Certificate revocation system

• US 5,793,868 A
• Filed: 11/05/1996
• Issued: 08/11/1998
• Est. Priority Date: 08/29/1996
• Status: Expired due to Term

• Current Assignee: Assa Abloy AB
• Original Assignee: Silvio Micali
• Inventors: Micali, Silvio
• Primary Examiner(s): Barron, Jr., Gilberto
• Application Number:
  US08/746,007
• Time in Patent Office: 644 Days
• Field of Search: 380/23, 380/28, 380/30
• US Class Current: 380/28
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Authenticating information about revoked certificates includes generating data identifying the revoked certificates, generating information about the revoked certificates including the data without including the revocation date of every one of the revoked certificates, and having the authority authenticate the information. The data may be generated by performing a hash of at least a portion of each of the certificates. Generating information about the revoked certificates may include adding a date indicating when the information was authenticated and may exclude the revocation date of any one of the revoked certificates in the list.

Claims

1. A method for an authority to provide authenticated information about revoked certificates, comprising the steps of:

(a) generating data identifying the revoked certificates;

(b) generating information about the revoked certificates including the data without including the revocation date of every one of the revoked certificates, wherein the information is independent of issue dates of the revoked certificates; and

(c) having the authority authenticate the information.

2. A method according to claim 1, further comprising the step of:

(d) generating the data by performing a hash of at least a portion of each of the certificates.

3. A method according to claim 1, wherein the information generated about the revoked certificates includes the data without including the revocation date of at least half of the revoked certificates.

4. A method according to claim 1, wherein generating information about the revoked certificates includes adding a date indicating when the information was authenticated.

5. A method according to claim 4, wherein the information generated about the revoked certificates includes the data without including the revocation date of any one of the revoked certificates in the list.

6. A method according to claim 1, wherein generating the data includes specifying certificate serial numbers of the revoked certificates.

7. A method according to claim 6, further comprising the steps of:

(d) mapping a revoked certificate to one or more bit positions in the data and having values at the one or more bit positions convey information about the certificate.

8. A method according to claim 1, wherein the data is obtained by compressing a list of identifiers of the revoked certificates.

9. A method according to claim 8, wherein each revoked certificate has a serial number and generating the data produces less bits than a summation of all the bits of the serial numbers of the revoked certificates.

10. A method according to claim 1, further comprising the steps of:

(d) mapping a revoked certificate to one or more bit positions in the data and having values at the one or more bit positions convey information about the certificate.

11. A method according to claim 1, wherein the step of authenticating the information includes digitally signing at least one of:

the information alone, the information together with date information, and the information together with additional data.

12. A method for an authority to provide authenticated information about revoked certificates, comprising the steps of:

(a) generating minimal data identifying the revoked certificates;

(b) generating information about the revoked certificates only by adding to the data one or more additional items that are shared by all the revoked certificates, wherein the information is independent of issue dates of the revoked certificates; and

(c) having the authority authenticate the information.

13. A method according to claim 12, wherein generating the data includes specifying certificate serial numbers of the revoked certificates.

14. A method according to claim 13, further comprising the steps of:

(d) mapping a revoked certificate to one or more bit positions in the data and having values at the one or more bit positions convey information about the certificate.

15. A method according to claim 12, wherein the data is obtained by compressing a list of identifiers of the revoked certificates.

16. A method according to claim 12, wherein each revoked certificate has a serial number and generating the data produces less bits than a summation of all the bits of the serial numbers of the revoked certificates.

17. A method according to claim 12, further comprising the steps of:

(d) mapping a revoked certificate to one or more bit positions in the data and having values at the one or more bit positions convey information about the certificate.

18. A method according to claim 12, wherein authenticating the information includes digitally signing at least one of:

the information alone, the information together with date information, and the information together with additional data.

19. A method for an authority to provide authenticated information about revoked certificates, comprising the steps of:

(a) generating minimal data identifying the revoked certificates;

(b) generating information about the revoked certificates by only adding to the data one or more additional items that are shared by two or more of the revoked certificates, wherein the information is independent of issue dates of the revoked certificates; and

(c) having the authority authenticate the information.

20. A method according to claim 19, wherein generating the data includes specifying certificate serial numbers of the revoked certificates.

21. A method according to claim 20, further comprising the steps of:

(d) mapping a revoked certificate to one or more bit positions in the data and having values at the one or more bit positions convey information about the certificate.

22. A method according to claim 19, wherein the data is obtained by compressing a list of identifiers of the revoked certificates.

23. A method according to claim 22, wherein each revoked certificate has a serial number and generating the data produces less bits than a summation of all the bits of the serial numbers of the revoked certificates.

24. A method according to claim 19, further comprising the steps of:

(d) mapping a revoked certificate to one or more bit positions in the data and having values at the one or more bit positions convey information about the certificate.

25. A method according to claim 19, wherein authenticating the information includes digitally signing at least one of:

the information alone, the information together with date information, and the information together with additional data.

26. A method for an authority to provide authenticated information about revoked certificates, comprising the steps of:

(a) generating minimal data identifying the revoked certificates;

(b) generating information about the revoked certificates by adding to the data one or more first items that are shared among certificates of a proper subset of the revoked certificates and one or more second items that are shared among all the revoked certificates; and

(c) having the authority authenticate the information.

27. A method according to claim 26, wherein generating the data includes specifying certificate serial numbers of the revoked certificates.

28. A method according to claim 27, further comprising the steps of:

(d) mapping at least one of the serial numbers to one or more bit positions in the data and having values at the one or more bit positions convey information about one of the revoked certificates corresponding to the at least one serial number.

29. A method according to claim 26, wherein the data is obtained by compressing a list of identifiers of the revoked certificates.

30. A method according to claim 29, wherein each revoked certificate has a serial number and generating the data produces less bits than a summation of all the bits of the serial numbers of the revoked certificates.

31. A method according to claim 26, further comprising the steps of:

(d) mapping a revoked certificate to one or more bit positions in the data and having values at the one or more bit positions convey information about the revoked certificate.

32. A method according to claim 26, wherein the step of authenticating the information includes digitally signing at least one of:

the information alone, the information together with date information, and the information together with additional data.

33. A method according to claim 32, wherein the date information indicates when the information was authenticated.

34. A method for an authority to provide authenticated information about whether certificates have been revoked, comprising the steps of:

(a) generating a data string, wherein each of the certificates corresponds to a single bit of the data string and the value thereof indicates whether a corresponding one of the certificates has been revoked, wherein information contained in the data string is independent of issue dates of the certificates; and

(b) having the authority authenticate the data string.

35. A method according to claim 34, wherein the step of having the authority authenticate the data string includes having the authority authenticate at least one of:

the data string alone, the data string together with date information, the data string together with additional information.

36. A method according to claim 35, wherein authenticating the data string includes digitally signing the data string.

37. A method according to claim 36, wherein the date information indicates the date of authentication.

38. A method for an authority to provide authenticated information about whether certificates have been revoked, comprising the steps of:

(a) mapping at least one of the certificates to one or more bit positions in a data string and having values at the one or more bit positions convey information about whether the at least one of the certificates has been revoked, wherein information contained in the data string is independent of issue dates of the certificates; and

(b) having the authority authenticate the data string.

39. A method according to claim 38, wherein the step of having the authority authenticate the data string includes having the authority digitally sign at least one of:

the data string alone, the data string together with date information, the data string together with additional information.

40. A method for an authority to provide authenticated data about public key certificates, comprising the steps of:

(a) mapping at least one of the public key certificates to one or more bit positions in a data string and having values at the one or more bit positions convey information about the at least one certificate, wherein the information is independent of issue dates of the certificates; and

(b) having the authority authenticate the data string.

41. A method according to claim 40, wherein the step of authenticating the data string includes digitally signing at least one of:

the data string alone, the data string together with date information, and the data string together with additional data.

42. A method for an authority to provide authenticated data about certificates, comprising the steps of:

(a) mapping each of the certificates to one or more bit positions in a data string and having values at the one or more bit positions convey information about the certificate, wherein the information is independent of issue dates of the certificates; and

(b) having the authority authenticate the data string.

43. A method according to claim 42, wherein the step of authenticating the data string includes digitally signing at least one of:

the data string alone, the data string together with date information, and the data string together with additional data.

44. A method according to claim 42, wherein mapping includes mapping each of the certificates according to the serial numbers thereof.

45. A method for an authority to generate authenticated information about revoked certificates, comprising the steps of:

(a) generating data identifying the revoked certificates;

(b) generating compressed date information indicating a date of revocation for each of a first subgroup of the revoked certificates that contains at least one of the revoked certificates, wherein the compressed date information is independent of issue dates of certificates that are not revoked; and

(c) generating the authenticated information by authenticating at least one of;

the data together with the compressed date information alone, the data together with compressed date information and other date information, and the date together with the compressed date information and other information.

46. A method according to claim 45, further comprising the step of:

(d) having the other date information include revocation dates of the revoked certificates that are outside of the first subgroup.

47. A method according to claim 45, wherein generating compressed date information includes specify a number of days between a revocation date and a reference date of at least one of the revoked certificates.

48. A method according to claim 47, wherein the reference date is the date of issuance of the certificate.

49. A method according to claim 47, wherein the reference date is the date of authentication.

50. A method according to claim 45, wherein the first subgroup contains all of the revoked certificates.

51. A method for an intermediary to prove whether a certificate has been revoked, comprising the steps of:

(a) causing a user to receive authenticated information generated by an authority wherein the authority has generated the authenticated information by the steps of;

(a) generating data identifying the revoked certificates;

(b) generating information about the revoked certificates including the data without including the revocation date of every one of the revoked certificates, wherein the information is independent of issue dates of the revoked certificates; and

(c) authenticating the information.

52. A method according to claim 51, further comprising the step of:

(b) the intermediary providing the authenticated information directly to the user.

53. A method according to claim 51, further comprising the step of:

(b) the intermediary receiving the authenticated information from at least one of;

the authority, an other intermediary, and a user.

54. A method for an intermediary to prove whether a certificate has been revoked, comprising the steps of:

(a) causing a user to receive authenticated information generated by an authority wherein the authority has generated the authenticated information by the steps of;

(a) generating minimal data identifying revoked certificates;

(b) generating information about the revoked certificates only by adding to the data one or more additional items that are shared by all the revoked certificates, wherein the information is independent of issue dates of the revoked certificates; and

(c) having the authority authenticate the information.

55. A method according to claim 54, further comprising the step of:

(b) the intermediary providing the authenticated information directly to the user.

56. A method according to claim 54, further comprising the step of:

(b) the intermediary receiving the authenticated information from at least one of;

the authority, an other intermediary, and a user.

57. A method for an intermediary to prove whether a certificate has been revoked, comprising the steps of:

(a) causing a user to receive authenticated information generated by an authority wherein the authority has generated the authenticated information by the steps of;

(a) generating minimal data identifying revoked certificates;

(b) generating information about the revoked certificates by only adding to the data one or more additional items that are shared by two or more of the revoked certificates, wherein the information is independent of issue dates of the revoked certificates; and

(c) having the authority authenticate the information.

58. A method according to claim 57, further comprising the step of:

(b) the intermediary providing the authenticated information directly to the user.

59. A method according to claim 57, further comprising the step of:

(b) the intermediary receiving the authenticated information from at least one of;

the authority, an other intermediary, and a user.

60. A method for an intermediary to prove whether a certificate has been revoked, comprising the steps of:

(a) causing a user to receive authenticated information generated by an authority wherein the authority has generated the authenticated information by the steps of;

(a) generating minimal data identifying revoked certificates;

(b) generating information about the revoked certificates by adding to the data one or more first items that are shared among certificates of a proper subset of the revoked certificates and one or more second items that are shared among all the revoked certificates, wherein the information is independent of issue dates of the revoked certificates; and

(c) having the authority authenticate the information.

61. A method according to claim 60, further comprising the step of:

(b) the intermediary providing the authenticated information directly to the user.

62. A method according to claim 60, further comprising the step of:

(b) the intermediary receiving the authenticated information from at least one of;

the authority, an other intermediary, and a user.

63. A method for an intermediary to prove whether a certificate has been revoked, comprising the steps of:

(a) causing a user to receive an authenticated data string generated by an authority wherein the authority has generated the authenticated data string by the steps of;

(a) mapping at least one of the certificates to one or more bit positions in a data string and having values at the one or more bit positions convey information about whether the at least one of the certificates has been revoked, wherein the information is independent of issue dates of the revoked certificates; and

(b) having the authority authenticate the data string.

64. A method according to claim 63, further comprising the step of:

(b) the intermediary providing the authenticated information directly to the user.

65. A method according to claim 63, further comprising the step of:

(b) the intermediary receiving the authenticated information from at least one of;

the authority, an other intermediary, and a user.

66. A method for an intermediary to prove information about public key certificates, comprising the steps of:

(a) causing a user to receive an authenticated data string generated by an authority wherein the authority has generated the authenticated data string by the steps of;

(a) mapping at least one of the public key certificates to one or more bit positions in a data string and having values at the one or more bit positions convey information about the at least one certificate, wherein the information is independent of issue dates of the public key certificates; and

(b) having the authority authenticate the data string.

67. A method according to claim 66, further comprising the step of:

(b) the intermediary providing the authenticated information directly to the user.

68. A method according to claim 66, further comprising the step of:

(b) the intermediary receiving the authenticated information from at least one of;

the authority, an other intermediary, and a user.

69. A method for an intermediary to prove information about certificates, comprising the steps of:

(a) causing a user to receive authenticated data generated by an authority wherein the authority has generated the authenticated data by the steps of;

(a) mapping each of the certificates to one or more bit positions in a data string and having values at the one or more bit positions convey information about the certificate, wherein information contained in the data string is independent of issue dates of the certificates; and

(b) having the authority authenticate the data string.

70. A method according to claim 69, further comprising the step of:

(b) the intermediary providing the authenticated information directly to the user.

71. A method according to claim 69, further comprising the step of:

(b) the intermediary receiving the authenticated information from at least one of;

the authority, an other intermediary, and a user.

72. A method for an intermediary to prove whether a certificate has been revoked, comprising the steps of:

(a) causing a user to receive authenticated information generated by an authority wherein the authority has generated the authenticated information by the steps of;

(a) generating data identifying the revoked certificates;

(b) generating compressed date information indicating a date of revocation for each of a first subgroup of the revoked certificates that contains at least one of the revoked certificates, wherein the compressed date information is independent of issue dates of the revoked certificates; and

(c) generating the authenticated information by authenticating at least one of;

the data together with the compressed date information alone, the data together with compressed date information and other date information, and the date together with the compressed date information and other information.

73. A method according to claim 72, further comprising the step of:

(b) the intermediary providing the authenticated information directly to the user.

74. A method according to claim 72, further comprising the step of:

(b) the intermediary receiving the authenticated information from at least one of;

the authority, an other intermediary, and a user.