Blocked tree authorization and status systems
A method is provided for communicating authenticated information concerning a digital public key certificate. A hash-tree data structure is created containing a pre-defined list of possible information, such as authorizations, restrictions, privileges, or validity period notices. The list items may include text and coded values. Each list entry is prefixed with a different random data (blocker) value that is securely stored and infeasible to guess. Each list item is hashed to produce a leaf hash, the leaf hashes are combined to produce a hash tree, and the root node of said tree is embedded into a digital certificate or message that is signed using a private key. In response to a request for authenticated information concerning a digital public key certificate, the certificate authority releases the relevant list item, its blocker value, and other hash values sufficient to authenticate the list item using the root node embedded in the digital certificate.
1 . (canceled)
2 . A method of managing authority associated with holders of public key certificates, comprising:
determining a plurality of initial random values, wherein each of the initial random values corresponds to a particular type of authority granted to a user;
applying a one-way hash function N times to the each of the initial random values to obtain a plurality of final hashed values;
a certificate authority issuing a public key certificate to the user that includes the plurality of final hashed values digitally signed by the certificate authority;
the certificate authority issuing, at T1, a first set of periodic freshness indicators corresponding to application of the one-way hash function to the initial random values M1 times, wherein M1 is a number of refresh intervals from the date of issuance of the digital certificate to T1; and
in response to a change of authority granted to the holder after T1 and prior to T2, the certificate authority issuing, at T2, a second set of periodic freshness indicators corresponding to application of the one-way hash function to a subset of the initial random values M2 times, wherein M2 is a number of refresh intervals from the date of issuance of the digital certificate to T2 and wherein the subset of initial random values is less than all of the initial random values and corresponds to the change of authority granted to the holder.