URL-based certificate in a PKI

• US 20030074555A1
• Filed: 10/17/2001
• Published: 04/17/2003
• Est. Priority Date: 10/17/2001
• Status: Abandoned Application

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Inventors: Fahn, Paul Neil, Semple, James
• Application Number:
  US09/978,200
• Publication Number:
  US 20030074555A1
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A method of requesting and issuing a certificate from certification authority for use by an initiating correspondent with a registration authority is provided. The initiating correspondent makes a request for a certificate to the registration authority, and the registration authority sends the request to a certificate authority, which issues the certificate to the registration authority. The certificate is stored at a location in a directory and this location is associated with a pointer such as uniform resource locator (URN) that is derived from information contained in the certificate request. The initiating correspondent computes the location using the same information and forwards it to other corespondents. The other correspondents can then locate the certificate to authenticate the public key of the initiating correspondent.

Claims

1. A method of allocating an address to a certificate to be stored in an addressable database for subsequent retrieval, said method comprising the steps of generating a string for use as a certificate locator from information contained in a certificate request and utilizing said string to obtain said address.

2. A method according to claim 1 wherein said string is mapped to an address in said directory.

3. A method according to claim 1 wherein said string is used as said address in said directory.

4. A method according to claim 1 wherein a mathematical function is applied to said information to obtain said string.

5. A method according to claim 4 wherein said mathematical function is a hash function.

6. A method according to claim 5 wherein said string is a portion of the output of said hash function.

7. A method of identifying an address of a certificate to a recipient of a signed message in a data communication system, said method comprising the steps of preparing a set of information for inclusion in a certificate request, generating from said set of information a string for use as a certificate locator in a database, and forwarding said string to said recipient to indicate the location of said certificate in said database.

8. A method according to claim 7 wherein said information includes a time varying element.

9. A method according to claim 7 wherein a predetermined mathematical function is applied to said information to obtain said string.

10. A method for maintaining certificates in a public key infrastructure having a certification authority and a pair of correspondents, said method comprising the steps of collating at one of said correspondents information comprising a request for a certificate of said certification authority, forwarding said request to said certification authority, computing from said information comprising said request a string for use as a certificate locator by said one correspondent and said certification authority, storing a certificate issued from said request in a directory at an address obtained from said string and forwarding said locator from said one correspondent to another permit retrieval of said certificate from said directory.

11. A method according to claim 10 wherein said information includes a time varying element.

12. A method according to claim 10 wherein communication between said one correspondent and said certification authority is performed over a secure channel.

13. A method according to claim 10 wherein said other correspondent obtains an address of said certificate from a known address of said directory and said string.

14. A method according to claim 10 wherein said other correspondent forwards said locator to said certification authority for construction of said address.

15. A method according to claim 10 wherein said string is computed by application of a cryptographic hash function at least part of said request.

16. A method according to claim 15 wherein said part includes a time varying element.

17. A method according to claim 15 wherein a portion of the output of said hash function is used as said bit string.

18. A method according to claim 10 wherein said but string is utilised as a pointer to an address in a directory.