Back to results
US 6,487,658 B1Granted
Efficient certificate revocation
AssigneeCorestreet Security, Ltd.
InventorSilvio Micali
Life of this patent
Estimating the term…
Abstract
We propose new systems for certificate revocation that are more economical and efficient than traditional ones. We also point out what we believe to be a structural problem in traditional public-key infrastructures, and various ways to solve it.
Claims53
A method for an authority to provide authenticated information about revoked certificates associated with identifiers belonging to an ordered set, comprising the steps of:
- (a) dividing the identifiers of the revoked certificates into a plurality of lists, wherein each of the lists includes all identifiers between a first value and a second value, and at least one of the lists contains at least two identifiers;
- and
- (b) for each of the lists, generating an authenticated list by having the authority authenticate at least one of:
- the list alone, the list together with date information, the list together with the first and second values, the list together with the first and second values and date information, and the list together with additional information.
1 more element
A method for an authority to provide authenticated information about revoked certificates having identifiers belonging to an ordered set, comprising the steps of:
- (a) dividing the revoked certificates into a plurality of subgroups, wherein at least one of the subgroups contains all the revoked certificates having an identifier between a given upper bound and a given lower bound and contains at least two revoked certificates;
- (b) for each of the subgroups, generating a data string indicating the revoked certificates belonging to the subgroup;
- and
- (c) for each of the data strings, generating authenticated information by having the authority authenticate at least one of:
- the data string alone, the data string together with an indication of the subgroup, the data string together with date information, the data string together with date information and an indication of the subgroup, and the data string together with additional information.
2 more elements
A method for an authority to provide authenticated information about revoked certificates, comprising the steps of:
- (a) dividing the revoked certificates into a plurality of subgroups wherein at least one of the subgroups contains certificates having serial numbers between a first value and a second value;
- (b) for at least one of the subgroups, generating a data string identifying the subgroup and identifying the revoked certificates contained therein, wherein at least one of the revoked certificates is represented by predetermined bit positions in a data string and wherein at least some bits at the bit positions convey revocation information about the at least one of the revoked certificates;
- and
- (c) generating authenticated revocation information by having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information.
2 more elements
A method for an authority to generate authenticated information about revoked certificates, comprising the steps of:
- (a) providing a subgroup, containing less than all of the revoked certificates, that contains all of the revoked certificates sharing a given characteristic of at least one of:
- certificates versions, certificate serial numbers, certificate algorithm identifiers, certificate public key information, certificate validity, certificate user names, and certificate date information;
- (b) generating a data string identifying the revoked certificates in the subgroup and the characteristic;
- and
- (c) generating the authenticated information by having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information, wherein the additional information includes compressed date information indicating a revocation date of at least one of the certificates, and wherein the compressed date information indicates a number of days between the revocation date and a reference date.
3 more elements
A method for an authority to generate authenticated information about revoked certificates, comprising the steps of:
- (a) providing a subgroup, containing less than all of the revoked certificates, that contains all of the revoked certificates sharing a given characteristic of at least one of:
- certificates versions, certificate serial numbers, certificate algorithm identifiers, certificate public key information, certificate validity, certificate user names, and certificate date information;
- (b) generating a data string identifying the revoked certificates in the subgroup and the characteristic;
- and
- (c) generating the authenticated information by having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information, wherein the additional information includes additional items that are shared by two or more of the revoked certificates.
3 more elements
A method for an authority to generate authenticated information about revoked certificates, comprising the steps of:
- (a) providing a subgroup, containing less than all of the revoked certificates, that contains all of the revoked certificates sharing a given characteristic of at least one of:
- certificates versions, certificate serial numbers, certificate algorithm identifiers, certificate public key information, certificate validity, certificate user names, and certificate date information, wherein each revoked certificate has an identifier and the at least one characteristic further includes having given bits in the identifier be equal to given values;
- (b) generating a data string identifying the revoked certificates in the subgroup and the characteristic;
- and
- (c) generating the authenticated information by having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information.
3 more elements
A method for an authority to generate authenticated information about revoked certificates, comprising the steps of:
- (a) providing a subgroup, containing less than all of the revoked certificates, that contains all of the revoked certificates sharing a given characteristic of at least one of:
- certificates versions, certificate serial numbers, certificate algorithm identifiers, certificate public key information, certificate validity, certificate user names, and certificate date information, wherein the at least one characteristic further includes having a function applied to at least a portion of the certificate yield a given value;
- (b) generating a data string identifying the revoked certificates in the subgroup and the characteristic;
- and
- (c) generating the authenticated information by having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information.
3 more elements
A method for an authority to generate authenticated information about revoked certificates, comprising the steps of:
- (a) providing a subgroup, containing less than all of the revoked certificates, that contains all of the revoked certificates sharing a given characteristic of at least one of:
- certificates versions, certificate serial numbers, certificate algorithm identifiers, certificate public key information, certificate validity, certificate user names, and certificate date information, wherein the at least one characteristic further includes having a hash function applied to at least a portion of the revoked certificate yield a given value;
- (b) generating a data string identifying the revoked certificates in the subgroup and the characteristic;
- and
- (c) generating the authenticated information by having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information.
3 more elements
A method for an authority to generate authenticated information about revoked conventional certificates, comprising the steps of:
- (a) providing a subgroup, containing less than all the revoked conventional certificates, that contains all of the revoked conventional certificates sharing a given characteristic;
- (b) generating a data string identifying the revoked conventional certificates in the subgroup and the characteristic;
- and
- (c) generating the authenticated information by having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information, wherein the additional information includes compressed date information indicating a revocation date of at least one of the certificates, and wherein the compressed date information indicates a number of days between the revocation date and a reference date.
2 more elements
A method for an authority to generate authenticated information about revoked conventional certificates, comprising the steps of:
- (a) providing a subgroup, containing less than all the revoked conventional certificates, that contains all of the revoked conventional certificates sharing a given characteristic;
- (b) generating a data string identifying the revoked conventional certificates in the subgroup and the characteristic;
- and
- (c) generating the authenticated information by having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information, wherein each revoked certificate has an identifier and the characteristic includes having given bits in the identifier be equal to given values.
2 more elements
A method for an authority to generate authenticated information about revoked conventional certificates, comprising the steps of:
- (a) providing a subgroup, containing less than all the revoked conventional certificates, that contains all of the revoked conventional certificates sharing a given characteristic;
- (b) generating a data string identifying the revoked conventional certificates in the subgroup and the characteristic;
- and
- (c) generating the authenticated information by having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information, wherein the characteristic includes having a function applied to at least a portion each of the revoked certificates yield a given value.
2 more elements
A method for an authority to generate authenticated information about revoked conventional certificates, comprising the steps of:
- (a) providing a subgroup, containing less than all the revoked conventional certificates, that contains all of the revoked conventional certificates sharing a given characteristic;
- (b) generating a data string identifying the revoked conventional certificates in the subgroup and the characteristic;
- and
- (c) generating the authenticated information by having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information, wherein the characteristic includes having a hash function applied to at least a portion of each of the revoked certificates yield a given value.
2 more elements
A method for an authority to generate authenticated information about revoked conventional certificates, comprising the steps of:
- (a) providing a subgroup, containing less than all the revoked conventional certificates, that contains all of the revoked conventional certificates sharing a given characteristic;
- (b) generating a data string identifying the revoked conventional certificates in the subgroup and the characteristic;
- and
- (a) generating the authenticated information by having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information, wherein the additional information includes additional items that are shared by two or more of the revoked certificates.
2 more elements
A method for an authority to provide authenticated information about revoked certificates, comprising the steps of:
- (a) after issuance of the revoked certificates, choosing a plurality of characteristics such that each of the revoked certificates possesses at least one of the characteristics and a number of certificates is less than a given amount;
- (b) for each of the characteristics, generating a data string that identifies the characteristic and all the revoked certificates possessing the characteristic;
- and
- (c) generating the authenticated information by, for each data string, having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information, wherein the additional information includes compressed date information indicating a revocation date of at least one of the certificates and wherein the compressed date information indicates a number of days between the revocation date and a reference date.
2 more elements
A method for an authority to provide authenticated information about revoked certificates, comprising the steps of:
- (a) after issuance of the revoked certificates, choosing a plurality of characteristics such that each of the revoked certificates possesses at least one of the characteristics and a number of certificates is less than a given amount;
- (b) for each of the characteristics, generating a data string that identifies the characteristic and all the revoked certificates possessing the characteristic;
- and
- (c) generating the authenticated information by, for each data string, having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information, wherein the characteristic includes having a function applied to at least a portion of each of the revoked certificates yield a given value.
2 more elements
A method for an authority to provide authenticated information about revoked certificates, comprising the steps of:
- (a) after issuance of the revoked certificates, choosing a plurality of characteristics such that each of the revoked certificates possesses at least one of the characteristics and a number of certificates is less than a given amount;
- (b) for each of the characteristics, generating a data string that identifies the characteristic and all the revoked certificates possessing the characteristic;
- and
- (c) generating the authenticated information by, for each data string, having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information, wherein the additional information includes additional items that are shared by two or more of the revoked certificates.
2 more elements
A method for an authority to provide authenticated information about certificates, comprising the steps of:
- (a) choosing a set of two or more characteristics such that each of the certificates possesses at least one of the characteristics;
- (b) for each of the characteristics, generating a data string identifying the characteristic, the certificates possessing the characteristic, and information about the certificates possessing the characteristic;
- (c) generating the authenticated information by, for each of the data strings, having the authority authenticate at least one of:
- the data string alone, the data string together with date information, and the data string together with additional information;
- (d) following generating the authenticated information, choosing a new set of characteristics such that each of the certificates possesses at least one characteristic of the new set of characteristics;
- (e) for each characteristic of the new set of characteristics, generating a new data string identifying the characteristic, the certificates possessing the characteristic, and information about the certificates possessing the characteristic;
- and
- (f) regenerating the authenticated information by, for each of the new data strings, having the authority authenticate at least one of:
- the new data string alone, the new data string together with date information, and the new data string together with additional information.
6 more elements
A method for an intermediary to prove to a first user whether one or more certificates have been revoked, comprising the steps of:
- (a) causing the first user to receive authenticated information generated by an authority by the steps of:
- (i) dividing identifiers of the revoked certificates into a plurality of lists, wherein each of the lists includes all identifiers between a first value and a second value, and at least one of the lists contains at least two identifiers;
- and
- (ii) for each of the lists, generating an authenticated list by having the authority authenticate at least one of:
- the list alone, the list together with date information, the list together with the first and second values, the list together with the first and second values and date information, and the list together with additional information.
2 more elements
A method for an intermediary to prove to a first user whether one or more certificates have been revoked, comprising the steps of:
- (a) causing the first user to receive authenticated information generated by an authority by the steps of:
- (i) dividing revoked certificates into a plurality of subgroups, wherein at least one of the subgroups contains all the revoked certificates having an identifier between a given upper bound and a given lower bound and contains at least two revoked certificates;
- (ii) for each of the subgroups, generating a data string indicating the revoked certificates belonging to the subgroup;
- and
- (iii) or each of the data strings, generating authenticated information by having the authority authenticate at least one of:
- the data string alone, the data string together with an indication of the subgroup, the data string together with date information, the data string together with date information and an indication of the subgroup, and the data string together with additional information.
3 more elements
Dependencies are inferred from the claim text.