Secure Element Time Management for PKI Certificate Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Public Key Infrastructure (PKI) environments, there is a need to improve the recognition of expired certificates and the validity of Certificate Revocation Lists (CRLs and OCSP stapling messages, as well as to securely manage time-variant parameters to prevent replay attacks and ensure timeliness guarantees.
Innovation Solution
A Secure Element (SE) obtains and stores time information, which can be periodically updated or opportunistically retrieved from a trusted interface or a Certificate Authority (CA), to check the expiration of security materials, such as CRLs and certificates, and verify the validity of OCSP stapling messages by comparing the time information with a security window.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If time information is obtained from external sources (CA or trusted interface), then the accuracy of certificate expiration detection is improved, but the device complexity and communication overhead increase
Solution Approach 1:
The SE obtains time information in advance from external sources (CA or trusted interface) and stores it locally for subsequent use. This preliminary action allows the SE to have time information ready before it is needed for certificate expiration checks, eliminating the need for real-time external queries and reducing communication overhead.
Solution Approach 2:
The SE creates a local copy of time information from external sources and stores it in its memory. This copy can be used repeatedly for certificate expiration detection without needing to contact external sources again, reducing device complexity and communication requirements while maintaining detection accuracy.
2Speed
If time information is stored locally in the SE, then the speed of certificate validation is improved, but the loss of time synchronization with external sources increases
Solution Approach 1:
The SE periodically updates its locally stored time information by obtaining new time values from external sources (CA or trusted interface) at regular intervals. This periodic refresh ensures that the local time information remains synchronized with external sources while allowing fast certificate validation between updates.
Solution Approach 2:
The SE uses its locally stored time information to validate certificates and can compare validation results with external time sources when available. This feedback mechanism helps detect and correct time synchronization drift, ensuring both fast validation and accurate timekeeping.
3Loss of energy
If the SE opportunistically obtains time information from messages, then the communication overhead is reduced, but the reliability of time information acquisition decreases
Solution Approach 1:
The SE uses a trusted interface as an intermediary to obtain time information. This trusted interface acts as a reliable mediator between the SE and external time sources, ensuring that time information is obtained reliably while minimizing direct communication overhead with external sources.
Solution Approach 2:
The SE extracts time information from various message types (OCSP stapling messages, CRL messages, or other authenticated messages) that it receives anyway for other purposes. This multi-functional approach allows the SE to obtain time information opportunistically from existing communications without additional dedicated time synchronization traffic.
Data Source
AI summary
A secure element (SE) with a notion of time useful for checking secure items is disclosed herein. Use of Public Key Infrastructure (PKI) with secure elements is improved by verifying secure items used by an SE. Methods of obtaining time information by the SE include push, pull, opportunistic, and local interface methods. The SE uses the time information to evaluate arriving and stored public key certificates and to discard those which fail the evaluation. The SE, in some embodiments, uses the time information in cooperation with certificate revocation lists (CRLs) and/or online certificate status protocol (OCSP) stapling procedures.