Secure Agent Certificate Revocation List Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing certificate revocation list systems lack enforcement mechanisms, allowing non-trusted software to potentially tamper with or prevent the delivery of current certificate revocation lists, leading to invalid certificates being validated.
Innovation Solution
A secure agent is implemented to enforce certificate revocation policies by receiving and storing the latest certificate revocation list, using a list generation index and enforcement generation index to ensure certificates are checked against the latest valid list, and refusing actions if the certificate's list generation index is outdated, thereby preventing tampering and ensuring only valid certificates are used.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secure agent is implemented in hardware to enforce certificate revocation policies, then security is improved, but device complexity increases due to the complicated logic required for securely checking certificates against the CRL
Solution Approach 1:
The system divides the CRL checking functionality into two parts: a secure agent in hardware that provides security and an enforcement module in software that handles the complex logic of checking list generation indices and enforcing revocation policies. This segmentation allows the hardware component to remain simple while the software component handles the complicated enforcement logic.
Solution Approach 2:
The patent introduces an enforcement module as an intermediary between the secure agent and the certificate validation process. This intermediary handles the complex logic of comparing list generation indices and determining whether certificates should be rejected, thereby preventing the secure agent from needing to contain this complicated logic directly.
2Measurement precision
If the secure agent stores and processes the entire CRL, then certificate checking accuracy is improved, but memory requirements and processing overhead increase
Solution Approach 1:
The patent extracts the CRL data from the secure agent and stores it externally in a database or file system. The secure agent only needs to access specific portions of the CRL when needed, rather than storing the entire list in memory. This extraction reduces the memory burden on the secure agent while maintaining the ability to perform accurate certificate checking.
3Reliability
If certificate revocation list updates are performed frequently to maintain security, then reliability is improved, but loss of time increases due to the need to distribute and process updated lists
Solution Approach 1:
The system performs preliminary actions by pre-computing and storing list generation indices and enforcement generation indices in advance. When a CRL update occurs, the enforcement module can quickly compare these pre-stored indices to determine whether certificates need to be rejected, eliminating the need for time-consuming real-time analysis of the entire CRL during enforcement operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for enforcing use of certificate revocation lists [figure 4, CRL 14] in validating certificates, the lists being associated with a series of list generation indices such that each list is assigned one index which advances according to a time of generation of the list, the lists and the indices being cryptographically signed, the method including receiving one of the lists and an associated index as an identifier of the one list, checking the certificates against the list, associating each of the certificates, which have been checked against the list, with the index, receiving an enforcement generation index (EGI) associated with a latest list in us.e, storing the EGI as a last known EGI, and refusing performance of an action associated with a certificate if the one index of the one certificate is earlier in the series than the last known EGI. Related apparatus and methods are also included.