IDENTITY-BASED CERTIFICATE MANAGEMENT

• US 20100257358A1
• Filed: 04/07/2009
• Published: 10/07/2010
• Est. Priority Date: 04/07/2009
• Status: Active Grant

• Current Assignee: SecureAuth Incorporated
• Original Assignee: SecureAuth Incorporated
• Inventors: Lo, Jeff, GRAJEK, GARRET
• Granted Patent: US 8,707,031 B2
• Time in Patent Office: Days
• US Class Current: 713/158
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3252 using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

Methods for managing digital certificates, including issuance, validation, and revocation are disclosed. Various embodiments involve querying a directory service with entries that correspond to a particular client identity and have attributes including certificate issuance limits and certificate validity time values. The validity time values are adjustable to revoke selectively the certificates based upon time intervals set forth in validity identifiers included therein.

Claims

1. A method for validating a digital certificate issued to a client system and associated with a specific client identity, the method comprising:

receiving the digital certificate from the client system, the digital certificate including a user identifier and a certificate validity period identifier, the user identifier corresponding to the specific client identity;

generating a first query to a directory service having a plurality of entries each associated with different client identities, the first query including a request for a first entry associated with the specific client identity, the first entry including a directory validity time value for the specific client identity;

receiving the directory validity time value returned by the first query; and

validating the digital certificate in response to a first evaluation of the certificate validity period identifier against the received directory validity time value.

2. The method of claim 1, wherein the certificate validity period is defined by a validity start time and a validity end time.

3. The method of claim 2, wherein the validity start time is subsequent to the validity time value in the first evaluation.

4. The method of claim 2, wherein the digital certificate is rejected in response to a second evaluation in which the validity start time in the digital certificate is prior to the received directory validity time value for the specific client identity.

5. The method of claim 2, wherein the digital certificate is rejected in response to a third evaluation in which the validity end time in the digital certificate is prior to a current time.

6. The method of claim 1, further comprising:

removing access restrictions to a network application resource upon validating the digital certificate.

7. The method of claim 6, wherein the user identifier corresponds to an account on the network application resource.

8. The method of claim 1, wherein the directory service is a lightweight directory access protocol (LDAP) compliant system.

9. The method of claim 1, wherein the directory service is a Standard Query Language (SQL) database.

10. A method for issuing a digital certificate to a client system, the digital certificate being associated with a client identity, the method comprising:

receiving a certificate issuance request from the client system;

generating a first query to a directory service for a first entry associated with the client identity in response to the certificate issuance request, the first entry having an attribute including an issuance count value;

generating the digital certificate in response to a comparison of the issuance count value being less than a predefined issuance limit value; and

issuing the digital certificate to the client system.

11. The method of claim 10, wherein prior to issuing the digital certificate to the client system, the method further includes:

transmitting a challenge to a user of the client system;

receiving from the user a response to the challenge; and

validating the client system based upon the challenge-response sequence, the digital certificate being issued to the validated client system.

12. The method of claim 11, wherein the challenge is transmitted to the user via a predetermined telephone device associated with the client identity.

13. The method of claim 11 wherein the challenge is transmitted to an e-mail address associated with the client identity.

14. The method of claim 10, further comprising:

generating a second query to the directory service including an increment of the issuance count value of the entry associated with the client identity.

15. The method of claim 10, wherein the generated digital certificate includes a certificate validity period identifier with a validity start time and a validity end time.

16. The method of claim 15, wherein the validity start time and the validity end time are subsequent to a generation time of the digital certificate.

17. The method of claim 10, wherein the directory service is a lightweight directory access protocol (LDAP) compliant system.

18. The method of claim 10, wherein the directory service is a Standard Query Language (SQL) database.

19. A method for revoking digital certificates associated with a client identity, the method comprising:

receiving a revocation request for a one of the digital certificates associated with the client identity, the revocation request including a validity time stamp;

setting a directory validity time value in a first entry of a directory service to the validity time stamp; and

incrementing an issuance count value in the first entry, the issuance count value being representative of a number of digital certificates issued to the client identity;

wherein the digital certificates include a user identifier corresponding to the client identity and a certificate validity period identifier, the directory validity time value being subsequent to the certificate validity period identifier of the one of the digital certificates.

20. The method of claim 19, wherein the validity time stamp has a value corresponding to the time of the revocation request, all of the digital certificates associated with the client identity being revoked as having a validity time value prior to the validity time stamp.

21. The method of claim 20, further comprising:

resetting the issuance count value to zero.

22. The method of claim 19, wherein the directory service is a lightweight directory access protocol (LDAP) compliant system.

23. The method of claim 19, wherein the directory service is a Standard Query Language (SQL) database.