Scalable certificate management system architectures

Inventors

Meyer, Alan T. • Powell, Gregory A.

Assignees

Integrity Security Services LLC

Abstract

An example system may include one or more application platforms (e.g., VMs) that run a registration authority and are communicatively connected to one or more compute engines that perform cryptographic computations required by the registration authority. The system may also include one or more application platforms that run an enrollment certificate authority and that are communicatively connected to one or more compute engines that perform cryptographic computations required by the enrollment certificate authority. It may further include one or more application platforms that run a pseudonym certificate authority and that are communicatively connected to one or more compute engines that perform cryptographic computations required by the pseudonym certificate authority. It may also include one or more load balancers communicatively connected to the one or more compute engines, the one or more load balancers to perform operations comprising distributing at least one request to the one or more compute engines.

Core Innovation

The invention describes a scalable certificate management system for securely providing certificates. The system includes one or more application platforms that run a registration authority application, an enrollment certificate authority application, a pseudonym certificate authority application, a first linkage authority application, and a second linkage authority application. Each application platform is communicatively connected to one or more compute engines that perform cryptographic computations requested by the corresponding authority application(s).

The enrollment certificate authority application generates and conditionally transmits an enrollment certificate to the registration authority application, and the pseudonym certificate authority application generates and conditionally transmits pseudonym certificates to the registration authority application. The first linkage authority application and the second linkage authority application generate and conditionally transmit linkage values to the registration authority application. Requests are generated within the authority applications and cryptographic computations are performed by the compute engines based on those requests.

The system further includes assigning certificate loads to computerized devices, where each certificate load indicates a number of pseudonym certificates to be stored within each computerized device during a time period, and the certificate loads are assignable so that different computerized devices can have different numbers of pseudonym certificates stored during the time period. The document also describes one or more load balancers connected to the compute engines to distribute at least one request based on a health measurement of the one or more compute engines, together with certificate provisioning roles, secure communication channels, and audit logging of provisioning and device activities.

Claims Coverage

The document provides three independent claims: a scalable certificate management system, a method for securely providing certificates, and a non-transitory computer-readable medium. Across these independent claims, four inventive features are asserted: authority applications request cryptographic computations from compute engines, load balancers distribute requests based on compute engine health measurements, and per-device assignable certificate loads control pseudonym certificate storage quantities during a time period.

All independent claims cover a scalable certificate management arrangement in which multiple authority applications request cryptographic computations from connected compute engines, load balancers distribute requests using a health measurement of the compute engines, and assignable certificate loads determine pseudonym certificate storage quantities per computerized device during a time period. The method and medium claims implement the same operations, including cryptographic computations, conditional generation and transmission of enrollment certificates, pseudonym certificates, and linkage values to the registration authority, and health-measurement-based request distribution.

Stated Advantages

Documented Applications