# US 8,572,730 B1 · Systems and methods for revoking digital signatures > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,572,730 B1 - Document ID: US8572730B1 - Status: Granted - Kind: B1 - Application number: 13/036,857 - Filed: 2011-02-28 - Granted: 2013-10-29 - Earliest claimed: 2011-02-28 - Assignees: Symantec Corporation - Applicants: William E. Sobel; Sourabh Satish - Inventors: William E. Sobel; Sourabh Satish - Web page: https://patentgrep.com/patent/US8572730B1 ## CPC - H04L 9/3247: {involving digital signatures} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer-implemented method for revoking digital signatures may include (1) identifying an executable file signed with a digital signature, (2) determining that the executable file is subject to a revocation check used to determine whether the digital signature has been revoked, (3) classifying the executable file based on at least one attribute of the executable file, (4) determining, based on the classification of the executable file, that the executable file is a member of a revocation group, wherein a status identifier associated with the revocation group indicates whether any member of the revocation group has a digital signature revocation, (5) determining, based on the status identifier associated with the revocation group, that the digital signature of the executable file has potentially been revoked, and then (6) performing the revocation check on the executable file. Various other methods, systems, and computer-readable media are also disclosed. ## Claims ### Claim 1 A computer-implemented method for revoking digital signatures, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying an executable file signed with a digital signature; determining that the executable file is subject to a revocation check, wherein the revocation check determines whether the digital signature has been revoked; classifying the executable file based on at least one attribute of the executable file; determining, based on the classification of the executable file, that the executable file is a member of a revocation group, wherein a status identifier of the revocation group indicates whether any member of the revocation group has a digital signature revocation; determining that the status identifier of the revocation group indicates that at least one member of the revocation group has a digital signature revocation; performing, based at least in part on determining that the status identifier of the revocation group indicates that at least one member of the revocation group has a digital signature revocation, the revocation check on the executable file. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: determining, based on the revocation check, that the digital signature has been revoked; performing a security action based on the determination that the digital signature has been revoked. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, wherein the security action comprises at least one of: preventing execution of the executable file; quarantining the executable file; deleting the executable file; updating the executable file. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the attribute of the executable file comprises an attribute of the digital signature. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein the attribute of the digital signature comprises a signatory of the digital signature. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, where identifying the executable file comprises at least one of: identifying an attempt to execute the executable file; identifying the executable file during a security scan. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein: the status identifier of the revocation group comprises a first timestamp indicating the latest time at which a digital signature of any member of the revocation group was revoked; performing the revocation check on the executable file is further based at least in part on: identifying a second timestamp indicating when the digital signature was last checked for revocation; determining that the second timestamp precedes the first timestamp. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, further comprising receiving a list of status identifiers corresponding to a plurality of revocation groups, the plurality of revocation groups comprising the revocation group. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, where receiving the list of status identifiers comprises at least one of: periodically receiving an updated version of the list of status identifiers; updating the list of status identifiers whenever the list of status identifiers is updated on a revocation server. ### Claim 10 A system for revoking digital signatures, the system comprising: an identification module programmed to: identify an executable file signed with a digital signature; determine that the executable file is subject to a revocation check, wherein the revocation check determines whether the digital signature has been revoked; a classification module programmed to: classify the executable file based on at least one attribute of the executable file; determine, based on the classification of the executable file, that the executable file is a member of a revocation group, wherein a status identifier of the revocation group indicates whether any member of the revocation group has a digital signature revocation; a determination module programmed to determine that the status identifier of the revocation group indicates that at least one member of the revocation group has a digital signature revocation; a checking module programmed to perform, based at least in part on determining that the status identifier of the revocation group indicates that at least one member of the revocation group has a digital signature revocation, the revocation check on the executable file; at least one processor configured to execute the identification module, the classification module, the determination module, and the checking module. ### Claim 11 (depends on 10) The system of claim 10, wherein the checking module is further programmed to: determine, based on the revocation check, that the digital signature has been revoked; perform a security action based on the determination that the digital signature has been revoked. ### Claim 12 (depends on 11) The system of claim 11, wherein the security action comprises at least one of: preventing execution of the executable file; quarantining the executable file; deleting the executable file; updating the executable file. ### Claim 13 (depends on 10) The system of claim 10, wherein the attribute of the executable file comprises an attribute of the digital signature. ### Claim 14 (depends on 13) The system of claim 13, wherein the attribute of the digital signature comprises a signatory of the digital signature. ### Claim 15 (depends on 10) The system of claim 10, where the identification module is programmed to identify the executable file by at least one of: identifying an attempt to execute the executable file; identifying the executable file during a security scan. ### Claim 16 (depends on 10) The system of claim 10, wherein: the status identifier of the revocation group comprises a first timestamp indicating the latest time at which a digital signature of any member of the revocation group was revoked; the checking module is programmed to perform the revocation check on the executable file based at least in part on: identifying a second timestamp indicating when the digital signature was last checked for revocation; determining that the second timestamp precedes the first timestamp. ### Claim 17 (depends on 10) The system of claim 10, wherein the determination module is further programmed to receive a list of status identifiers corresponding to a plurality of revocation groups, the plurality of revocation groups comprising the revocation group. ### Claim 18 (depends on 17) The system of claim 17, where the determination module is programmed to receive the list of status identifiers by at least one of: periodically receiving an updated version of the list of status identifiers; updating the list of status identifiers whenever the list of status identifiers is updated on a revocation server. ### Claim 19 A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to: identify an executable file signed with a digital signature; determine that the executable file is subject to a revocation check, wherein the revocation check determines whether the digital signature has been revoked; classify the executable file based on at least one attribute of the executable file; determine, based on the classification of the executable file, that the executable file is a member of a revocation group, wherein a status identifier of the revocation group indicates whether any member of the revocation group has a digital signature revocation; determine that the status identifier of the revocation group indicates that at least one member of the revocation group has a digital signature revocation; perform, based at least in part on determining that the status identifier of the revocation group indicates that at least one member of the revocation group has a digital signature revocation, the revocation check on the executable file. ### Claim 20 (depends on 19) The non-transitory computer-readable-storage medium of claim 19, wherein the one or more computer-executable instructions further cause the computing device to: determine, based on the revocation check, that the digital signature has been revoked; perform a security action based on the determination that the digital signature has been revoked.