Method and device for enabling a trust relationship using an expired public key infrastructure (PKI) certificate
View Patent ↗A method and device are useful for enabling a trust relationship using an expired public key infrastructure (PKI) certificate. The method includes determining at a relying party a maximum permissible grace period during which the PKI certificate can be conditionally granted a valid status (step 905 ). Next, at the relying party an uncertainty interval is determined, during which the relying party is unable to detect a revocation of the PKI certificate (step 910 ). A certificate grace period is then determined at the relying party from a function of the maximum permissible grace period, the uncertainty interval and at least one attribute defined in the PKI certificate (step 915 ). Using the PKI certificate, a trust relationship is then enabled between the relying party and a certificate holder of the PKI certificate, after determining the grace period and before an expiration of the grace period (step 920 ).
1. A method for enabling a trust relationship using an expired public key infrastructure (PKI) certificate, the method comprising:
determining at a relying party device a maximum permissible grace period during which the PKI certificate can be conditionally granted a valid status;
determining at the relying party device an uncertainty interval during which the relying party device is unable to detect a revocation of the PKI certificate;
determining at the relying party device a certificate grace period from a function of the maximum permissible grace period, the uncertainty interval and at least one attribute defined in the PKI certificate; and
enabling, using the PKI certificate, a trust relationship between the relying party device and a certificate holder device presenting the PKI certificate after determining the grace period and before an expiration of the grace period.
2. The method of claim 1 , wherein the certificate grace period is determined from a function of an uncertainty interval and a verifiable recent validity interval.
3. The method of claim 1 , wherein the certificate grace period is determined from a function of an uncertainty interval and a verifiable seniority interval.
4. The method of claim 2 , wherein the verifiable recent validity interval is normalized by a validity evaluation interval.
5. The method of claim 3 , wherein the verifiable seniority interval is normalized by a seniority evaluation interval.
6. The method of claim 1 , wherein the method is defined by an online certificate status protocol (OCSP).
7. The method of claim 1 , wherein a maximum period for the certificate grace period is defined as a variable included in the PKI certificate.
8. The method of claim 1 , wherein the certificate grace period is determined during an implicit negotiation with the certificate holder.
9. The method of claim 1 , wherein the certificate grace period is determined during an explicit negotiation with the certificate holder.
10. A device for enabling a trust relationship using an expired public key infrastructure (PKI) certificate, comprising:
a processor; and
a programmable memory coupled to the processor for storing:
computer readable program code components for determining at a relying party device a maximum permissible grace period during which the PKI certificate could be conditionally granted a valid status;
computer readable program code components for determining at the relying party device an uncertainty interval during which the relying party device is unable to detect a revocation of the PKI certificate;
computer readable program code components for determining at the relying party device a certificate grace period from a function of the maximum permissible grace period, the uncertainty interval and at least one attribute defined in the PKI certificate; and
computer readable program code components for enabling, using the PKI certificate, a trust relationship between the relying party device and a certificate holder device presenting the PKI certificate after determining the grace period and before an expiration of the grace period.
11. The device of claim 10 , wherein the certificate grace period is determined from a function of an uncertainty interval and a verifiable recent validity interval.
12. The device of claim 10 , wherein the certificate grace period is determined from a function of an uncertainty interval and a verifiable seniority interval.
13. The device of claim 11 , wherein the verifiable recent validity interval is normalized by a validity evaluation interval.
14. The device of claim 12 , wherein the verifiable seniority interval is normalized by a seniority evaluation interval.
15. The device of claim 10 , wherein enabling the trust relationship is performed during execution of an online certificate status protocol (OCSP).
16. The device of claim 10 , wherein a maximum period for the certificate grace period is defined as a variable included in the PKI certificate.
17. The device of claim 10 , wherein the certificate grace period is determined during an implicit negotiation with the certificate holder.
18. The device of claim 10 , wherein the certificate grace period is determined during an explicit negotiation with the certificate holder.
19. A device for enabling a trust relationship using an expired public key infrastructure (PKI) certificate, comprising:
means for determining at a relying party device a maximum permissible grace period during which the PKI certificate could be conditionally granted a valid status;
means for determining at the relying party device an uncertainty interval during which the relying party device is unable to detect a revocation of the PKI certificate;
means for determining at the relying party device a certificate grace period from a function of the maximum permissible grace period, the uncertainty interval and at least one attribute defined in the PKI certificate; and
means for enabling, using the PKI certificate, a trust relationship between the relying party device and a certificate holder device presenting the PKI certificate after determining the grace period and before an expiration of the grace period.