Certificate Revocation
AssigneeSkype
InventorsEric Rescorla, Theo Zourzouvillys
Life of this patent
Estimating the term…
Abstract
A communication system includes a plurality of nodes, the communication system being arranged to assign each of the plurality of nodes a certificate by means of which it can authenticate itself to other nodes in the communication system. The communication system further includes an authentication node arranged to determine that a certificate should be revoked and to, responsive to that determination, write an indicator of that certificate's revocation to a location in the communication system that is external to the authentication node and to which the node assigned the revoked certificate is not permitted to write.
Claims43
A communication system comprising a plurality of nodes, the communication system being arranged to assign each of the plurality of nodes a certificate by means of which it can authenticate itself to other nodes in the communication system, the communication system further comprising an authentication node arranged to determine that a certificate should be revoked and to, responsive to that determination, write an indicator of that certificate's revocation to a location in the communication system that is external to the authentication node and to which the node assigned the revoked certificate is not permitted to write.
An authentication node for operating in a communication system comprising a plurality of nodes, each of the plurality of nodes being assigned a certificate by means of which it can authenticate itself to other nodes in the communication system, the authentication node being arranged to determine that a certificate should be revoked and to, responsive to that determination, write an indicator of that certificate's revocation to a location in the communication system that is external to the authentication node and to which a node assigned the revoked certificate is not permitted to write.
A node for operating in a communication system comprising a plurality of nodes, each of the plurality of nodes being assigned a certificate by means of which it can authenticate itself to other nodes in the communication system, the node being arranged to:
- receive an indicator of a certificate's revocation from an authentication node;
- store that indicator at a location within the node;
- and
- not permit a node that is assigned the revoked certificate to write to the location in which the indicator is stored.
A node for operating in a communication system comprising a plurality of nodes, each of the plurality of nodes being assigned a certificate by means of which it can authenticate itself to other nodes in the communication system, the node being arranged to authenticate another node by:
- receiving a certificate assigned to the other node;
- obtaining an indicator of that certificate's validity;
- and
- authenticating the other node in dependence on the certificate and the indicator.
A non-transitory computer-readable medium encoded with instructions, that when executed by an authentication node for operating in a communication system comprising a plurality of nodes, each of the plurality of nodes being assigned a certificate by means of which it can authenticate itself to other nodes in the communication system, cause the authentication node to determine that a certificate should be revoked and to, responsive to that determination, write an indicator of that certificate's revocation to a location in the communication system that is external to the authentication node and to which a node assigned the revoked certificate is not permitted to write.
A non-transitory computer-readable medium encoded with instructions, that when executed by a node for operating in a communication system comprising a plurality of nodes, each of the plurality of nodes being assigned a certificate by means of which it can authenticate itself to other nodes in the communication system, cause the node to:
- receive an indicator of a certificate's revocation from an authentication node;
- store that indicator at a location within the node;
- and
- not permit a node that is assigned the revoked certificate to write to the location in which the indicator is stored.
A non-transitory computer-readable medium encoded with instructions, that when executed by a node for operating in a communication system comprising a plurality of nodes, each of the plurality of nodes being assigned a certificate by means of which it can authenticate itself to other nodes in the communication system, cause the node to authenticate another node by:
- receiving a certificate assigned to the other node;
- obtaining an indicator of that certificate's validity;
- and
- authenticating the other node in dependence on the certificate and the indicator.
Dependencies are inferred from the claim text.