Time-Based Intermediate Certificate Authority Chain for Revocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Digital certificates with time-based expirations require reliable clocks for validation, which can be unreliable in devices without accurate timekeeping, and certificate revocation lists (CRLs) grow excessively when used for frequent rotations or compromises, making them inefficient for validating digital certificates.
Innovation Solution
Implementing a chain of time-based intermediate certificate authorities with validation periods that encode expiration times, allowing certificates to be added to a CRL based on these periods, and replacing intermediate CAs to manage certificate revocation efficiently without relying on client device clocks or excessive CRL growth.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate revocation lists are used for frequent certificate rotations or compromises, then certificate revocation capability is improved, but CRL size grows excessively
Solution Approach 1:
The patent divides the certificate authority hierarchy into multiple levels (root CA, intermediate CAs, and end-entity certificates). Each intermediate CA manages its own subset of certificates independently, segmenting the overall CRL management. This allows revocation information to be maintained at multiple hierarchical levels rather than consolidating all revocations in a single large CRL, thereby reducing the size of individual CRLs while maintaining comprehensive revocation capability.
2Manufacturing precision
If time-based expirations are embedded in digital certificates, then certificate validity control is improved, but validation reliability deteriorates due to unreliable client clocks
Solution Approach 1:
The patent introduces intermediate certificate authorities as mediators between the root CA and end entities. These intermediate CAs are issued certificates with explicit time-based validity periods by the root CA. The intermediate CAs then use their own validated time periods to sign end-entity certificates, acting as intermediaries that transfer and enforce time-based validity control without requiring client devices to maintain accurate clocks themselves. The time validation is performed by the CA infrastructure rather than by client device clocks.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method (800) for representing certificate expiration includes obtaining, from a root certificate authority (310R), a root digital certificate (210R) and generating a chain of intermediate certificate authorities (310N). Each intermediate certificate authority includes a respective intermediate certificate (210N) digitally signed by the intermediate certificate authority and a respective validation time period (312) indicating a range of times when the intermediate certificate authority is permitted to digitally sign certificates. The respective validation time period includes the validation time period of each intermediate certificate authority that is lower in the chain. The method includes generating a certificate revocation list (510) and generating a plurality of end entity certificates (210L). The method includes, after the respective validation time period of the lowest intermediate certificate authority in the chain has elapsed, adding, to the certificate revocation list, one or more of the plurality of end entity certificates.