SYSTEM AND METHOD FOR CHECKING DIGITAL CERTIFICATE STATUS

• US 20100250948A1
• Filed: 04/28/2010
• Published: 09/30/2010
• Est. Priority Date: 03/20/2002
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: Janhunen, Stefan E., Little, Herbert A.
• Granted Patent: US 8,103,876 B2
• Time in Patent Office: Days
• US Class Current: 713/175
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A method for handling digital certificate status requests between a client system and a proxy system is provided. The method includes the steps of receiving at the proxy system digital certificate status request data transmitted from the client system and generating query data for the digital certificate status in response to receiving the digital certificate status request data. The query data is transmitted to a status provider system, and status data from the status provider system in response to the query data is received at the proxy system. Digital certificate status data based on the status data received is generated and transmitting to the client system.

Claims

1. A proxy system configured to redirect a data item to a client system, comprising:

a proxy module configured to determine whether the data item includes a transmitted digital certificate and, upon a determination that the data item includes the transmitted digital certificate, to generate and provide query data for the transmitted digital certificate for transmission to a status provider system and to receive status data for the transmitted digital certificate in response to the query data.

2. The proxy system of claim 1 wherein the proxy system is further operable to generate transmitted digital certificate status data based on the status data received;

and to transmit the transmitted digital certificate status data to the client system.

3. The proxy system of claim 1 wherein the proxy system is further operable to communicate with a plurality of status providers, thereby allowing the proxy system to redirect status data from the plurality of status providers to the client system.

4. The proxy system of claim 1 wherein said client system is a mobile device.

5. The proxy system of claim 1, wherein the proxy module is further operable to:

receive a digital certificate status request data transmitted from the client system;

generate the query data for the digital certificate status in response to receiving the digital certificate status request data;

transmit the query data to a status provider system;

receive status data from the status provider system in response to the query data;

generate digital certificate status data based on the status data received; and

transmit the digital certificate status data to the client system.

6. The proxy system of claim 5, wherein the digital certificate status data comprises a subset of the status data received from the status provider system.

7. The proxy system of claim 5, wherein the status request data comprises a subset of the query data.

8. The proxy system of claim 7, wherein the query data comprises an Online Certificate Status Protocol (OCSP) query.

9. The proxy system of claim 5, wherein the digital certificate status data transmitted from the proxy system comprises a valid indicator, a revoked indicator, or an unknown indicator.

10. The system of claim 5, wherein the digital certificate comprises a digital certificate chain of digital certificates, and wherein the status request data comprises data corresponding to each digital certificate in the digital certificate chain.

11. The system of claim 5, wherein the digital certificate status data comprises validity period data indicating a validity period for the digital certificate, and wherein the client system is further operable to periodically generate and provide status request data corresponding to a status request for transmission to the proxy system during the validity period of the digital certificate.

12. The system of claim 5, wherein the status request data is received from the client system at predetermined times spaced at predetermined intervals or at configurable intervals.

13. A method for redirecting a data item to a client system at a proxy system, comprising:

determining whether the data item includes a transmitted digital certificate;

generating and providing, upon a determination that the data item includes the transmitted digital certificate, query data for the transmitted digital certificate to a status provider system;

receiving status data for the transmitted digital certificate in response to the query data;

generating digital certificate status data based on the status data received; and

transmitting the digital certificate status data to the client system.

14. The method of claim 13, further comprising communicating with a plurality of status providers;

and

redirecting status data from the plurality of status providers to the client system.

15. The method of claim 13, further comprising:

receiving digital certificate status request data transmitted from the client system;

generating query data for the digital certificate status in response to receiving the digital certificate status request data;

transmitting the query data to a status provider system;

receiving at the proxy system status data from the status provider system in response to the query data;

generating digital certificate status data based on the status data received; and

transmitting the digital certificate status data to the client system;

16. The method of claim 13, wherein the proxy system receives the status data from the status provider system using communication protocols other than Online Certificate Status Protocol (OCSP).

17. The method of claim 13, wherein the digital certificate is used to encode an outgoing message prior to sending of the message from the mobile device.

18. The method of claim 13, wherein the digital certificate status data comprises validity period data indicating a validity period for the digital certificate, and wherein the client module is further operable to periodically generate and provide status request data corresponding to a status request for transmission to the proxy system during the validity period of the digital certificate.

19. The method of claim 13, wherein the status request data is received from the client system at predetermined times spaced at predetermined intervals or at configurable intervals.

20. The method of claim 13, wherein the proxy system is configured to communicate with the client system over a wireless network, wherein the client system is a mobile device.

21. A computer-readable memory encoded with instructions for commanding a data-processor to execute steps comprising:

determining whether the data item includes a transmitted digital certificate;

generating and providing, upon a determination that the data item includes the transmitted digital certificate, query data for the transmitted digital certificate to a status provider system;

receiving status data for the transmitted digital certificate in response to the query data;

generating digital certificate status data based on the status data received; and

transmitting the digital certificate status data to the client system.