Validation Server Handling Certificate Authority Key Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing validation server systems face challenges in confirming the revocation status of public key certificates when a certificate authority updates its secret key, leading to issues with duplicate storage of revoked certificates and incorrect validation results due to the lack of consideration for key updates in standard protocols like OCSP (RFC2560).
Innovation Solution
The validation server maintains an authority certificate with updated key information and revocation data, allowing it to verify the validity of public key certificates issued by a certificate authority before and after key updates by comparing hash values and identifiers, and transmitting signed validation results to terminal equipment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the validation server uses the standard OCSP protocol to verify public key certificates, then the validation process is simple and follows established standards, but the system cannot correctly handle certificate revocation verification when the certificate authority updates its secret key
Solution Approach 1:
The validation server performs preliminary actions by storing multiple authority certificates (including old and new key versions) before validation requests arrive. When a certificate authority updates its secret key, the validation server has already captured and stored both the old authority certificate (with old key) and the new authority certificate (with new key), enabling it to handle validation requests for certificates issued at any time without protocol changes.
Solution Approach 2:
The validation server is designed to universally handle validation requests regardless of when the certificate was issued relative to key updates. By maintaining multiple authority certificates with different key versions and using hash-based identification that works across key transitions, the server provides a unified validation service that accommodates both pre-key-update and post-key-update certificates without requiring different validation pathways.
2Reliability
If the validation server stores multiple CRLs for different key versions, then it can verify certificates issued before and after key updates, but the storage capacity and data management complexity increase significantly
Solution Approach 1:
The invention extracts and stores only the essential authority certificate information (issuer name, key identifier, and serial number) needed for validation, rather than storing complete CRLs for each key version. The validation server captures authority certificates and extracts their identifying characteristics, storing them in a compact format that enables verification without requiring full duplication of revocation lists for each key version.
Solution Approach 2:
The validation server creates simplified copies of authority certificate information rather than storing complete CRLs. By capturing and storing essential authority identification data (issuerName, authorityKeyIdentifier, serialNumber) in a condensed format, the server enables validation functionality without the storage overhead of maintaining multiple full CRL datasets for different key versions.
3Measurement precision
If the validation server uses hash values of issuer name and key information to identify certificate authorities, then it can correctly match certificates with their issuing authority across key updates, but the computation time for hash calculation increases
Solution Approach 1:
The validation server performs preliminary hash calculations when capturing and storing authority certificates. By pre-computing hash values of issuer names and key identifiers at the time of authority certificate capture, the server avoids performing these calculations for every validation request, thereby reducing real-time processing time while maintaining accurate authority identification.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In response to a validation request that includes second information identifying the certificate authority, key information of the certificate authority at issuance of the public key certificate, and information identifying the public key certificate, if the second information identifying the certificate authority included in the validation request corresponds to the first information identifying the certificate authority included in the authority certificate, and the information identifying the public key certificate included in the validation request does not exist in the revocation information, the validation server creates a validation result indicating that the public key certificate corresponding to the information identifying the public key certificate included in the validation request is valid.