(19)Fresh off Patent
(45) Week of Oct 19, 2026 No. 7 3,667 lapsed 70 listed
Cybersecurity & privacy · expired at full term Oct 19, 2026

Grounded dense hash-tree certificate revocation responder

A CA publishes a rooted hash tree (

Sheet 1 of the patent drawingsSheet 2 of the patent drawingsSheet 3 of the patent drawings

(57) What the patent covered

This write-up was generated by AI from the patent's text and may contain mistakes, so check it against the original patent before relying on it.

The independent claim covered a method where, on a request for a certificate's validation at a specific time interval, the responder computes and returns the co-node (sibling-hash) values for the grey vertex corresponding to that interval in a grounded dense hash tree whose bottom-layer leaves are only children of their parents; the responder either sends all co-node values if the requester does not specify which are needed or sends only the requested co-node values when specified.

Distinguishing feature: Use of a grounded dense hash tree (a densely populated Merkle tree variant with single-child bottom leaves) and selective transmission of co-node values per-interval to trade communication versus server computation.

Novelty 4/5. At filing (2003–2005) Merkle-tree CRTs and CRLs were known; the patent introduced a specific dense/grounded tree layout and per-interval co-node computation/transmission as a different approach to revocation proof distribution.

Implementation

Implement the grounded dense hash tree as a logical Merkle tree stored in a database keyed by (interval, node index). On revocation or periodic update, compute leaves for intervals and populate internal node hashes bottom-up. Expose an authenticated API that accepts a certificate identifier and interval and returns the set of co-node hashes; if the client indicates which co-node positions it needs the server returns those only. Clients verify by hashing the certificate interval leaf with the co-nodes to rederive and compare the published root (or signed root) for that interval.

Components: CA server process that stores hash tree nodes, Persistent storage for leaf and internal node hashes (database, object store), Network API (TLS-protected REST or RPC) for validation queries, Batch hash computation library (SHA-1, SHA-256), Client-side verifier that reconstructs root from received co-nodes.

Buildability 5/5. Main engineering work is deterministic hash bookkeeping and efficient partial-tree hash computation; scale depends on intervals and leaf density rather than new protocols or hardware.

Market demand

No demand check has been run for this patent. Likely search terms: Merkle-tree revocation proofs, certificate revocation proof API, grounded dense hash tree CRT. The links in the sidebar open these searches.

Buyers: Certificate authorities; PKI operators; secure IoT or enterprise device fleets.

Before manufacturing

This patent has 1 related US patent (continuation, divisional or parent) that may remain in force: US 7,840,994. Review their claims before proceeding.

Patent has lapsed but similar Merkle-tree revocation schemes and operational requirements (signed roots, interval management, clock trust) are common; careful design needed for storage growth and proof size tradeoffs.

This patent has reached the end of its full term and cannot be revived. This page is a research lead, not legal advice. Obtain a freedom-to-operate opinion before manufacturing.

Claim 1, as granted

1. A method comprising: receiving a request for validation status information for a certificate at a specific interval; computing, with a computer processor, values of co-nodes of a grey vertex corresponding to the specific interval in a grounded dense hash tree, wherein each bottom layer leaf in the grounded dense hash tree is an only child to a corresponding parent leaf in the grounded dense hash tree; and transmitting co-node values to the requester, wherein transmitting co-node values to the requester comprises transmitting all co-node values to the requestor when the requester does not indicate which co-node values are needed and transmitting requested co-node values to the requester when the requester indicates which co-node values are needed.