Certificate issue lists

• US 5,717,757 A
• Filed: 11/19/1996
• Issued: 02/10/1998
• Est. Priority Date: 08/29/1996
• Status: Expired due to Term

• Current Assignee: Assa Abloy AB
• Original Assignee: Silvio Micali
• Inventors: Micali, Silvio
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/752,223
• Time in Patent Office: 448 Days
• Field of Search: 380/23, 380/25, 380/29, 380/30, 380/49, 380/50
• US Class Current: 713/158
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

An authority provides authenticated information about a plurality of certificate identifiers by generating a data string identifying all the plurality of certificate identifiers and by having the authority authenticate one or more of the data string alone, the data string together with date information, or the data string together with additional information. The date information may include the date of authentication. The additional information may include a date of issuance of at least one of the certificates. The additional information may include certificate information about at least some of the issued certificates. The certificate information may include one or more of: revocation information or validity information of at least some of the issued certificates.

Claims

1. A method for an authority to provide authenticated information about a plurality of issued certificates, comprising the steps of:

(a) generating a data string that includes information identifying all the plurality of issued certificates; and

(b) having the authority authenticate the data string.

2. A method according to claim 1, wherein the data string further includes information indicating a date of authentication of the data string.

3. A method according to claim 1, wherein the data string further includes information indicating a date of issuance of at least one of the certificates.

4. A method according to claim 1, wherein the data string further includes certificate information about a subset of the issued certificates.

5. A method according to claim 4, wherein the certificate information includes at least one of:

revocation information and validity information of the subset of the issued certificates.

6. A method for an authority to generate authenticated information about a plurality of certificates, comprising the steps of:

(a) generating a data string indicating a first set of identifiers, where identifiers, in the first set correspond to issued certificates, and a second set of identifiers, wherein identifiers of all issued certificates are outside the second set; and

(b) having the authority generate the authenticated information by authenticating the data string.

7. A method according to claim 6, wherein the data string further includes information indicating a date of authentication of the data string.

8. A method according to claim 6, wherein the data string further includes certificate information about a subset of the certificates.

9. A method according to claim 8, wherein the certificate information includes at least one of:

revocation information and validity information of the subset of the certificates.

10. A method according to claim 6, wherein the data string further includes a date of issuance of at least one of the certificates.

11. A method for an authority to provide authenticated information about certificate identifiers, comprising, the steps of:

(a) generating data indicating a set of identifiers, wherein an identifier of each issued certificate is outside the set; and

(b) having the authority authenticate the data.

12. A method according to claim 11, wherein the data further includes certificate information about issued certificates.

13. A method to provide authenticated information about one or more unissued certificate identifiers, comprising the steps of:

(a) generating data that includes information identifying the one or more unissued certificate identifiers; and

(b) authenticating the data.

14. A method for an authority to generate authenticated issuance information about a plurality of certificate identifiers, comprising the steps of:

(a) mapping at least two of the plurality of certificate identifiers to predetermined bit positions in a data string and having a subset of bits at the bit positions convey issuance information about the at least two certificates, the issuance information indicating whether each of the certificate identifiers corresponds to an issued certificate; and

(b) generating authenticated issuance information by having the authority authenticate the data string.

15. A method according to claim 14, wherein mapping to predetermined bit positions reduces an amount of bits used to represent certificates that are mapped.

16. A method according to claim 14, wherein an amount of bits used to represent the certificates in the authenticated issuance information is less than a total number of bits contained in serial numbers of the certificates.

17. A method to generate authenticated issuance information about a plurality of certificates, comprising the steps of:

(a) generating a data string containing information identifying all issued certificates among the plurality of certificates that share a given characteristic; and

(b) generating the authenticated issuance information by authenticating the data string.

18. A method according to claim 17, wherein each issued certificate has an identifier belonging to an ordered set and the characteristic includes having the identifier be between a given lower bound and a given upper bound in the ordered set.

19. A method according to claim 17, wherein each issued certificate has an identifier and the characteristic includes having given bits in the identifier be equal to given values.

20. A method according to claim 17, wherein each issued certificate has an identifier and the characteristic includes having a hash function applied to at least a portion of each issued certificate yield a given value.

21. A method according to claim 17, wherein the characteristic includes having the certificate contain a given value in a given field.

22. A method to generate authenticated issuance information about a plurality of certificate identifiers, comprising the steps of:

(a) generating a data string containing information identifying all unissued certificate identifiers that share a given characteristic; and

(b) generating the authenticated information by authenticating the data string.

23. A method according to claim 22, wherein each unissued certificate identifier belongs to an ordered set and the characteristic includes having the identifier be between a given lower bound and a given upper bound in the ordered set.

24. A method according to claim 22, wherein the characteristic includes having given bits in the identifier be equal to given values.

25. A method according to claim 22, wherein the characteristic includes having a hash function applied to at least a portion of the unissued certificate identifier yield a given value.

26. A method according to claim 22, wherein the characteristic includes having the certificate contain a given value in a given field.

27. A method for an authority to generate authenticated information about a plurality of certificate identifiers, comprising the steps of:

(a) generating a data string containing information identifying a set containing all of the certificate identifiers that share a given characteristic and correspond to issued certificates, at least one of the issued certificates not being revoked; and

(b) generating the authenticated information by having the authority authenticate the data string.

28. A method for an authority to provide authenticated issuance information about issued certificates, comprising the steps of:

(a) choosing a plurality of characteristics;

(b) for each of the characteristics, generating a data string that contains information that identifies the characteristic and all the issued certificates possessing the characteristic, wherein at least one of the certificates is not revoked and wherein each of the certificates possess at least one of the characteristics; and

(c) generating the authenticated information having the authority authenticate each of the data strings.

29. A method according to claim 28, wherein at least one of the data strings further includes revocation information for a subset of the certificates.

30. A method according to claim 29, wherein the characteristic includes an identifier for a subset of the certificates.

31. A method for an authority to provide authenticated issuance information about certificate identifiers, comprising the steps of:

(a) choosing a plurality of characteristics wherein each of the certificate identifiers possesses at least one of the characteristics;

(b) for each of the characteristics, generating a data string containing information that indicates the characteristic and a set of unissued certificate identifiers possessing the characteristic; and

(c) generating the authenticated information by having the authority authenticate each of the data strings.

32. A method according to claim 31, wherein at least one of the data strings includes certificate information for a subset of issued certificates.

33. A method according to claim 31, wherein at least one of the characteristics corresponds to an identifier for at least one of the certificates.

34. A method to provide authenticated issuance information about certificate identifiers, comprising the steps of:

(a) choosing a plurality of characteristics wherein each of the certificate identifiers possesses at least one of the characteristics;

(b) for each of the characteristics, generating a data string that identifies the characteristic, all the identifiers for issued and unissued certificates possessing the characteristic, and information distinguishing the issued certificate identifiers from the unissued certificate identifiers; and

(c) generating the authenticated information by authenticating each of the data strings.

35. A method according to claim 34, wherein the at least one of the data strings further includes revocation information for a subset of the certificates.

36. A method according to claim 34, wherein the characteristic corresponds to identifiers for a subset of the certificates.

37. A method for providing authenticated information about certificates, comprising the steps of:

(a) receiving a request for information about a certificate including a proof that the certificate is issued;

(b) verifying that the proof is valid; and

(c) in response to the proof being valid, providing the requested information.

38. A method according to claim 37, wherein the proof includes providing an entire CA-authenticated certificate.

39. A method according to claim 38, wherein verifying includes comparing the entire CA-authenticated certificate to an on hand copy of a verified CA-authenticated certificate.

40. A method according to claim 38, wherein verifying includes comparing a function evaluated at the entire CA-authenticated certificate to the function evaluated at an on hand copy of a verified CA-authenticated certificate.

41. A method according to claim 38, wherein a CA digitally signs the certificate to authenticate the certificate and verifying includes verifying the signature of the CA.

42. A method according to claim 37, wherein the proof includes a hash of an entire CA-authenticated certificate.

43. A method according to claim 42, wherein verifying includes comparing the hash of the CA-signed certificate to an on hand copy of a hash verified entire CA-signed certificate.

44. A method according to claim 37, wherein the proof includes a given function of an entire CA-authenticated certificate.

45. A method for providing authenticated information about certificates to a requestor, comprising the steps of:

(a) receiving a request for a first type of information about at least one certificate including a proof that the requestor knows at least a second type of information about the certificate;

(b) verifying that the proof is valid; and

(c) in response to the proof being valid, providing the first type of information to the requestor.

46. A method according to claim 45, wherein the proof is interactive.

47. A method according to claim 45, wherein the second type of information is authenticated.

48. A method of providing to a user authenticated information about an identifier for a certificate, comprising the steps of:

(a) having the user provide the identifier to an intermediary; and

(b) having the intermediary cause the user to receive authenticated information indicating that the identifier does not correspond to an issued certificate.