Method and apparatus for managing digital certificates

• US 20080209208A1
• Filed: 02/27/2007
• Published: 08/28/2008
• Est. Priority Date: 02/27/2007
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Parkinson, Steven W.
• Granted Patent: US 8,135,950 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

Method and apparatus for managing digital certificates are described herein. In one embodiment, an encryption certificate is extracted from an email received from an owner of the encryption certificate, where the encryption certificate being issued from a trusted party other than the owner. Then the encryption certificate is associated with an entry of a directory based on an identity (ID) of the owner, where the directory provides directory services to one or more email servers. Other methods and apparatuses are also described.

Claims

1. A computer-implemented method for managing digital certificates, the method comprising:

extracting an encryption certificate from an email received from an owner of the encryption certificate, the encryption certificate being issued from a trusted party other than the owner; and

associating the encryption certificate with an entry of a directory based on an identity (ID) of the owner, the directory providing directory services to one or more email servers.

2. The method of claim 1, further comprising:

locating an existing entry associated with the owner of the encryption certificate within the directory;

upon successfully locating the existing entry, updating the existing entry with the extracted encryption certificate; and

publishing the updated encryption certificate in a network community, such that others in the network community can send an encrypted email to the owner of the encryption certificate.

3. The method of claim 1, further comprising adding a new entry based on the ID of the owner of the encryption certificate, if there is no existing entry associated with the owner of the encryption certificate in the directory.

4. The method of claim 1, further comprising verifying that the encryption certificate is issued by the trusted party prior to associating the encryption certificate with an entry of a directory.

5. The method of claim 1, further comprising verifying a signature signing the email to confirm that the email is received from the owner of the encryption certificate prior to associating the encryption certificate with an entry of a directory.

6. The method of claim 5, further comprising matching a first email address associated with the owner of the encryption certificate and a second email address associated with the signature that signs the email.

7. The method of claim 1, wherein the email is directed to a predetermined destination address to request for updating the entry associated with the certificate, including at least one of adding, deleting, modifying, and querying the entry in the directory.

8. The method of claim 1, wherein the trusted party is a certificate authority, wherein the directory is an LDAP (lightweight directory access protocol) compatible directory, and the ID of the owner comprises at least one of a name and email address associated with the owner.

12. The machine-readable medium of claim 1, wherein the method further comprises verifying that the encryption certificate is issued by the trusted party prior to associating the encryption certificate with an entry of a directory.

15. The machine-readable medium of claim 1, wherein the email is directed to a predetermined destination address to request for updating the entry associated with the certificate, including at least one of adding, deleting, modifying, and querying the entry in the directory.

16. The machine-readable medium of claim 1, wherein the trusted party is a certificate authority, wherein the directory is an LDAP (lightweight directory access protocol) compatible directory, and the ID of the owner comprises at least one of a name and email address associated with the owner.

9. A machine-readable medium having instructions, which when executed, cause a processor to perform a method for managing digital certificates, the method comprising:

extracting an encryption certificate from an email received from an owner of the encryption certificate, the encryption certificate being issued from a trusted party other than the owner; and

associating the encryption certificate with an entry of a directory based on an identity (ID) of the owner, the directory providing directory services to one or more email servers.

10. The machine-readable medium of claim 9, wherein the method further comprises:

locating an existing entry associated with the owner of the encryption certificate within the directory;

upon successfully locating the existing entry, updating the existing entry with the extracted encryption certificate; and

publishing the updated encryption certificate in a network community, such that others in the network community can send an encrypted email to the owner of the encryption certificate.

11. The machine-readable medium of claim 9, wherein the method further comprises adding a new entry based on the ID of the owner of the encryption certificate, if there is no existing entry associated with the owner of the encryption certificate in the directory.

13. The machine-readable medium of claim 9, wherein the method further comprises verifying a signature signing the email to confirm that the email is received from the owner of the encryption certificate prior to associating the encryption certificate with an entry of a directory.

14. The machine-readable medium of claim 13, wherein the method further comprises matching a first email address associated with the owner of the encryption certificate and a second email address associated with the signature that signs the email.

17. An apparatus for managing digital certificates, comprising:

an extractor to extract an encryption certificate from an email received from an owner of the encryption certificate, the encryption certificate being issued from a trusted party other than the owner; and

a directory entry processing unit coupled to the extractor to associate the encryption certificate with an entry of a directory based on an identity (ID) of the owner, the directory providing directory services to one or more email servers.

18. The apparatus of claim 17, further comprising an encryption certificate verifier configured to verify that the encryption certificate is issued by the trusted party prior to associating the encryption certificate with an entry of a directory.

19. The apparatus of claim 17, further comprising a signature verifier configured to verify a signature signing the email to confirm that the email is received from the owner of the encryption certificate prior to associating the encryption certificate with an entry of a directory.

20. The apparatus of claim 19, wherein the signature verifier is configured to match a first email address associated with the owner of the encryption certificate and a second email address associated with the signature that signs the email.

21. The apparatus of claim 17, wherein the directory entry processing unit is configured to:

locate an existing entry associated with the owner of the encryption certificate within the directory,

upon successfully locating the existing entry, update the existing entry with the extracted encryption certificate, and

cause the directory to publish the updated encryption certificate in a network community, such that others in the network community can send an encrypted email to the owner of the encryption certificate.

22. The apparatus of claim 17, wherein the directory entry processing unit is configured to add a new entry based on the ID of the owner of the encryption certificate, if there is no existing entry associated with the owner of the encryption certificate in the directory.