US 2022/0103380 A1 · Scalable Certificate Revocation Truth Distribution and Verification Using a Bloom Filter Set and a False Positive Set for PKI-Based IoT Scenarios

Abstract

A first IoT device includes a memory, a transceiver, bloom filter evaluation, false positive comparison and control modules. The memory stores: a bloom filter set including an array of bits representing entries in a certificate revocation list; and a false positive set including a list of certificate entries falsely identified as being revoked. The transceiver receives from a second IoT device a message including a certificate. The bloom filter evaluation module receives the bloom filter set from a back office station and determines whether an identifier associated with the certificate is in the bloom filter set. The false positive comparison module receives the false positive set from the back office station and determines whether the identifier is in the false positive set. The control module permits communication between the first and second IoT devices based on whether the identifier is in the bloom filter and false positive sets.

Claims20

Dependent claims

A first Internet of things (IoT) device comprising:

a memory configured to store
a bloom filter set including an array of bits representing entries in a certificate revocation list, and
a false positive set including a list of certificate entries falsely identified by the bloom filter set as being revoked;
a transceiver configured to receive from a second IoT device a message, wherein the message includes a certificate;
a bloom filter evaluation module configured to receive the bloom filter set from a back office station and determine whether an identifier associated with the certificate is deemed to be in the bloom filter set;
a false positive comparison module configured to receive the false positive set from the back office station and determine whether the identifier is in the false positive set;
and
a control module configured to permit communication between the first IoT device and the second IoT device based on whether the identifier is deemed to be in the bloom filter set and whether the identifier is in the false positive set.

5 more elements

A back office station comprising:

a memory configured to store a certificate revocation list, a bloom filter set, and a false positive set, wherein the certificates revocation list includes a revoked certificate of a first Internet of Thing (IoT) device;
a certificate revocation module configured to generate and store in the memory the certificate revocation list;
a bloom filter module comprising a bloom filter and configured to generate the bloom filter set based on the certificate revocation list using the bloom filter, wherein the bloom filter set is an array of bits representative of the certificate revocation list;
a false positive module configured to generate the false positive set based on a first potential false positive list received from a second IoT device, wherein the false positive set includes identifiers associated with certificates not in the certificate revocation list but in one or more potential false positive lists, wherein the one or more false positive lists includes the first potential false positive list, and wherein the false positive set includes an identifier of a third IoT device;
and
a control module configured to transmit the bloom filter set and the false positive set to the second IoT device to prevent communication with the first IoT device and permit communication with the third IoT device.

3 more elements

Dependencies are inferred from the claim text.

Scalable Certificate Revocation Truth Distribution and Verification Using a Bloom Filter Set and a False Positive Set for PKI-Based IoT Scenarios

Life of this patent

Scalable Certificate Revocation Truth Distribution and Verification Using a Bloom Filter Set and a False Positive Set for PKI-Based IoT Scenarios

Life of this patent

Abstract

Claims20