Remote management of client installed digital certificates

• US 20050081029A1
• Filed: 08/13/2004
• Published: 04/14/2005
• Est. Priority Date: 08/15/2003
• Status: Abandoned Application

• Current Assignee: Imcentric Incorporated, Venafi,Inc.
• Original Assignee: Imcentric Incorporated
• Inventors: Thornton, Russell S., Seegmiller, Jayson, Hodson, Benjamin
• Application Number:
  US10/917,964
• Publication Number:
  US 20050081029A1
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Disclosed herein are several digital certificate discovery and management systems. Detailed information on various example embodiments of the inventions are provided in the Detailed Description below, and the inventions are defined by the appended claims.

Claims

1. A method for automatically managing placement of digital certificates to client devices from a certificate management system, the certificate management system including network facilities for communication over an electronic communication network, the method comprising the steps of:

receiving requests for connections from clients,

attempting to retrieve a digital certificate from the client device by way of the network facilities and a client executable component,

if in said attempting a digital certificate is retrieved, checking for expiration of the retrieved digital certificate,

if in said attempting a digital certificate is retrieved, querying a revocation server by way of said network facilities for revocation of the retrieved digital certificate,

if the retrieved digital certificate is expired or revoked, retrieving a newly issued certificate from a network certificate server,

if in said attempting a digital certificate is not retrieved, accessing a certificate store to retrieve an authentication certificate,

following said accessing a network certificate server to retrieve an authentication certificate, placing the retrieved authentication certificate in the certificate store of said client device, and

authenticating the client device for data transfer.

2. A method according to claim 1, wherein said authenticating indicates authentication of an individual for a financial transaction.

3. A method according to claim 1, wherein said authenticating indicates authentication of an individual for a contractual transaction.

4. A method according to claim 1, wherein said authenticating indicates authentication of an individual for a loan application.

5. A method according to claim 1, further comprising the step of providing access to resources within an organization based on an authenticated individual'"'"'s access rights.

6. A method according to claim 1, further comprising the step of providing access to email messages for authenticated individuals.

7. A method according to claim 1, further comprising the step of providing access to applications on the client device for authenticated individuals.

8. A method for automatically managing placement of digital certificates to client devices from a certificate management system, the certificate management system including network facilities for communication over an electronic communication network, the method comprising the steps of:

receiving requests for connections from clients,

attempting to retrieve a digital certificate from the client device by way of the network facilities and said client executable component,

if in said attempting a digital certificate is retrieved, checking for expiration of the retrieved digital certificate,

if in said attempting a digital certificate is retrieved, querying a revocation server by way of said network facilities for revocation of the retrieved digital certificate,

if the retrieved digital certificate is expired or revoked, retrieving a newly issued certificate from a network certificate server,

if in said attempting a digital certificate is not retrieved, accessing a certificate store to retrieve an authentication certificate,

following said accessing a network certificate server to retrieve an authentication certificate, placing the retrieved authentication certificate in the certificate store of said client device, and

authenticating the client device for data transfer.

9. A method according to claim 8, wherein said authenticating indicates authentication of an individual for a financial transaction.

10. A method according to claim 8, wherein said authenticating indicates authentication of an individual for a contractual transaction.

11. A method according to claim 8, wherein said authenticating indicates authentication of an individual for a loan application.

12. A method according to claim 8, further comprising the step of providing access to resources within an organization based on an authenticated individual'"'"'s access rights.

13. A method according to claim 8, further comprising the step of providing access to email messages for authenticated individuals.

14. A method according to claim 8, further comprising the step of providing access to applications on the client device for authenticated individuals.

15. A method according to claim 8, further comprising the step of providing an access rights configuration interface operable from the client device upon authentication.

16. A method for automatically managing placement of digital certificates to client devices from a certificate management system, the certificate management system including network facilities for communication over an electronic communication network, the method comprising the steps of:

receiving requests for connections from clients,

attempting to retrieve a digital certificate from the client device by way of the network facilities and said client executable component,

if in said attempting a digital certificate is retrieved, checking for expiration of the retrieved digital certificate,

if in said attempting a digital certificate is retrieved, querying a revocation server by way of said network facilities for revocation of the retrieved digital certificate,

if the retrieved digital certificate is expired or revoked, retrieving a newly issued certificate from a network certificate server,

if in said attempting a digital certificate is not retrieved, accessing a certificate store to retrieve an authentication certificate,

following said accessing a network certificate server to retrieve an authentication certificate, placing the retrieved authentication certificate in the certificate store of said client device,

authenticating the client device for data transfer, said authenticating identifying the client device to the certificate management system, said authenticating further identifying a user to the certificate management system;

providing access to services conditioned on the enablement of the services for the identified client device and user.

17. A method according to claim 16, further comprising the step of providing an access rights configuration interface operable from the client device upon authentication.

18. A method according to claim 16, wherein said authenticating indicates authentication of an individual for a financial transaction.

19. A method according to claim 16, wherein said authenticating indicates authentication of an individual for a contractual transaction.

20. A method according to claim 16, wherein said authenticating indicates authentication of an individual for a loan application.

21. A method according to claim 16, further comprising the step of providing access to resources within an organization based on an authenticated individual'"'"'s access rights.

22. A method according to claim 16, further comprising the step of providing access to email messages for authenticated individuals.

23. A method according to claim 16, further comprising the step of providing access to applications on the client device for authenticated individuals.