Mechanisms for certificate revocation status verification on constrained devices

A method comprising:

• receiving a random nonce at a client device before authentication protocol execution;
• determining, using a processor, whether a new revocation status response is to be obtained based on at least a portion of an authentication protocol request message cached status response is usable:
• obtaining revocation status information using the random nonce in the client device when network connectivity is available;
• determining, using the processor, whether a cached status response is usable:
• upon determination that the cached status response is usable, executing the authentication protocol with the processor, wherein the authentication protocol response is verified based on the nonce;
• and
• generating, using the processor, a revocation status response corresponding to the revocation status information that is configured for verification based on the secure nonce, and
• upon determination that the cached status response is not usable, executing the new revocation status response that is configured for verification based on a second secure nonce.

A method comprising:

• receiving a random seed value at a client device from a verifier device;
• deriving at the client device a revocation status nonce for a revocation status protocol request;
• determining, using a processor, whether a new revocation status response is to be obtained based on at least a portion of the revocation status protocol request;
• determining, using the processor, whether a cached status response is usable:
• upon determination that the cached status response is usable, verifying, using the processor, an authentication protocol response with an authentication protocol nonce;
• and
• verifying, using the processor, a revocation status response with the revocation status nonce, wherein the revocation status nonce is configured for a second derivation, via the verifier device, according to the random seed value prior to proxied status response verification, and upon determination that the cached status response is not usable, executing the new revocation status response that is configured for verification based on a second secure nonce.

An apparatus comprising a processor, and a memory in communication with the processor and having computer coded instructions stored therein, said instructions configured, when executed by the processor, to cause the apparatus to perform:

• receiving a nonce as at least a portion of an authentication protocol request message;
• determining, using the processor, whether a new revocation status response is to be obtained based on at least the portion of the authentication protocol request message;
• deriving, using the processor, a secure nonce for a revocation status protocol request using the nonce from the authentication protocol request as an operator of a key derivation function;
• determining, using the processor, whether a cached status response is usable:
• upon determination that the cached status response is usable, providing an authentication protocol response comprising the nonce and the secure nonce, wherein the authentication protocol response is configured for verification based on the nonce;
• and
• generating, using the processor, a revocation status response that is configured for verification based on the secure nonce, and
• upon determination that the cached status response is not usable, executing the new revocation status response that is configured for verification based on a second secure nonce.

An apparatus comprising a processor, and a memory in communication with the processor and having computer coded instructions stored therein, said instructions configured, when executed by the processor, to cause the apparatus to perform:

• receiving a random nonce at a client device before authentication protocol execution;
• determining, using the processor, whether a new revocation status response is to be obtained based on at least a portion of an authentication protocol request message;
• obtaining revocation status information using the random nonce in the client device when network connectivity is available;
• determining, using the processor, whether a cached status response is usable:
• upon determination that the cached status response is usable, executing the authentication protocol, wherein the authentication protocol response is verified based on the nonce;
• and generating, using the processor, a revocation status response corresponding to the revocation status information that is configured for verification based on the secure nonce, and upon determination that the cached status response is not usable, executing the new revocation status response that is configured for verification based on a second secure nonce.

An apparatus comprising a processor, and a memory in communication with the processor and having computer coded instructions stored therein, said instructions configured, when executed by the processor, to cause the apparatus to perform:

• receiving a random seed value at a client device from a verifier device;
• deriving at the client device a revocation status nonce for a revocation status protocol request;
• determining, using the processor, whether a new revocation status response should be obtained based on at least a portion of the revocation status protocol request;
• determining, using the processor, whether a cached status response is usable;
• upon determination that the cached status response is usable, verifying, using the processor, an authentication protocol response with an authentication protocol nonce;
• verifying, using the processor, the revocation status response with the revocation status nonce, wherein the revocation status nonce is configured for a second derivation, via the verifier device, according to the random seed value prior to proxied status response verification, and
• upon determination that the cached status response is not usable, executing the new revocation status response that is configured for verification based on a second secure nonce.