Generating a CRL using a sub-system having resources separate from a main certificate authority sub-system

• US 9,419,805 B2
• Filed: 07/25/2011
• Issued: 08/16/2016
• Est. Priority Date: 07/25/2011
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Wnuk, Andrew
• Primary Examiner(s): Edwards, Linglan
• Application Number:
  US13/190,297
• Publication Number:
  US 20130031363A1
• Time in Patent Office: 1,849 Days
• Field of Search: 713/158
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A server computing system initiates a first sub-system to generate a certificate revocation list (CRL) using resources that are separate from resources of a second sub-system that performs certificate authority (CA) management functions other than generating a CRL. The first sub-system receives a command from the second sub-system to update revocation data in a cache that is coupled to the first sub-system and generates a CRL using the updated revocation data in the cache. The first sub-system provides the CRL to the second sub-system.

Claims

1. A method comprising:

receiving, by a first server computer, a command from a second server computer to update revocation data;

generating, using computing resources of the first server computer separate from computing resources of the second server computer, updated revocation data in view of the command;

generating, using the computing resources of the first server computer separate from computing resources of the second server computer, a certificate revocation list (CRL) in view of the updated revocation data;

receiving a status request regarding the first server computer;

transmitting a response for the status request, the response comprising data indicating whether the first server computer is not busy, a scheduled time for generating the CRL, an amount of time to generate the CRL and a time the CRL is last generated;

receiving, by the first server computer, a command to override the scheduled time for generating the CRL in view of the response;

providing, by the first server computer, the CRL to the second server computer to update certificate records stored in a data store that is coupled to the second server computer, wherein the update is to cause at least one of;

a digital certificate to be generated in view of the CRL, the digital certificate to be issued, or the CRL to be published;

receiving, by the first server computer, a command to update configuration data for the CRL stored in a cache memory that is separate from the second server computer, wherein the configuration data comprising a schedule to generate the CRL; and

providing a status update comprising a time the cache memory is last updated.

2. The method of claim 1, wherein the computing resources of the first server computer comprises a central processing unit (CPU) that is separate from the second server computer.

3. The method of claim 1, further comprising:

generating, using the computing resources of the first server computer separate from computing resources of the second server computer, a delta CRL in view of changes to the CRL since the time the CRL is last generated.

4. The method of claim 1, wherein receiving the command to update revocation data comprises at least one of:

receiving, by the first server computer, a command from the second server computer to update status data in at least one certificate record that is stored in a cache that is coupled to the first server computer;

or

receiving, by the first server computer, a command from the second server computer to update configuration data that is stored in the cache that is coupled to the first server computer, the configuration data comprising data specifying elements to be included in the CRL.

5. The method of claim 1, wherein the status comprises at least one of a time the cache is updated or a time for generating the CRL.

6. The method of claim 1, wherein generating the CRL in view of the updated revocation data comprises:

receiving, by the first server computer, a command from the second server computer to generate the CRL; and

generating, by the first server computer, the CRL in response to the command from the second server computer.

7. A system comprising:

a first server computer comprising;

a first memory; and

a first processing device operatively coupled to the first memory, the first processing device to;

receive a command from a second server computer to update revocation data;

generate updated revocation data in view of the command using computing resources of the first server computer separate from computing resources of the second server computer;

generate the CRL in view of the updated revocation data using computing resources of the first server computer separate from computing resource of the second server computer;

receive a status request by the first server computer;

transmit a response for the status request comprising data indicating;

whether the first server computer is not busy, whether the first server is to perform an action to generate the CRL, an amount of time to generate the CRL and a time the CRL is last generated;

receive a command to override the scheduled time for generating the CRL in view of the response;

provide the CRL to the second server computer to update certificate records stored in a data store that is coupled to the second server computer, wherein the update is to cause at least one of;

a digital certificate to be generated in view of the CRL, the digital certificate to be issued, or the CRL to be published;

receive a command to update configuration data for the CRL stored in a cache memory that is separate from the second server computer, wherein the configuration data comprising a schedule to generate the CRL; and

provide a status update comprising a time the cache memory is last updated.

8. The system of claim 7, further comprises the first processing device to:

generate, using the computing resources of the first server computer separate from computing resources of the second server computer, a delta CRL in view of changes to the CRL since the time the CRL is last generated.

9. The system of claim 7, wherein the second server computer comprises:

a second memory; and

a second processing device, operatively coupled to the second memory, the second processing device to;

send the command to update the revocation data to the first processing device;

send the request to the first server computer system for the status;

receive the status from the first server computer indicating that the first server computer is generating the CRL; and

access the CRL from a data store that is coupled to the second server computer.

10. A non-transitory computer-readable medium including instructions that, when executed by a first processing device, cause the first processing device to:

receive a command from a second processing device to update revocation data;

generate, using computing resources of the first processing device separate from computing resources of the second processing device, updated revocation data in view of the command;

generate, using the computing resources of the first processing device separate from computing resources of the second processing device, a certificate revocation list (CRL) in view of the updated revocation data;

receive a status request by the first processing device;

transmit a response for the status request comprising data indicating whether the first processing device is not busy, a scheduled time to generate the CRL, an amount of time to generate the CRL and a time the CRL is last generated;

receive a command to override the scheduled time for generating the CRL in view of the response;

provide the CRL to the second processing device to update certificate records stored in a data store that is coupled to the second processing device, wherein the update is to cause at least one of;

a digital certificate to be generated in view of the CRL, the digital certificate to be issued, or the CRL to be published;

receive a command to update configuration data for the CRL stored in a cache memory that is separate from the processing device, wherein the configuration data comprising a schedule to generate the CRL; and

provide a status update comprising a time the cache memory is last updated.

11. The non-transitory computer-readable medium of claim 10, wherein the computing resources of the first processing device comprise at least one of a cache memory that is separate from the second processing device or a central processing unit (CPU) that is separate from the second processing device.

12. The non-transitory computer-readable medium of claim 10, further comprising the first processing device further to:

generate, using computing resources of the first processing device separate from computing resources of the second processing device, a delta CRL in view of changes to the CRL since the time the CRL is last generated.

13. The non-transitory computer-readable medium of claim 10, wherein to receive the command to update revocation data, the first processing device is to:

receive a command to update status data in at least one certificate record that is stored in a cache that is coupled to the first processing device or

receive a command to update configuration data that is stored in the cache that is coupled to the first processing device, the configuration data comprising at least one of a schedule to generate the CRL or data specifying elements to be included in the CRL.

14. The non-transitory computer-readable medium of claim 10, wherein the status comprises at least one of a time the cache is last updated or a time for generating the CRL.