Efficient retrieval of cryptographic evidence

• US 20060294576A1
• Filed: 06/24/2005
• Published: 12/28/2006
• Est. Priority Date: 06/24/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Cross, David B., Hallin, Philip J., Yiu, Kelvin S., Hurst, Ryan M., Agarwal, Vishal
• Granted Patent: US 7,818,575 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

An efficient protocol for retrieving cryptographic evidence may be selected by evaluating a local policy and a number of relevant factors. Furthermore, updated cryptographic evidence may be prefetched during a time period in which there is a low volume of requests for cryptographic evidence. This low volume time period may be defined, approximately, as an overlapping window in which both a first cryptographic evidence publication and a second cryptographic evidence publication are valid.

Claims

1. A method for making a selection of a preferred cryptographic evidence retrieval scheme for use in validating a cryptographic statement, the method comprising:

examining a policy for validating the cryptographic statement;

identifying at least one factor relevant to the selection of the preferred cryptographic evidence retrieval scheme; and

selecting the preferred cryptographic evidence retrieval scheme in accordance with both the policy and the factor.

2. The method of claim 1, comprising identifying the at least one factor relevant to the selection of the preferred cryptographic evidence retrieval scheme, the factor being a user preference for the preferred cryptographic evidence retrieval scheme.

3. The method of claim 1, comprising identifying the at least one factor relevant to the selection of the preferred cryptographic evidence retrieval scheme, the factor being a response stapled to the cryptographic statement, the response corresponding to the preferred cryptographic evidence retrieval scheme.

4. The method of claim 1, wherein identifying the factor comprises calculating a quantity of cached online certificate status protocol responses from an issuer of the cryptographic statement.

5. The method of claim 4, wherein selecting the preferred cryptographic evidence retrieval scheme comprises:

selecting a certificate revocation list as the preferred cryptographic evidence retrieval scheme if the quantity of cached online certificate status protocol responses is more than the threshold number; and

selecting online certificate status protocol as the preferred cryptographic evidence retrieval scheme if the quantity of cached online certificate status protocol responses is not more than the threshold number.

6. A computer-readable medium having computer executable instructions for performing the steps recited in claim 1.

7. A method for efficiently prefetching cryptographic evidence, comprising:

identifying a next update time at which a first cryptographic evidence publication ceases to be valid;

identifying a next publish time at which a second cryptographic evidence publication becomes valid; and

selecting a prefetch time that is a time between the next publish time and the next update time; and

prefetching the cryptographic evidence at the prefetch time.

8. The method of claim 7, comprising selecting the prefetch time by selecting a random number and calculating the prefetch time using the random number.

9. The method of claim 7, wherein selecting the prefetch time comprises:

calculating a first time by adding a delta time period to the next publish time;

calculating a second time by subtracting the delta time period from the next update time; and

selecting a third time within an adjusted time period between the first time and the second time; and

setting the prefetch time to be the third time.

10. The method of claim 7, wherein selecting the third time comprises:

calculating a proxy identifier based on caching information;

selecting a random number;

calculating a first part that is a modulus of half of the adjusted time period and the proxy identifier;

calculating a second part that is a modulus of half of the adjusted time period and the random number; and

setting the third time to be the sum of the next publish time, the delta time, the first part, and the second part.

11. The method of claim 10, further comprising prefetching the cryptographic evidence according to a prefetch priority order corresponding to the frequency with which an issuer of the cryptographic evidence is checked.

12. A computer-readable medium having computer executable instructions for performing the steps recited in claim 7.

13. A method for selecting a cryptographic evidence retrieval scheme for validating a cryptographic statement, comprising:

calculating a quantity of cached online certificate status protocol responses from an issuer of the cryptographic statement; and

determining whether to request the cryptographic evidence using online certificate status protocol or a certificate revocation list based, at least in part, on a relationship between the quantity of responses and a threshold number.

14. The method of claim 13, comprising:

determining to request the cryptographic evidence using the certificate revocation list if the quantity of responses is more than the threshold number; and

determining to request the cryptographic evidence using online certificate status protocol if the quantity of responses is less than or equal to the threshold number.

15. The method of claim 13, wherein calculating the quantity comprises:

assigning a prefix to each cached online certificate status protocol response that is indicative of its issuer; and

counting a number of cached online certificate status protocol responses that have been assigned the prefix.

16. The method of claim 13, further comprising determining whether to request the cryptographic evidence using online certificate status protocol or a certificate revocation list based, at least in part, on a user preference for either online certificate status protocol or a certificate revocation list.

17. The method of claim 13, further comprising using a time valid stapled online certificate status protocol response to validate the cryptographic statement if it is provided along with the cryptographic statement.

18. The method of claim 13, further comprising:

determining whether a previously downloaded version of the cryptographic evidence is still valid; and

if so, then using the previously downloaded version to validate the cryptographic statement; and

if not, then requesting an updated version of the cryptographic evidence to validate the cryptographic statement.

19. The method of claim 18, wherein requesting an updated version of the cryptographic evidence comprises:

determining whether the cryptographic evidence has been updated since the previously downloaded version was downloaded; and

if so, then downloading the updated version of the cryptographic evidence to validate the cryptographic statement; and

if not, then using the previously downloaded version of the cryptographic evidence to validate the cryptographic statement.

20. A computer-readable medium having computer executable instructions for performing the steps recited in claim 13.