Obtaining and using time information on a secure element (SE)
A secure element (SE) with a notion of time useful for checking secure items is disclosed herein. Use of Public Key Infrastructure (PKI) with secure elements is improved by verifying secure items used by an SE. Methods of obtaining time information by the SE include push, pull, opportunistic, and local interface methods. The SE uses the time information to evaluate arriving and stored public key certificates and to discard those which fail the evaluation. The SE, in some embodiments, uses the time information in cooperation with certificate revocation lists (CRLs) and/or online certificate status protocol (OCSP) stapling procedures.
1. A method comprising:
at a secure element (SE) including a memory:
receiving, from an entity, a message signed with a public key included in a public key certificate associated with a certification authority (CA) and generated by a trusted certificate issuer (CI), wherein the public key certificate includes an expiration time;
obtaining a time information value from a time information variable of the memory, wherein the time information value is uniquely associated with a set of one or more CAs associated with the CI and that includes the CA;
comparing the expiration time with the time information value to produce a comparison result;
when the comparison result indicates that the expiration time falls outside a security window:
treating the public key certificate as untrustworthy; and
when the comparison result indicates that the expiration time does not fall outside a security window:
processing the message.
2. The method of claim 1 , further comprising:
requesting a time information update from the CA;
receiving the time information value from the CA; and
storing the time information value in the time information variable.
3. The method of claim 1 , further comprising:
receiving an unsolicited time information value from the CA; and
storing the time information value in the time information variable.
4. The method of claim 1 , further comprising:
receiving a signed message from a second entity;
authenticating the message using a certificate associated with the second entity;
when the authenticating is successful, obtaining a second time information value from the signed message; and
storing the second time information value in the time information variable,
wherein the second entity is one of the set of one or more CAs or the CI.
5. The method of claim 1 , wherein treating the public key certificate as untrustworthy includes:
removing the public key certificate from the memory.
6. The method of claim 1 , wherein treating the public key certificate as untrustworthy includes:
adding an identity of the entity to a list of untrusted entities in the memory.
7. The method of claim 1 , wherein treating the public key certificate as untrustworthy includes:
removing an identity of the entity from a list of trusted entities in the memory.
8. The method of claim 1 , further comprising:
receiving, prior to the receiving the message, the public key certificate; and
storing the public key certificate in the memory.
9. The method of claim 1 , wherein the message includes a certificate revocation list (CRL).
10. The method of claim 9 , wherein the CRL includes a server identifier.
11. The method of claim 10 , wherein the processing the message includes:
removing the server identifier from a trusted entities list of the memory.
12. A secure element (SE) comprising:
a processor; and
a memory, wherein the memory includes instructions that when executed by the processor cause the SE to perform steps comprising:
receiving a first epoch value from a first certification authority (CA),
storing the first epoch value in a second time information variable of the memory,
receiving, from an entity, a message signed with a public key included in a public key certificate associated with the first CA and generated by a trusted certificate issuer (CI),
obtaining a time information value from a time information variable of the memory,
wherein the time information value is uniquely associated with a set of one or more CAs associated with the CI and that includes the first CA
obtaining a second epoch value from the message,
when an expiration time falls outside a security window or the first epoch value does not match the second epoch value:
treating the public key certificate as untrustworthy, and
when the expiration time falls inside a security window and the first epoch value matches the second epoch value:
processing the message.
13. The SE of claim 12 , wherein the time information value includes the expiration time.
14. The SE of claim 12 , wherein the time information value includes a publication time.
15. The SE of claim 12 , wherein the time information value includes an online certificate status protocol (OCSP) stapling time.
16. A secure element (SE) comprising:
a processor; and
a memory, wherein the memory includes instructions that when executed by the processor cause the SE to perform steps comprising:
receiving, from an entity, a message signed with a public key included in a public key certificate associated with a certification authority (CA) and generated by a trusted certificate issuer (CI), wherein the public key certificate includes an expiration time;
obtaining a time information value from a time information variable of the memory, wherein the time information value is uniquely associated with a set of one or more CAs associated with the CI and that includes the CA;
comparing the expiration time with the time information value to produce a comparison result;
when the comparison result indicates that the expiration time falls outside a security window:
treating the public key certificate as untrustworthy; and
when the comparison result indicates that the expiration time does not fall outside a security window:
processing the message.
17. The SE of claim 16 , wherein the steps performed by the SE further comprise:
receiving a signed message from a second entity;
authenticating the message using a certificate associated with the second entity;
when the authenticating is successful, obtaining a second time information value from the signed message; and
storing the second time information value in the time information variable,
wherein the second entity is one of the set of one or more CAs or the CI.
18. The SE of claim 16 , wherein treating the public key certificate as untrustworthy includes:
adding an identity of the entity to a list of untrusted entities in the memory.
19. The SE of claim 16 , wherein treating the public key certificate as untrustworthy includes:
removing an identity of the entity from a list of trusted entities in the memory.
20. The SE of claim 16 , wherein:
the message includes a certificate revocation list (CRL);
the CRL includes a server identifier; and
the processing the message includes removing the server identifier from a trusted entities list of the memory.