Systems and methods for managing CRLS for a multi-core system
The present invention is directed towards systems and methods for maintaining Certificate Revocation Lists (CRLs) for client access in a multi-core system. A first core may generate a secondary CRL corresponding to a master CRL maintained by the first core. The CRLs may identify certificates to revoke. The first core can store the secondary CRL to a memory element accessible by the cores. A second core may receive a request to validate a certificate. The second core can provisionally determine, via access to the secondary CRL, whether the certificate is revoked. The second core may also determine not to revoke the certificate. Responsive to the determination, the second core may request the first core to validate the certificate. The first core can determine whether to revoke the certificate based on the master CRL. The first core may send a message to the second core based on the determination.
1. A method of maintaining a certificate revocation list (CRL) for a multi-core system, the method comprising:
a) generating, by a first packet engine of a first core of a multi-core system, a secondary certificate revocation list (CRL) corresponding to a master CRL maintained by the first core;
b) storing, by the first packet engine, the secondary CRL to a memory element accessible by a second core of a plurality of cores;
c) receiving, by a second packet engine of a second core of the multi-core system, a request to validate a certificate;
d) determining, by the second packet engine, via access to the secondary CRL in the memory element to provisionally revoke the certificate; and
e) sending, by the second packet engine responsive to the determination, a message to the first core to verify whether the certificate is revoked based on the master CRL.
2. The method of claim 1 , wherein the master CRL identifies certificates to revoke and the secondary CRL identifies certificates to provisionally revoke and certificates not to revoke.
3. The method of claim 1 , wherein step (a) further comprises generating the secondary CRL comprising a plurality of bit arrays.
4. The method of claim 3 , wherein step (a) further comprises assigning each bit array to at least one certificate and setting bits of a serial number of each certificate in the assigned bit array.
5. The method of claim 1 , wherein step (d) further comprises identifying, by the second packet engine, a bit array of the secondary CRL to validate the certificate, the identification based on a name of the certificate's issuer.
6. The method of claim 5 , wherein step (d) further comprises performing a bit scan of the identified bit array against a serial number of the certificate, the serial number comprising a plurality of bits.
7. The method of claim 6 , wherein step (d) further comprises determining, by the second packet engine, that the certificate is provisionally revoked based on a matching bit scan against a serial number of the certificate.
8. The method of claim 6 , wherein step (d) further comprises determining, by the second packet engine, that the certificate as not revoked based on a non-matching bit scan against a serial number of the certificate.
9. The method of claim 1 , wherein step (d) further comprises determining, by the second packet engine via access to the secondary CRL in the memory element, that the certificate as not revoked.
10. The method of claim 9 , wherein step (e) further comprises determining, by the second packet engine, not to send the message based on the determination that the certificate is not revoked.
11. A system of maintaining a certificate revocation list (CRL) for a multi-core system, the system comprising:
a master certificate revocation list (CRL) maintained by a first packet engine of a first core of a multi-core system comprising a plurality of cores;
a CRL generator of a second core of the multi-core system, generating a secondary CRL corresponding to the master CRL, the secondary CRL stored in a memory element accessible by the plurality of cores;
a certificate manager of the second core, receiving a request to validate a certificate, determining via access to the secondary CRL in the memory element to provisionally revoke the certificate, and responsive to the determination, sending a message to the first core to verify whether the certificate is revoked based on the master CRL.
12. The system of claim 11 , wherein the master CRL identifies certificates to revoke and the secondary CRL identifies certificates to provisionally revoke and certificates not to revoke.
13. The system of claim 11 , wherein the secondary CRL comprises a plurality of bit arrays.
14. The system of claim 13 , wherein each of the plurality of bit arrays are assigned to at least one certificate and bits of a serial number of each certificate are set in the assigned bit array.
15. The system of claim 11 , wherein the certificate manager identifies a bit array of the secondary CRL to validate the certificate, the identification based on a name of the certificate's issuer.
16. The system of claim 15 , wherein the certificate manager performs a bit scan of the identified bit array against a serial number of the certificate, the serial number comprising a plurality of bits.
17. The system of claim 16 , wherein the certificate manager determines that the certificate is provisionally revoked based on a matching bit scan against a serial number of the certificate.
18. The system of claim 17 , wherein the certificate manager determines that the certificate is not revoked based on a non-matching bit scan against a serial number of the certificate.
19. The system of claim 11 , wherein the certificate manager determines, via access to the secondary CRL in the memory element that the certificate is not revoked.
20. The system of claim 19 , wherein the certificate manager determines not to send the message based on the determination that the certificate is not revoked.