AUTOMATED KEY MANAGEMENT SYSTEM AND METHOD

• US 20090119511A1
• Filed: 01/08/2009
• Published: 05/07/2009
• Est. Priority Date: 08/09/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: Adams, Neil P., Brown, Michael S., Little, Herbert A.
• Granted Patent: US 8,135,951 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0433 Key management protocols

Abstract

A system and method for automatic key and certificate management is disclosed. In particular, a key store in a base computer contains both new and previously viewed cryptographic keys. In one embodiment, for each new key, if a corresponding certificate matches an existing certificate, the new certificate may be automatically downloaded to a mobile communications device without prompting a user.

Claims

1. A system for processing electronic messages, the system comprising:

a base computer comprising a first memory for storing one or more certificates for use in at least one of decrypting secure electronic messages, encrypting secure electronic messages, or signing secure electronic messages;

a mobile communications device comprising a second memory for storing one or more certificates for use in at least one of decrypting secure electronic messages, encrypting secure electronic messages, or signing secure electronic messages; and

program logic operable to automatically identify one or more certificates corresponding to one or more new keys in said first memory for downloading to said second memory;

wherein the certificates are identified based on detection of new keys and certificates corresponding to the new keys;

wherein said program logic is configured to mark certificates corresponding to the new keys that match existing certificates stored in the first memory;

wherein said new keys are determined by comparing a list of previously available keys with a current list of keys in said first memory; and

wherein said program logic is configured to automatically download said identified certificates to said mobile communications device.

2. The system of claim 1, wherein said mobile communications device comprises a wireless device.

3. The system of claim 1, wherein said base computer comprises a desktop computer.

4. The system of claim 1, wherein said program logic is resident on said base computer.

5. The system of claim 1, further comprising a device that receives said mobile communications device and provides a hard wired interface enabling communication between said base computer and said mobile communications device.

6. The system of claim 1, further comprising a device that receives said mobile communications device and provides a wireless interface enabling communication between said base computer and said mobile communications device.

7. The system of claim 1, wherein said program logic is invoked via a key synchronization utility running on said base computer.

8. A method for updating a cryptographic certificate store of a mobile communications device, the method comprising:

establishing an interface between a base computer and the mobile communications device;

detecting one or more new keys by comparing a list of previously available keys with one or more keys in a key store of the base computer;

determining whether a certificate corresponding to a new key matches an existing certificate stored in the first memory; and

downloading the certificate corresponding to the new key if a match between the corresponding certificate and an existing certificate is determined.

9. The method of claim 8, wherein said mobile communications device comprises a wireless device.

10. The method of claim 8, wherein said base computer comprises a desktop computer.

11. The method of claim 8, wherein said step of establishing a connection is accomplished via a hard wired connection.

12. The method of claim 8, wherein the step of establishing a connection is accomplished via a wireless connection.

13. The method of claim 8, wherein said method is accomplished using a certificate synchronization utility executing on the base computer.

14. The method of claim 8, further comprising updating the list of previously available keys to include the new keys.

15. A computing device for processing electronic messages, the computing device comprising:

a first memory for storing one or more certificates for use in at least one of decrypting secure electronic messages, encrypting secure electronic messages, or signing secure electronic messages;

an interface provided for communication with a mobile communications device; and

program logic operable to automatically identify one or more certificates corresponding to one or more new keys in said first memory for downloading to said second memory;

wherein the certificates are identified based on detection of new keys and certificates corresponding to the new keys;

wherein said program logic is configured to mark certificates corresponding to the new keys that match existing certificates stored in the first memory;

wherein said new keys are determined by comparing a list of previously available keys with a current list of keys in said first memory; and

wherein said program logic is configured to automatically download said identified certificates to said mobile communications device.

16. The computing device of claim 15, wherein said mobile communications device comprises a wireless device.

17. The computing device of claim 15, wherein said computing device comprises a desktop computer.

18. The computing device of claim 15, wherein the interface comprises a hard wired interface.

19. The computing device of claim 15, wherein the interface comprises a wireless interface.

20. The computing device of claim 15, wherein said program logic is invoked via a key synchronization utility running on said computing device.