Partitioning certificate revocation lists
View Patent ↗Certificates issued by a CA are distributed across multiple CRLs. Each certificate issued by the CA is assigned to a specific CRL, and the address of that CRL is written to the appropriate field of the certificate, such that an authenticating application can subsequently determine if the certificate is revoked. When the CA revokes a specific one of the issued certificates, it determines to which CRL the revoked certificate is assigned, and updates the specific CRL accordingly. In some embodiments, a single one of the multiple CRLs is active for assignment of certificates at any given time, and each certificate issued by the CA is assigned to the currently active CRL. In other embodiments, assignments of issued certificates are distributed between different ones of a pre-determined number of multiple CRLs by applying a statistical distribution formula to each issued certificate to determine a corresponding target CRL.
1. A computer implemented method for managing certificate revocation list (CRL) size by distributing multiple certificates issued by a single certificate authority (CA) across different ones of a plurality of separate CRLs, the method comprising:
creating, by a computer, multiple CRLs across which certificates issued by the CA are distributed;
assigning, by the computer, each certificate issued by the CA to a specific one of the multiple CRLs, the specific CRL being currently active for assignment of certificates at certificate issuance time, wherein only a specific single one of the multiple CRLs is active for assignment of certificates at any given time and the remaining of the multiple CRLs are inactive for assignment at the given time, wherein the multiple CRLs allow an application to use less network bandwidth when accessing the specific one of the multiple CRLs;
for each specific certificate issued by the CA, writing, by the computer, an address of the specific one of the multiple CRLs to which the specific issued certificate is assigned to the specific certificate, wherein an authenticating application has access to the specific one of the multiple CRLs through the written address in the specific certificate;
revoking, by the CA, a specific one of the issued certificates;
determining, by the CA, to which specific one of the multiple CRLs the revoked certificate is assigned; and
updating, by the CA, the specific CRL to which the revoked certificate is assigned to indicate that the certificate is revoked.
2. The method of claim 1 further comprising:
designating a new specific one of the multiple CRLs as being currently active for assignment of certificates, responsive to an amount of time since designation of a prior one of the multiple CRLs as being active.
3. The method of claim 1 further comprising:
designating a new specific one of the multiple CRLs as being currently active for assignment of certificates, responsive to size of a prior active one of the multiple CRLs.
4. The method of claim 1 further comprising:
designating a new specific one of the multiple CRLs as being currently active for assignment of certificates, responsive to a number of issued certificates having been assigned to a prior active one of the multiple CRLs.
5. The method of claim 1 further comprising:
designating a new specific one of the multiple CRLs as being currently active for assignment of certificates, responsive to a combination of an amount of time since designation of a prior one of the multiple CRLs as being active, size of a prior active one of the multiple CRLs, and/or number of issued certificates having been assigned to a prior active one of the multiple CRLs.
6. The method of claim 1 further comprising:
maintaining a mapping between specific ones of the multiple CRLs and time ranges during which they were active; and
when a specific certificate is revoked, referring, by the CA, to the maintained mapping to determine to which specific one of multiple CRLs the revoked certificate is assigned.
7. The method of claim 1 further comprising:
assigning certificates issued by the CA prior to an initialization time to a pre-existing legacy CRL; and
assigning certificates issued by the CA after the initialization time the different ones of the multiple CRLs.
8. At least one non-transitory computer readable medium for managing certificate revocation list (CRL) size by distributing multiple certificates issued by a single certificate authority (CA) across different ones of a plurality of separate CRLs, the at least one non-transitory computer readable medium storing computer executable instructions that, when loaded into computer memory and executed by at least one processor of at least one computing device, cause the at least one computing device to perform the following steps:
creating multiple CRLs across which certificates issued by the CA are distributed;
assigning each certificate issued by the CA to a specific one of the multiple CRLs, the specific CRL being currently active for assignment of certificates at certificate issuance time, wherein only a specific single one of the multiple CRLs is active for assignment of certificates at any given time and the remaining of the multiple CRLs are inactive for assignment at the given time, wherein the multiple CRLs allow an application to use less network bandwidth when accessing the specific one of the multiple CRLs;
for each specific certificate issued by the CA, writing an address of the specific one of the multiple CRLs to which the specific issued certificate is assigned to the specific certificate, wherein an authenticating application has access to the specific one of the multiple CRLs through the written address in the specific certificate;
revoking a specific one of the issued certificates;
determining to which specific one of the multiple CRLs the revoked certificate is assigned; and
updating the specific CRL to which the revoked certificate is assigned to indicate that the certificate is revoked.
9. The at least one non-transitory computer readable medium of claim 8 further storing computer executable instructions for:
designating a new specific one of the multiple CRLs as being currently active for assignment of certificates, responsive to an amount of time since designation of a prior one of the multiple CRLs as being active.
10. The at least one non-transitory computer readable medium of claim 8 further storing computer executable instructions for:
designating a new specific one of the multiple CRLs as being currently active for assignment of certificates, responsive to size of a prior active one of the multiple CRLs.
11. The at least one non-transitory computer readable medium of claim 8 further storing computer executable instructions for:
designating a new specific one of the multiple CRLs as being currently active for assignment of certificates, responsive to a number of issued certificates having been assigned to a prior active one of the multiple CRLs.
12. The at least one non-transitory computer readable medium of claim 8 further storing computer executable instructions for:
assigning certificates issued by the CA prior to an initialization time to a pre-existing legacy CRL; and
assigning certificates issued by the CA after the initialization time the different ones of the multiple CRLs.
13. A computer implemented method for managing certificate revocation list (CRL) size by distributing multiple certificates issued by a single certificate authority (CA) across different ones of a plurality of separate CRLs, the method comprising:
creating, by a computer, multiple CRLs across which certificates issued by the CA are distributed;
assigning, by the computer, each certificate issued by the CA to a specific one of the multiple CRLs, wherein the assigning of issued certificates is distributed between different ones of a pre-determined number of multiple CRLs, and wherein the multiple CRLs allow an application to use less network bandwidth when accessing the specific one of the multiple CRLs;
for each specific certificate issued by the CA, writing, by the computer, an address of the specific one of the multiple CRLs to which the specific issued certificate is assigned to the specific certificate, wherein an authenticating application has access to the specific one of the multiple CRLs through the written address in the specific certificate;
revoking, by the CA, a specific one of the issued certificates;
determining, by the CA, to which specific one of the multiple CRLs the revoked certificate is assigned; and
updating, by the CA, the specific CRL to which the revoked certificate is assigned to indicate that the certificate is revoked.
14. The method of claim 13 , wherein distributing assignments of issued certificates between different ones of a pre-determined number of multiple CRLs further comprises:
applying a statistical distribution formula to each issued certificate to determine to which specific CRL it is to be assigned, the formula being a function of an identifier of the specific certificate and a total number of the multiple CRLs across which assignment of certificates is being distributed.
15. The method of claim 14 , wherein the statistical distribution formula further comprises:
a subset of digits of a serial number of the specific certificate modulo a total number of the multiple CRLs across which assignment of certificates is being distributed.