method and system for pre-encoding a cached CRL is described.