Method and system for enabling PKI in a bandwidth restricted environment
A PKI mechanism is facilitated in a bandwidth-limited distributed environment by creating a periodic chain of PKI related updates. Changes in CRLs are reflected by periodically created DeltaCRL objects that are part of a continuous chain. The DeltaCRL objects allow for the iterative generation of an updated CRL from a known base CRL within the timeframe of the DeltaCRL chain. Updating of CRL data at bandwidth-limited remote nodes of the distributed environment is facilitated by transmitting a relatively small data object instead of transmitting a complete and bandwidth-taxing updated CRL.
1 . A method for updating CRL information between distributed components in a PKI environment, comprising:
sequentially receiving a plurality of periodically updated versions of a CRL associated with a certificate authority;
generating a plurality of DeltaCRL data elements by reference to sequentially adjacent CRL versions from the received CRL versions;
providing the DeltaCRLs to a node in a distributed PKI environment; and
the node sequentially applying the DeltaCRLs to a base CRL to provide increasingly updated versions of said CRL, the base CRL being a version of the CRL within the timeframe of said periodically updated sequence of CRLs.
2 . The method of claim 1 , further comprising generating a hash value corresponding to each DeltaCRL, the hash value generated by reference sequentially adjacent CRL versions from the received CRL versions.