Patent ID: 7721102

Claim:
A system for detecting exposure of an OCSP responder's session private key in a D-OCSP-KIS to verify the status of a user's certificate online, comprising: a plurality of clients each including a processor which requests certificate status information; a plurality of OCSP responders each including a processor which receives the certificate status information request from the clients, sends a response, produces a hash value, and delivers the hash value to a certificate authority (CA) to get a certificate issued; and the CA including a processor which receives the hash value from the OCSP responders and issues the certificate to the OCSP responders in response to a certificate issue request; wherein each of the clients verifies a digital signature using a hash value contained in a certificate of at least one of the OCSP responders and a hash value contained in the response, and each of the clients stores a counter value for a hash operation in each verification and recognizes the response as valid when a current counter value is greater than a previous counter value; and wherein the OCSP responders compute the hash values by repetitively computing as many hash chains as the total number of clients, and deliver final values of the hash chains to the CA.