Efficient certificate revocation

• US 7,337,315 B2
• Filed: 03/21/2003
• Issued: 02/26/2008
• Est. Priority Date: 10/02/1995
• Status: Expired due to Fees

• Current Assignee: Assa Abloy AB
• Original Assignee: Corestreet, Ltd. (Assa Abloy AB)
• Inventors: Micali, Silvio
• Primary Examiner(s): Skeikh; Ayaz
• Assistant Examiner(s): Sherkat; Arezoo
• Application Number:
  US10/395,017
• Publication Number:
  US 20030221101A1
• Time in Patent Office: 1,803 Days
• Field of Search: 713155-158
• US Class Current: 713/157
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G07C 9/23 by means of a password
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: H04L 2209/30 Compression, e.g. Merkle-Damgard construction
• CPC Class Codes: H04L 9/3255 using group based signatures, e.g. ring or threshold signatures
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A method and system for overcoming the problems associated with certificate revocation lists (CRL'"'"'s), for example, in a public key infrastructure. The invention uses a tree-based scheme to replace the CRL.

Claims

1. A method for authenticating validity information about certificates, comprising:

having a Directory periodically receive data signed by a Certifying Authority, wherein the data includes at least one of;

a certificate and a Certificate Revocation List (CRL);

having theDirectory make a record of the data;

having the Directory receive a query from a user about the validity of a certificate having an identifier X;

having the Directory consult the data to deduce that the certificate with identifier X is valid;

having the Directory produce a digital signature binding together the identifier X, an indication that the certificate is valid, and additional information; and

having the Directory send the digital signature to the user.

2. A method according to claim 1, wherein the data consulted by the Directory is a CRL and wherein the additional information specifies at least one of:

the date of the CRL and the date of the next CRL.

3. A method to provide authenticated information about validity of individual certificates, comprising:

having a Directory receive a Certificate Revocation List (CRL) from a Certifying Authority;

having the Directory receive a query from a user about the validity of a certificate having an identifier X;

having the Directory consult the CRL to deduce that the certificate with identifier X is valid;

having the Directory produce a digital signature binding together the identifier X, an indication that the certificate is valid, and at least one of;

the date of the CRL and the date of the next CRL; and

having the Directory provide the digital signature to the user.