Mobile credential revocation
Managing validity status of at least one associated credential includes providing a credential manager that selectively validates associated credentials for at least one device, the device invalidating a corresponding associated credential, and the device requesting that the credential manager validate the corresponding associated credential after invalidating the associated credential. The associated credential may be invalidated based on an external event, such as a user invalidating the associated credential from a UI of the device, a user improperly entering a pin value, a user indicating that a corresponding device is lost, the device entering sleep mode, the device locking a user interface thereof, the device shutting down, and a particular time of day. The at least one associated credential may be provided on an integrated circuit card (ICC) that may be part of a mobile phone and/or a smart card.
1. A method of managing validity status of at least one of a plurality of associated credentials, comprising:
providing a credential manager that selectively validates a particular one of the associated credentials for at least one device by validating a corresponding primary credential that is cryptographically independent from the plurality of the associated credentials, wherein the plurality of the associated credentials are deemed invalid when the corresponding primary credential is invalid; and
the at least one device invalidating the particular one of the associated credentials while other ones of the plurality of the associated credentials and the corresponding primary credential remain valid.
2. The method, according to claim 1 , wherein invalidating the particular one of the associated credential limits scope of use of the associated credential.
3. The method, according to claim 1 , wherein invalidating the particular one of the associated credentials prevents use of the particular one of the associated credentials and wherein validating the particular one of the associated credentials allows use of the particular one of the associated credentials.
4. The method, according to claim 1 , wherein the credential manager includes at least one of: a credential validation function and a credential revocation function.
5. The method, according to claim 1 , wherein the particular one of the associated credential is invalidated based on an external event.
6. The method, according to claim 5 , wherein the external event is selected from the group consisting of one or more of: a user invalidating the associated credential from a UI of the at least one device, a user improperly entering a pin value, a user indicating that a corresponding device is lost, the at least one device entering sleep mode, the at least one device locking a user interface thereof, the at least one device shutting down, the device losing connection to a network, the device leaving a location or area, the device configuration changing, and a particular time of day.
7. The method, according to claim 1 , wherein the particular one of the associated credentials is provided on an integrated circuit card (ICC).
8. The method, according to claim 7 , wherein the ICC is part of one of: a mobile phone and a smart card.
9. The method, according to claim 1 , wherein the particular one of the associated credentials is provided within a trusted execution environment of a device.
10. The method, according to claim 1 , wherein the particular one of the associated credentials is invalidated based on an internal event.
11. The method, according to claim 10 , wherein the internal event is selected from the group consisting of one or more of: a counter reaching a limit, a clock reaching a limit, a configuration change of the trusted execution environment, and a configuration change of the ICC.
12. The method, according to claim 1 , wherein particular one of the associated credentials is implemented using one of: iCLASS, Elliptic Curve Cryptography (ECC), X.509, Card Verifiable Certificate, and symmetric key cryptography and wherein the primary credential is an X.509 digital certificate.
13. The method, according to claim 1 , further comprising:
the credential manager receiving external input indicating that the particular one of the associated credentials should not be validated.
14. The method, according to claim 13 , wherein the external input is provided by a user.
15. The method, according to claim 1 , wherein the particular one of the associated credentials is invalidated after the particular one of the associated credentials is used.
16. A validation system, comprising:
a credential manager that selectively validates a particular one of the associated credentials for at least one device by validating a corresponding primary credential that is cryptographically independent from the plurality of the associated credentials, wherein the plurality of the associated credentials are deemed invalid when the corresponding primary credential is invalid; and
at least one device, coupled to the credential manager, that invalidates the particular one of the associated credentials while other ones of the plurality of the associated credentials and the corresponding primary credential remain valid.
17. The validation system, according to claim 16 , wherein the particular one of the associated credential is invalidated based on an external event.
18. The validation system, according to claim 17 , wherein the external event is selected from the group consisting of one or more of: a user invalidating the associated credential from a UI of the at least one device, a user improperly entering a pin value, a user indicating that a corresponding device is lost, the at least one device entering sleep mode, the at least one device locking a user interface thereof, the at least one device shutting down, the device losing connection to a network, the device leaving a location or area, the device configuration changing, and a particular time of day.
19. The validation system, according to claim 16 , wherein the particular one of the associated credentials is provided on an integrated circuit card (ICC).
20. The validation system, according to claim 19 , wherein the ICC is part of one of: a mobile phone and a smart card.
21. The validation system, according to claim 16 , wherein the particular one of the associated credentials is provided within a trusted execution environment of a device.
22. The validation system, according to claim 16 , wherein the particular one of the associated credentials is invalidated based on an internal event.
23. The validation system, according to claim 22 , wherein the internal event is selected from the group consisting of one or more of: a counter reaching a limit, a clock reaching a limit, a configuration change of the trusted execution environment, and a configuration change of the ICC.
24. The validation system, according to claim 16 , wherein particular one of the associated credentials is implemented using one of: iCLASS, Elliptic Curve Cryptography (ECC), X.509, Card Verifiable Certificate, and symmetric key cryptography and wherein the primary credential is an X.509 digital certificate.