Authority-neutral certification for multiple-authority PKI environments

• US 20030065921A1
• Filed: 08/26/2002
• Published: 04/03/2003
• Est. Priority Date: 09/28/2001
• Status: Active Grant

• Current Assignee: Fintegraph, LLC (Ascend Innovation Management, LLC)
• Original Assignee: Imagitas Incorporated (Red Ventures LLC)
• Inventors: Chang, Kae-por F.
• Granted Patent: US 7,328,344 B2
• Time in Patent Office: Days
• US Class Current: 713/175
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A method for facilitating electronic certification, and systems for use therewith, are presented in the context of public key encryption infrastructures. Some aspects of the invention provide methods for facilitating electronic certification using authority-neutral service requests sent by an application, which are then formatted by a server comprising a middleware that can convert the authority-neutral request into certification authority specific objects. The server and middleware then return a response from a selected certification authority back to the service requesting application. Thus, the server and/or middleware act as intermediaries that facilitate user transactions in an environment having multiple certification authorities without undue burden on the applications or the expense and reliability problems associated therewith.

Claims

1. A method for facilitating electronic certification, comprising:

receiving, on a server, a service request from an application, the service request containing public key encryption data;

based on information contained in the service request, selecting a certification authority, from a plurality of available certification authorities;

generating a data object including information associated with the information in the service request;

transmitting the data object from the server to the selected certification authority;

receiving, on the server, a response from the selected certification authority;

generating a response object including information associated with information contained in the response; and

transmitting the response object to the application.

2. The method of claim 1, wherein the service request is certification authority-neutral.

3. The method of claim 1, wherein generating the data object comprises putting the data object into a format consistent with an industry-standard protocol.

4. The method of claim 3, wherein the industry-standard protocol is the Open Certificate Status Protocol (OCSP).

5. The method of claim 1, wherein the electronic certification takes place in a public key infrastructure (PKI) environment.

6. The method of claim 1, wherein the server is a World Wide Web server adapted for conducting secure transactions.

7. The method of claim 1, wherein receiving the service request comprises receiving a HTTPS message from the application.

8. The method of claim 1, wherein the response from the selected certification authority is in a format consistent with an industry-standard protocol.

9. The method of claim 8, wherein the industry-standard protocol is the Open Certificate Status Protocol (OCSP).

10. The method of claim 1, further comprising posting an object to the server using a Post method.

11. The method of claim 1, further comprising passing the service request, using a load balancer, to a selected server, the server selected from a plurality of servers.

12. The method of claim 1, wherein generating the service response object comprises putting the response into a HTTP-compatible format.

13. The method of claim 1, further comprising accessing a database to retrieve data associated with the application.

14. The method of claim 1, further comprising accessing a database to retrieve data associated with an end user.

15. The method of claim 1, further comprising fetching a hardware token for delivery to the application.

16. The method of claim 1, further comprising checking a Certificate Revocation List (CRL) for information relevant to the electronic certification.

17. The method of claim 1, further comprising storing a log entry in a log associated with the application.

18. The method of claim 1, further comprising storing a log entry in a log associated with the certification authority.

19. The method of claim 1, further comprising registration of the application using a registration process.

20. The method of claim 19, wherein the registration process comprises creating an application preference profile.

21. The method of claim 20, wherein the application preference profile is stored on a database.

22. The method of claim 1, wherein the transmitted data object comprises a subset of application-related information, the subset being chosen based on the selected certification authority.

23. A system for facilitating electronic certification in a public key infrastructure (PKI), comprising:

a server connecting an application with a PKI certification authority; and

middleware, implemented on the server, the middleware comprising;

a responder for responding to a service request received from the application;

a dispatcher for routing communication through the server;

a selector for selecting a certification authority from among a plurality of available certification authorities based on the service request; and

a certification service request formatter corresponding to the selected certification authority.

24. The system of claim 23, further comprising an application.

25. The system of claim 24, further comprising an end user, the end user having transactional relations with the application.

26. The system of claim 23, further comprising a certification authority.

27. The system of claim 23, further comprising a communication network coupled to the server for passing communication signals between the server and any of:

the application and the selected certification authority.

28. The system of claim 23, further comprising a load balancer coupled to the server, for delivering the service request to the server.

29. The system of claim 23, further comprising a database for storing data.

30. The system of claim 29, wherein the database is coupled to the server over a network.

31. The system of claim 29, wherein the database comprises a LDAP database.

32. The system of claim 29, wherein the database contains application-specific data.

33. The system of claim 29, wherein the database contains certification authority-specific data.

34. The system of claim 29, further comprising a Certificate Revocation List (CRL).

35. The system of claim 29, further comprising a log for logging transactions.

36. A method for facilitating an electronic certification transaction in a public key infrastructure (PKI), comprising:

(A) storing user profile data, corresponding to a user, on a database;

(B) storing application data, corresponding to an application, on the database;

(C) storing permission data, indicative of an application'"'"'s permission to access user profile data, on the database;

(D) determining whether an application requesting a portion of the user profile data has permission to access said portion of the user profile data, based on the permission data; and

(E) if said application in (D) does have permission to access said portion of the user profile data, selectively allowing said application in (D) to access said portion of the user profile data to conduct said electronic certification transaction.

37. The method of claim 36, wherein the user profile data and the application data and the permission data are stored in a table in the database.