Patent ID: 8041943

Claim:
A method for enforcing use of certificate revocation lists in validating certificates, the certificate revocation lists being associated with a series of list generation indices such that each of the certificate revocations lists is assigned one of the list generation indices, the list generation indices advancing according to a time of generation of the certificate revocation lists, the certificate revocation lists and the list generation indices being cryptographically signed, the method comprising: receiving one of the certificate revocation lists and an associated one of the list generation indices as an identifier of the one certificate revocation list; checking the certificates against the one certificate revocation list; associating each of the certificates, which have been checked against the one certificate revocation list, with the one list generation index; receiving an enforcement generation index associated with a latest one of the certificate revocation lists in use; storing the enforcement generation index as a last known enforcement generation index; and refusing performance of an action associated with one of the certificates if the one list generation index of the one certificate is earlier in the series than the last known enforcement generation index.