Certificate revocation notification systems

• US 20050114653A1
• Filed: 09/24/2004
• Published: 05/26/2005
• Est. Priority Date: 07/15/1999
• Status: Abandoned Application

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Sudia, Frank W.
• Application Number:
  US10/949,713
• Publication Number:
  US 20050114653A1
• Time in Patent Office: Days
• US Class Current: 713/158
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3218 using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A revocation notification system for a public key certificate and associated method are provided. At the time of issuance, a CA requests and receives from an independent revocation service provider entity a THV corresponding to an IRV under the sole control of said revocation service provider. It then embeds such THV into the public key certificate and digitally signs the public key certificate with a private key. An entity requests revocation from the revocation service provider. The revocation service provider ceases publication of valid PFI updates for the public key certificate.

Claims

1. (canceled)

2. A method of managing revocation status for public key certificates, comprising:

determining an initial random value;

applying a one-way hash function N times to the initial random value to obtain a final hashed value;

a certificate authority issuing a public key certificate that includes the final hashed value digitally signed by the certificate authority;

a third party receiving the digital certificate and a first periodic freshness indicator at a first time T1;

the third party applying the one-way hash function to the first periodic freshness indicator M times to obtain a first final value and caching intermediate results thereof, where M is a number of refresh intervals from the date of issuance of the digital certificate to T1;

the third party confirming that the digital certificate has not been revoked prior to T1 by confirming that the first final value equals the final hashed value of the digital certificate; and

in response to receiving a second periodic freshness indicator at a time T2 that is after T1, the third party using one of the cached intermediate values corresponding to T2 to confirm that the certificate has not been revoked prior to T2.