Secure Agent Certificate Revocation List Enforcement

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing certificate revocation list systems lack enforcement mechanisms, allowing non-trusted software to potentially tamper with or prevent the delivery of current certificate revocation lists, leading to invalid certificates being validated.

Innovation Solution

A secure agent is implemented to enforce certificate revocation policies by receiving and storing the latest certificate revocation list, using a list generation index and enforcement generation index to ensure certificates are checked against the latest valid list, and refusing actions if the certificate's list generation index is outdated, thereby preventing tampering and ensuring only valid certificates are used.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a secure agent is implemented in hardware to enforce certificate revocation policies, then security is improved, but device complexity increases due to the complicated logic required for securely checking certificates against the CRL

Engineering Contradiction:
ImprovesecurityVSAvoidlogic complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system divides the CRL checking functionality into two parts: a secure agent in hardware that provides security and an enforcement module in software that handles the complex logic of checking list generation indices and enforcing revocation policies. This segmentation allows the hardware component to remain simple while the software component handles the complicated enforcement logic.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces an enforcement module as an intermediary between the secure agent and the certificate validation process. This intermediary handles the complex logic of comparing list generation indices and determining whether certificates should be rejected, thereby preventing the secure agent from needing to contain this complicated logic directly.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Measurement precision

If the secure agent stores and processes the entire CRL, then certificate checking accuracy is improved, but memory requirements and processing overhead increase

Engineering Contradiction:
Improvecertificate checking accuracyVSAvoidmemory requirements
Core Design Contradiction:
Measurement precisionVSQuantity of substance

Solution Approach 1:

The patent extracts the CRL data from the secure agent and stores it externally in a database or file system. The secure agent only needs to access specific portions of the CRL when needed, rather than storing the entire list in memory. This extraction reduces the memory burden on the secure agent while maintaining the ability to perform accurate certificate checking.

Inventive Principle:
Principle #2Taking out (Extraction)

3Reliability

If certificate revocation list updates are performed frequently to maintain security, then reliability is improved, but loss of time increases due to the need to distribute and process updated lists

Engineering Contradiction:
Improvecertificate revocation enforcementVSAvoidCRL distribution time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by pre-computing and storing list generation indices and enforcement generation indices in advance. When a CRL update occurs, the enforcement module can quickly compare these pre-stored indices to determine whether certificates need to be rejected, eliminating the need for time-consuming real-time analysis of the entire CRL during enforcement operations.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP1999677B1Method to enforce the use of a certificate revocation list
Publication Date: 2012.07.18 NDS
  • EP1999677B1 patent drawingFigure 1
  • EP1999677B1 patent drawingFigure 2
  • EP1999677B1 patent drawingFigure 3

AI summary

A method for enforcing use of certificate revocation lists [figure 4, CRL 14] in validating certificates, the lists being associated with a series of list generation indices such that each list is assigned one index which advances according to a time of generation of the list, the lists and the indices being cryptographically signed, the method including receiving one of the lists and an associated index as an identifier of the one list, checking the certificates against the list, associating each of the certificates, which have been checked against the list, with the index, receiving an enforcement generation index (EGI) associated with a latest list in us.e, storing the EGI as a last known EGI, and refusing performance of an action associated with a certificate if the one index of the one certificate is earlier in the series than the last known EGI. Related apparatus and methods are also included.