METHOD AND APPARATUS FOR SECURELY EXCHANGING CRYPTOGRAPHIC IDENTITIES THROUGH A MUTUALLY TRUSTED INTERMEDIARY

• US 20090037727A1
• Filed: 10/07/2008
• Published: 02/05/2009
• Est. Priority Date: 04/10/2003
• Status: Active Grant

• Current Assignee: Max Pritikin
• Original Assignee: Max Pritikin
• Inventors: Pritikin, Max
• Granted Patent: US 7,743,246 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A method of securely exchanging cryptographic identities through a mutually trusted intermediary is disclosed. Data, which specifies a petitioner'"'"'s cryptographic identity and a petitioner'"'"'s resource identifier, is received. Input, which specifies an authority'"'"'s resource identifier, is received. The petitioner'"'"'s cryptographic identity and the petitioner'"'"'s resource identifier are sent to a destination that is associated with the authority'"'"'s resource identifier. Data, which specifies the authority'"'"'s cryptographic identity, is received. The authority'"'"'s cryptographic identity is sent to a destination that is associated with the petitioner'"'"'s resource identifier.

Claims

1. A computer-implemented method for securely exchanging cryptographic identities through a mutually trusted intermediary computer, the method comprising:

receiving, at the trusted intermediary computer, from a petitioner computer, data that

specifies;

a first cryptographic identity of the petitioner computer,

a first resource identifier identifying a first location where the petitioner computer is located, and

an input receiving entity for accepting input, from a particular entity at the trusted intermediary computer, that specifies a second resource identifier identifying a second location where an authority computer is located;

receiving, at the trusted intermediary computer, from the particular entity, the input that specifies the second resource identifier identifying the second location where the authority computer is located, and to which the trusted intermediary computer is to send the data received from the petitioner computer;

sending, from the trusted intermediary computer, the first cryptographic identity and the first resource identifier to the authority computer at the second location indicated by the second resource identifier;

receiving, from the authority computer, data that specifies a second cryptographic identity of the authority computer and the first resource identifier and the second resource identifier; and

sending, from the trusted intermediary computer, the second cryptographic identity and the second resource identifier to the petitioner computer at the first location indicated by the first resource identifier.

2. The method of claim 1, further comprising:

requesting first authentication data from a user at the trusted intermediary computer;

sending, from the trusted intermediary computer, the first authentication data to the petitioner computer at the first location indicated by the first resource identifier;

requesting second authentication data from the user at the trusted intermediary computer; and

sending, from the trusted intermediary computer, the second authentication data to the authority computer at the second location identified by the second resource identifier.

3. The method of claim 1, wherein the data is first web page data, wherein the first resource identifier is a first uniform resource locator (URL) identifying the petitioner computer, wherein the second resource identifier is a second URL identifying the authority computer, and wherein the second URL is received from an input field on a web page.

4. The method of claim 1, wherein the data is markup language data contained in a first Hypertext Transfer Protocol (HTTP) message received from the petitioner computer, wherein the first cryptographic identity is a first public key of the petitioner computer, wherein the first resource identifier is a first uniform resource locator (URL) identifying the petitioner computer, wherein the second resource identifier is a second URL identifying the authority computer, and wherein the second URL is received from an input field on a web page.

5. The method of claim 1, wherein the particular entity is an automated entity.

6. An apparatus for securely exchanging cryptographic identities through a mutually trusted intermediary computer, comprising:

means for receiving, at the trusted intermediary computer, from a petitioner computer, data that specifies;

a first cryptographic identity of the petitioner computer,

a first resource identifier identifying a first location where the petitioner computer is located, and

an input receiving entity for accepting input, from a particular entity at the trusted intermediary computer, that specifies a second resource identifier identifying a second location where an authority computer is located;

means for receiving, at the trusted intermediary computer, from the particular entity, the input that specifies the second resource identifier identifying the second location where the authority computer is located, and to which the trusted intermediary computer is to send the data received from the petitioner computer;

means for sending, from the trusted intermediary computer, the first cryptographic identity and the first resource identifier to the authority computer at the second location indicated by the second resource identifier;

means for receiving, from the authority computer, data that specifies a second cryptographic identity of the authority computer and the first resource identifier and the second resource identifier; and

means for sending, from the trusted intermediary computer, the second cryptographic identity and the second resource identifier to the petitioner computer at the first location indicated by the first resource identifier.

7. The apparatus of claim 6, further comprising:

means for requesting first authentication data from a user at the trusted intermediary computer;

means for sending, from the trusted intermediary computer, the first authentication data to the petitioner computer at the first location indicated by the first resource identifier;

means for requesting second authentication data from the user at the trusted intermediary computer; and

means for sending, from the trusted intermediary computer, the second authentication data to the authority computer at the second location identified by the second resource identifier.

8. The apparatus of claim 6, wherein the data is first web page data, wherein the first resource identifier is a first uniform resource locator (URL) identifying the petitioner computer, wherein the second resource identifier is a second URL identifying the authority computer, and wherein the second URL is received from an input field on a web page.

9. The apparatus of claim 6, wherein the data is markup language data contained in a first Hypertext Transfer Protocol (HTTP) message received from the petitioner computer, wherein the first cryptographic identity is a first public key of the petitioner computer, wherein the first resource identifier is a first uniform resource locator (URL) identifying the petitioner computer, wherein the second resource identifier is a second URL identifying the authority computer, and wherein the second URL is received from an input field on a web page.

10. The apparatus of claim 6, wherein the particular entity is an automated entity.

11. A volatile or non-volatile computer-readable medium carrying one or more sequences of instructions for securely exchanging cryptographic identities through a mutually trusted intermediary computer, which instructions, when executed by one or more processors, cause the one or more processors to perform:

receiving, at the trusted intermediary computer, from a petitioner computer, data that specifies;

a first cryptographic identity of the petitioner computer,

a first resource identifier identifying a first location where the petitioner computer is located, and

an input receiving entity for accepting input, from a particular entity at the trusted intermediary computer, that specifies a second resource identifier identifying a second location where an authority computer is located;

receiving, at the trusted intermediary computer, from the particular entity, the input that specifies the second resource identifier identifying the second location where the authority computer is located, and to which the trusted intermediary computer is to send the data received from the petitioner computer;

sending, from the trusted intermediary computer, the first cryptographic identity and the first resource identifier to the authority computer at the second location indicated by the second resource identifier;

receiving, from the authority computer, data that specifies a second cryptographic identity of the authority computer and the first resource identifier and the second resource identifier; and

sending, from the trusted intermediary computer, the second cryptographic identity and the second resource identifier to the petitioner computer at the first location indicated by the first resource identifier.

12. The medium of claim 11, wherein the one or more sequences of instructions for securely exchanging cryptographic identities through a mutually trusted intermediary computer further comprise instructions which, when executed by one or more processors, cause the one or more processors to perform:

requesting first authentication data from a user at the trusted intermediary computer;

sending, from the trusted intermediary computer, the first authentication data to the petitioner computer at the first location indicated by the first resource identifier;

requesting second authentication data from the user at the trusted intermediary computer;

sending, from the trusted intermediary computer, the second authentication data to the authority computer at the second location identified by the second resource identifier.

13. The medium of claim 11, wherein the data is first web page data, wherein the first resource identifier is a first uniform resource locator (URL) identifying the petitioner computer, wherein the second resource identifier is a second URL identifying the authority computer, and wherein the second URL is received from an input field on a web page.

14. The medium of claim 11, wherein the data is markup language data contained in a first Hypertext Transfer Protocol (HTTP) message received from the petitioner computer, wherein the first cryptographic identity is a first public key of the petitioner computer, wherein the first resource identifier is a first uniform resource locator (URL) identifying the petitioner computer, wherein the second resource identifier is a second URL identifying the authority computer, and wherein the second URL is received from an input field on a web page.

15. The medium of claim 11, wherein the particular entity is an automated entity.

16. An apparatus for securely exchanging cryptographic identities through a mutually trusted intermediary computer, comprising:

a network interface that is coupled to a data network for receiving one or more packet flows therefrom;

a processor; and

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

receiving, at the trusted intermediary computer, from a petitioner computer, data that specifies;

a first cryptographic identity of the petitioner computer,

a first resource identifier identifying a first location where the petitioner computer is located, and

an input receiving entity for accepting input, from a particular entity at the trusted intermediary computer, that specifies a second resource identifier identifying a second location where an authority computer is located;

receiving, at the trusted intermediary computer, from the particular entity, the input that specifies the second resource identifier identifying the second location where the authority computer is located, and to which the trusted intermediary computer is to send the data received from the petitioner computer;

sending, from the trusted intermediary computer, the first cryptographic identity and the first resource identifier to the authority computer at the second location indicated by the second resource identifier;

receiving, from the authority computer, data that specifies a second cryptographic identity of the authority computer and the first resource identifier and the second resource identifier; and

sending, from the trusted intermediary computer, the second cryptographic identity and the second resource identifier to the petitioner computer at the first location indicated by the first resource identifier.

17. The apparatus of claim 16, wherein the one or more sequences of instructions for securely exchanging cryptographic identities through a mutually trusted intermediary computer further comprise instructions which, when executed by the one or more processors, cause the one or more processors to perform:

requesting first authentication data from a user at the trusted intermediary computer;

sending, from the trusted intermediary computer, the first authentication data to the petitioner computer at the first location indicated by the first resource identifier;

requesting second authentication data from the user at the trusted intermediary computer;

sending, from the trusted intermediary computer, the second authentication data to the authority computer at the second location identified by the second resource identifier.

18. The apparatus of claim 16, wherein the data is first web page data, wherein the first resource identifier is a first uniform resource locator (URL) identifying the petitioner computer, wherein the second resource identifier is a second URL identifying the authority computer, and wherein the second URL is received from an input field on a web page.

19. The apparatus of claim 16, wherein the data is markup language data contained in a first Hypertext Transfer Protocol (HTTP) message received from the petitioner computer, wherein the first cryptographic identity is a first public key of the petitioner computer, wherein the first resource identifier is a first uniform resource locator (URL) identifying the petitioner computer, wherein the second resource identifier is a second URL identifying the authority computer, and wherein the second URL is received from an input field on a web page.

20. The apparatus of claim 16, wherein the particular entity is an automated entity.