System and method for supporting multiple certificate status providers on a mobile communication device

• US 20050148323A1
• Filed: 03/20/2003
• Published: 07/07/2005
• Est. Priority Date: 03/20/2002
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Little, Herbert A, Hobbs, Dale J., Janhunen, Stefan E.
• Granted Patent: US 7,865,720 B2
• Time in Patent Office: Days
• US Class Current: 455/414.100
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/00 Services specially adapted for wireless communication networks; Facilities therefor
• CPC Class Codes: H04W 88/182 Network node acting on behalf of an other network entity, e.g. proxy

Abstract

A method and system for supporting multiple digital certificate status information providers are disclosed. An initial service request is prepared at a proxy system client module and sent to a proxy system service module operating at a proxy system. The proxy system prepares multiple service requests and sends the service requests to respective multiple digital certificate status information providers. One of the responses to the service requests received from the status information providers is selected, and a response to the initial service request is prepared and returned to the proxy system client module based on the selected response.

Claims

1. A method of accessing multiple digital certificate status information providers to obtain digital certificate status information, comprising the steps of:

receiving a request for digital certificate status information from a communication device;

generating multiple service requests based upon the received request, each of the multiple service requests corresponding to a digital certificate status information provider;

sending the generated multiple service requests to their corresponding digital certificate status information providers;

receiving a plurality of responses comprising digital certificate status information from the digital certificate status information providers;

ranking the received responses based upon ranking criteria;

based upon the ranking, using at least one of the received responses to generate a response to the request for digital certificate status information; and

sending the generated response to the request to the communication device.

2. The method of claim 1, wherein the request includes a list of status information providers to which a service request is to be sent.

3. The method of claim 2, wherein the request includes a ranking list that specifies an order of preference between subsequent responses from the status information providers.

4. The method of claim 2, wherein the list of status information providers is arranged in order of preference between subsequent responses from the status information providers.

5. The method of claim 1, further comprising the step of processing a secure message at the communication device based on the generated response sent to the communication device.

6. The method of claim 5, wherein the secure message comprises a digital signature.

7. The method of claim 1, wherein the request comprises identification information identifying a target digital certificate for which digital certificate status information is requested, wherein the response from the at least one of the digital certificate status information providers comprises status information for the target digital certificate, and wherein the generated response comprises a status indicator for the target digital certificate.

8. The method of claim 7, wherein the status indicator comprises one of:

a valid indicator, a revoked indicator, and an unknown indicator.

9. The method of claim 8, wherein the target digital certificate comprises a signature key for verifying a digital signature in a secure message received at the communication device, further comprising the steps of:

determining whether the status indicator is the valid indicator; and

verifying the digital signature using the signature key where the status indicator is the valid indicator.

10. The method of claim 9, wherein the secure message is a message that has been signed and then encrypted.

11. The method of claim 9, wherein the secure message is a message that has been encrypted and then signed.

12. The method of claim 6, wherein the secure message was signed using Secure Multipurpose Internet Mail Extensions (S/MIME) techniques.

13. The method of claim 6, wherein the secure message was signed using Pretty Good Privacy (PGP) techniques.

14. The method of claim 6, wherein the secure message comprises an e-mail message.

15. The method of claim 9, wherein the secure message further comprises the target digital certificate.

16. The method of claim 1, further comprising the steps of:

receiving a secure message comprising a digital certificate at the communication device; and

generating a request for digital certificate status information for the digital certificate in the secure message.

17. The method of claim 1, further comprising the step of:

generating the request for digital certificate status information at the communication device at predetermined time intervals.

18. The method of claim 17, wherein the predetermined time intervals are configurable by a user of the communication device.

19. The method of claim 1, further comprising the steps of:

invoking digital certificate checking operations by a user through a user interface of the communication device; and

generating the request for digital certificate status information at the communication device in response to the step of invoking.

20. The method of claim 1, wherein the request comprises a revocation status request for a digital certificate stored at the communication device.

21. The method of claim 20, wherein the generated multiple service requests that are sent to corresponding digital certificate status information providers comprise revocation status information requests.

22. The method of claim 6, wherein the secure message further comprises a chained digital certificate, wherein status information for the digital certificate and the chained digital certificate is requested in the request, and wherein the generated response comprises a status indicator for the digital certificate and the chained digital certificate.

23. The method of claim 1, wherein status information for a plurality of digital certificates is requested in the request, and wherein the generated response comprises a status indicator for each of the plurality of digital certificates.

24. The method of claim 23, wherein each of the multiple service requests comprises a status information request for at least one of the plurality of digital certificates.

25. The method of claim 24, wherein each of the multiple service requests comprises a status information request for the plurality of digital certificates.

26. The method of claim 1, wherein the multiple service requests and each response from the digital certificate status information providers conform to Online Certificate Status Protocol (OCSP).

27. The method of claim 8, wherein the target digital certificate comprises a cryptographic key, further comprising the steps of:

determining whether the status indicator is the valid indicator; and

processing a message to be sent from the communication device using the cryptographic key where the status indicator is the valid indicator.

28. The method of claim 27, wherein the step of processing comprises the steps of:

encrypting the message using a session key; and

encrypting the session key using the cryptographic key.

29. The method of claim 27, wherein the step of processing comprises the step of encrypting the message using the cryptographic key.

30. The method of claim 27, wherein the cryptographic key is a public key corresponding to a private key of an intended recipient of the message.

31. The method of claim 1, wherein a proxy computer system connected to the communication device and to the status information providers performs the steps of receiving the request, generating multiple service requests, sending the generated multiple generated service requests, receiving a response from at least one of the service providers, generating a response to the request, and sending the generated response.

32. The method of claim 31, wherein the proxy computer system generates the multiple service requests based upon the received request and upon information stored locally at the proxy computer system.

33. The method of claim 31, wherein the step of generating a response to the request comprises the steps of:

determining whether the received digital certificate status information comprises a signed portion; and

generating a response comprising the signed portion without the unsigned portion.

34. The method of claim 31, wherein the communication device comprises a proxy system client component, wherein the proxy computer system comprises a proxy system service component, and wherein the proxy system service component is configured to exchange information with the proxy system client component to obtain digital certificate status information.

35. The method of claim 34, wherein the communication device comprises multiple proxy system client components, and wherein each of the proxy system client components is adapted to collect request information and to process response information for a different digital certificate status check protocol.

36. The method of claim 35, wherein the request information collected by the proxy system client components is combined into the request and sent to the proxy computer system, and wherein the proxy system service component extracts information from the request to generate the multiple service requests.

37. The method of claim 34, wherein the proxy computer system comprises status provider client components which exchange information with different status information providers to obtain digital certificate status information.

38. The method of claim 37, wherein the proxy system client component includes information required by the status provider clients in the request only once.

39. The method of claim 37, further comprising the step of:

selecting a digital certificate on the communication device for which digital certificate status information is to be requested,

wherein the proxy system client component extracts request information required by a proxy system service component from the selected digital certificate.

40. The method of claim 37, wherein the proxy system client component is configured to collect request information comprising a unique identifier for each digital certificate for which digital certificate status information is requested, wherein the proxy computer system comprises a mapping table which contains associations between digital certificate issuers and unique identifiers, and wherein the association is used in generating the multiple service requests.

41. The method of claim 37, wherein the proxy computer system generates and sends a service request to each status information provider for which a status provider client component has been implemented.

42. The method of claim 37, wherein the proxy computer system generates and sends a service request to each status information provider in a list of status information providers stored at the proxy computer system.

43. The method of claim 31, wherein the proxy computer system sends an error message to the communication device when the request contains insufficient information for the proxy computer system to generate the multiple service requests.

44. The method of claim 40, wherein the request information further comprises a list of status information providers, and wherein the proxy computer system generates and sends a service request to each status information provider in the list of status information providers.

45. The method of claim 44, wherein each unique identifier comprises a digital certificate serial number.

46. The method of claim 44, wherein each unique identifier comprises digital certificate subject name.

47. The method of claim 44, wherein a status provider client component formats a service request for its corresponding status information provider based on a unique identifier received by the proxy system service component from the proxy system client component.

48. The method of claim 37, wherein the proxy computer system provides an interface between the communication device and status information providers.

49. The method of claim 48, wherein requests and responses between the proxy system client component and proxy system service component conform to a different communication protocol than a protocol used between the status provider client components and their corresponding status information providers.

50. The method of claim 49, wherein the communication protocol between the status provider client components and their corresponding status information providers is Online Certificate Status Protocol (OCSP), and wherein the communication protocol between the proxy system client component and the proxy system service component supports a more compact protocol involving less data exchange than OCSP.

51. The method of claim 50, wherein the communication device comprises multiple proxy system client components, and wherein the proxy computer system comprises multiple proxy system service components.

52. The method of claim 31, wherein the proxy computer system is connected to the communication device via a network connection.

53. The method of claim 52, wherein the network connection between the proxy computer system and the communication device comprises a wireless gateway and a wireless network connection.

54. The method of claim 53, wherein the network connection between the proxy computer system and the communication device further comprises a wide area network.

55. The method of claim 52, wherein the network connection between the proxy computer system and the communication device comprises a virtual private network.

56. The method of claim 31, wherein the proxy computer system is connected to the status information providers via a wide area network.

57. The method of claim 1, wherein the step of generating a response to the request comprises the steps of:

determining whether any of the responses from the status information providers contain digital certificate status information; and

generating a response comprising an error message where none of the responses from the status information providers contain digital certificate status information.

58. The method of claim 1, wherein the step of generating a response to the request comprises the steps of:

detecting receipt of a first definitive response from one of the status information providers; and

generating a response to the request using at least a portion of the first definitive response.

59. The method of claim 1, wherein the step of generating a response to the request comprises the steps of:

selecting a response from one of the status information providers based on predetermined selection criteria; and

generating a response to the request using at least a portion of the selected response.

60. The method of claim 59, wherein the selection criteria comprise a status information provider ranking list.

61. The method of claim 1, wherein the communication device is selected from the group consisting of:

a handheld communication device, a data communication device, a voice communication device, a dual-mode communication device, a mobile telephone with data communication capabilities, a personal digital assistant (PDA) enabled for wireless communications, a two-way pager, and a wireless modem.

62. An apparatus for accessing multiple digital certificate status information providers to obtain digital certificate status information for a communication device, comprising:

means for receiving a request regarding digital certificate status information from the communication device;

means for generating multiple service requests based upon the received request, each generated service request corresponding to a digital certificate status information provider;

means for sending the generated multiple service requests to their corresponding status information providers over a computer network;

means for receiving over a computer network a response from at least one of the status information providers, means for determining whether any of the responses from the status information providers contain digital certificate status information;

wherein the status information response includes an error message where none of the responses from the status information providers contain digital certificate status information.