Patent US5699431A successfully refreshed from Google Patents.
US5699431A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method for efficient management of certificate revocation lists and update information
Assignee: Entrust Ltd
•
Filing: 1995-11-13
•
Granted: 1997-12-16
•
Expires: 2015-11-13
Abstract
Abstract A method which allows implementation of the revocation of public-key certificates facilitates engineering of certificate revocation lists (CRLs). It solves the practical problem of CRLs potentially growing to unmanageable lengths by allowing CRLs to be segmented, based on size considerations or priority considerations related to revocation reasons. The method is used to distribute CRL information to users of certificate-based public-key systems. It is also applied more generally to update any field in a certificate by reference to a secondary source of authenticated information.
Inventors
- 👤 Paul C. Van Oorschot
- 👤 Warwick S. Ford
- 👤 Stephen W. Hillier
- 👤 Josanne Otway
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-31 12:28
CPC Classifications
H; H04; H04L; H04L9/00; H04L9/32; H04L9/3263; H04L9/3268
Claims Analysis
Total Claims: 21
Claim 1
Independent Claim
121 words
In a secure telecommunication system which includes an authorization agent such as a certification authority and other entities authorized by said certification authority for digitally issuing a certificate, a method of conveying additional information which alters actions taken by a system processing said certificate, comprising steps of: i) storing additional information at a plurality of data storage locations; ii) extracting from said certificate accessing information which specifies how said additional information is to be obtained; iii) verifying the authenticity of said additional information through digital verifying techniques such as digital signature verification; iv) processing said verified additional information obtained from any of the plurality of data storage locations; and v) performing on said certificate the action altered by the additional information.
Claim 2
Dependent Claim
121 words
In a secure telecommunication system which includes an authorization agent such as a certification authority and other entities authorized by said certification authority for digitally issuing a certificate, a method of conveying additional information which alters actions taken by a system processing said certificate, comprising steps of: i) storing additional information at a plurality of data storage locations; ii) extracting from said certificate accessing information which specifies how said additional information is to be obtained; iii) verifying the authenticity of said additional information through digital verifying techniques such as digital signature verification; iv) processing said verified additional information obtained from any of the plurality of data storage locations; and v) performing on said certificate the action altered by the additional information.
Claim 3
Dependent Claim
47 words
The method according to claim 1, wherein the additional information is related to the validity of a certificate, conditions for the validity including any of certificate revocation, a validity period specified by a starting and ending date and other relevant information, and any alteration of such conditions.
Claim 4
Dependent Claim
17 words
The method according to claim 2 wherein the validity conditions are verified by the use of CRLs.
Claim 5
Dependent Claim
58 words
The method according to claim 3, wherein a CRL is segmented and a list of revoked certificates corresponding to a particular authorization agent is separated into at least one CRL segment whose content is stored in one of the plurality of data storage locations, and each certificate contains at least one location indicator which indicates associated CRL segment.
Claim 6
Dependent Claim
19 words
The method according to claim 4, wherein at least one CRL segment corresponds to at least one revocation reason.
Claim 7
Dependent Claim
19 words
The method according to claim 5, wherein the location indicator specifies a field in an entry in a database.
Claim 8
Dependent Claim
28 words
The method according to claim 5, wherein the certificate is of the format as specified in X.509 and the location indicator is an additional field in the certificate.
Claim 9
Dependent Claim
47 words
The method according to claim 5, wherein the format of CRLs and CRL segments is that specified in X.509 with an added field within the CRL itself specifying any of the location indicator of the CRL segment and the reason codes associated with this particular CRL segment.
Claim 10
Independent Claim
22 words
The method according to claim, wherein the certificate is a public-key certificate for any type of public key, including Diffie-Hellman public keys.
Claim 11
Dependent Claim
18 words
The method according to claim 5, wherein the certificate is for an attribute other than a public key.
Claim 12
Dependent Claim
37 words
The method according to claim 5, wherein CRL segments at at least one distribution point are signed by any of a common certification authority key and segment keys authorized by the certification authority which issued the certificate.
Claim 13
Dependent Claim
33 words
The method according to claim 5, wherein a particular certificate appears on a plurality of different CRL segments associated with any of the same revocation reasons and an overlapping set of revocation reasons.
Claim 14
Dependent Claim
38 words
The method according to claim 5 wherein a CRL segment is indicated indirectly from information embedded in the certificate and the certificate includes a compressed representation such as hash of a more complete specification of information, linkable thereto.
Claim 15
Dependent Claim
16 words
The method according to claim 5 wherein a CRL segment is indicated by an explicit address.
Claim 16
Dependent Claim
40 words
The method according to claim 5 wherein the method of indicating a CRL segment can be determined indirectly from information embedded in the certificate, the embedded information being represented by a compressed representation, such as the result of one-way hash.
Claim 17
Dependent Claim
18 words
The method according to claim 5, wherein at least one revocation reason is specified in the CRL segment.
Claim 18
Dependent Claim
25 words
The method according to claim 6, wherein the database is a directory and the entry includes a CRL attribute of an entry in an X.509directory.
Claim 19
Dependent Claim
30 words
The method according to claim 5, wherein the certificate is of the format similar to that specified in X.509 and the location indicator is an additional field in the certificate.
Claim 20
Dependent Claim
48 words
The method according to claim 5, wherein the format of CRLs and CRL segments is similar to that specified in X.509, with an added field within the CRL itself specifying any of the location of the CRL segment and the reason codes associated with this particular CRL segment.
Claim 21
Dependent Claim
23 words
The method according to claim 14 wherein an explicit address is any of a network address, filename address, and database directory entry address.
References Cited (Backward Citations)
US4200770A
Cited
US4405829A
Cited
US4868877A
Cited
US5005200A
Cited
US5220604A
Cited
US5261002A
Cited
US5390247A
Cited
US5495098A
Cited
US5371794A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2000-12-15 | 2001-06-16 | 2001-12-16 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2004-12-15 | 2005-06-16 | 2005-12-16 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2008-12-15 | 2009-06-16 | 2009-12-16 | $7700.00 | Window Closed / Lapsed |