Method of validating certificate by certificate validation server using certificate policies and certificate policy mapping in public key infrastructure

• US 20040030888A1
• Filed: 05/21/2003
• Published: 02/12/2004
• Est. Priority Date: 08/08/2002
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Kim, Tae Sung, Choi, Dae Seon, Cho, Sang Rae, Jin, Seung Hun, Cho, Young Seob, Kim, Hee Sun, Roh, Jong Hyuk
• Granted Patent: US 7,478,236 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

The present invention provides a method of validating a certificate by a certificate validation server using certificate policy and certificate policy mapping in a public key infrastructure (PKI). If the certificate validation server receives, from a client, an object certificate to be validated, a certificate of a certification authority which the client trusts, and a certificate policy which will be applied to validation of the object certificate, and receives a request for validation of the object certificate, the certificate validation server creates a certification path for the object certificate in response to the request. The certificate validation server validates the created certification path using a certificate policy mapping table if the validation of the object certificate is allowed, and then transmits a result message to the client according to the result of the validation of the certification path.

Claims

1. A method of validating a certificate by a certificate validation server using certificate policies and certificate policy mapping in a public key infrastructure, comprising the steps of:

allowing a certificate validation server to receive, from a client, an object certificate to be validated, a certificate of a certification authority which the client trusts, and a certificate policy which will be applied to validation of the object certificate, and allowing the certificate validation server to receive a request for validation of the object certificate;

allowing the certificate validation server to create a certification path for the object certificate in response to the request of the validation;

allowing the certificate validation server to determine whether the validation of the object certificate is allowed or denied using a certificate policy table with respect to the created certification path and the certificate policy;

allowing the certificate validation server to validate the created certification path using a certificate policy mapping table if the validation of the object certificate is allowed; and

allowing the certificate validation server to transmit a success message to the client if a validation result of the certification path is a success, or allowing the certificate validation server to transmit a failure message to the client if the validation result of the certification path is a failure.

2. The method according to claim 1, wherein the certificate policy table and the certificate policy mapping table are managed by the certificate validation server.

3. The method according to claim 1, wherein the certificate policy table is designed such that allowance policies and denial policies for certificate validation are separately managed.

4. The method according to claim 1, wherein the certificate policy mapping table is designed such that certificate policies of different domains are mapped to each other using the certificate policy mapping table in the public key infrastructure, thereby enabling certificates to be compatibly used between the different domains.