Trust information delivery scheme for certificate validation

An apparatus comprising:

• a client device comprising a memory housing a trust information object (TIO) associated with a client, said TIO comprising:
• a plurality of hash values for a plurality of trust entity certificates, wherein the plurality of hash values represent hashes generated from a public key portion of the plurality of trust entity certificates, said TIO further comprising associated trust information indicating a level of trust for a trusted entity associated with each of said plurality of trust entity certificates;
• wherein the client device is configured to receive a certificate chain from a server during an SSL handshake between said client device and said server, wherein the certificate chain comprises a plurality of unverified certificates from the server, wherein the plurality of unverified certificates includes a first unverified root certificate of a certificate authority issuing the plurality of unverified certificates;
• and
• wherein the client device is further configured to:
• hash the first unverified root certificate to generate a digest;
• compare the resulting digest against the plurality of hash values obtained from the TIO;
• when the resulting digest and a first corresponding trust bit of the first unverified root certificate are found in said TIO, wherein finding the resulting digest and the first corresponding trust bit of the first unverified root certificate in said TIO results in a first match:
• validate said certificate chain;
• and
• initiate a session with the server.

A method comprising:

• connecting to a server to update an old trust information object (TIO) with a new TIO over a secure socket layer (SSL), said old TIO and new TIO each comprising:
• a plurality of hash values, wherein the plurality of hash values represent hashes generated from a public key portion of a plurality of trust entity certificates, said old TIO and new TIO each further comprising a plurality of trust bit vectors associated with the plurality of trust entity certificates, wherein the plurality of trust bit vectors indicate a level of trust for each of trusted entities associated with each of the plurality of trust entity certificates;
• hashing a public key portion of a root certificate of a certificate authority certifying the server to generate a first hash value;
• performing a first check to ensure that the generated first hash value matches a verified hash value from the plurality of hash values in the old TIO;
• performing a second check to ensure that a trust bit within one of the plurality of trust bit vectors in the old TIO indicates that a level of trust associated with the server is adequate;
• performing a third check to ensure that a first timestamp associated with the new TIO is later than a second timestamp associated with the old TIO;
• and
• overwriting the old TIO with the new TIO.