Patent ID: 8707030

Claim:
A method of providing path validation information for a system, comprising: determining, using at least one processor, paths between each of a plurality of certificates of the system and at least one trust root; storing, in a non-transitory computer readable medium, validation information prior to a request for path validation information for a trust path from a target certificate to the at least one trust root, the trust path including a chain of certificates from the target certificate to the at least one trust root, wherein the validation information identifies a particular trust path from a particular one of the plurality of certificates to the at least one trust root, wherein the validation information for each particular trust path includes a proof for each of the plurality of certificates along the particular trust path indicating that each of the plurality of certificates has not been revoked, and wherein the proofs for the plurality of certificates are stored for each of the plurality of certificates of the particular trust path, are digitally signed, and are pre-generated prior to receiving the request for path validation information; in response to the request for path validation information, determining, using at least one processor, the trust path from the target certificate to the at least one trust root that satisfies the request, fetching the validation information for the trust path, and providing to a relying party the validation information for the trust path in response to the request without performing real-time certificate status validation of the trust path; and applying name or policy constraints to the validation information and only providing validation information that is consistent with the constraints.