LIFECYCLE MANAGEMENT METHOD AND APPARATUS FOR TRUSTED CERTIFICATES AND TRUST CHAINS

• US 20200136838A1
• Filed: 06/30/2017
• Published: 04/30/2020
• Est. Priority Date: 06/30/2017
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola Solutions, Inc.
• Inventors: KUCHARSKI, Wojciech, MUSIAL, Elizeusz, GRZESIK, Andrzej, TOMASIK, Marcin, KRUEGEL, Chris A.
• Granted Patent: US 11,456,881 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A method and apparatus is provided for updating certificates in a trust chain and managing versions of the trust chain. A first electronic processor determines that a first certificate in a first level of the trust chain is to be updated, updating the first certificate and each certificate in a lower level in the trust chain that is lower than the first level, creates a second version of the trust chain including an updated first certificate and an updated certificate at each lower level in the trust chain, and transmits the second version of the trust chain to one or more entities.

Claims

1. A method of updating certificates in a trust chain including certificates in a hierarchical order and managing versions of the trust chain, comprising:

determining, by a first electronic processor, that a first certificate in a first level in a hierarchy of the trust chain is to be updated;

updating, by the first electronic processor, the first certificate and each certificate in a lower level in the hierarchy of the trust chain that is lower than the first level;

creating, by the first electronic processor, a second version of the trust chain including an updated first certificate and an updated certificate at each lower level in the hierarchy of the trust chain; and

transmitting, by the first electronic processor, the second version of the trust chain to one or more entities.

2. The method of claim 1, wherein the determining comprises monitoring a first version of the trust chain and determining that the first certificate is set to expire at an upcoming date.

3. The method of claim 1, wherein the determining comprises receiving an update request from a second electronic processor monitoring the trust chain.

4. The method of claim 1, further comprising requesting that an end entity having an end entity certificate including a first version of the trust chain send an update request for the end entity certificate;

and

subsequent to receiving the update request, updating the end entity certificate with the second version of the trust chain.

5. The method of claim 1, wherein transmitting the second version of the trust chain comprises transmitting a message including one of the second version of the trust chain or an updated portion of the second version of the trust chain, wherein the message is signed with a private key associated with a first electronic processor certificate.

6. The method of claim 5, wherein the message includes an instruction to replace a portion of a first version of the trust chain with the updated portion of the second version of the trust chain.

7. The method of claim 5, further comprising updating the first electronic processor certificate, wherein the message is signed with the private key associated with the first electronic processor certificate and the message includes an updated certificate associated with the first electronic processor and instructions to use the updated certificate associated with the first electronic processor.

8. The method of claim 7, further comprising deactivating the first electronic processor certificate and using the updated first electronic processor certificate.

9. The method of claim 1, further comprising deactivating a first version of the trust chain and using the second version of the trust chain to issue new end entity certificates.

10. The method of claim 1, further comprising receiving an update request for a first application certificate from an end entity,

determining that the end entity includes a second application certificate including the trust chain;

and

updating the first application certificate and the second application certificate using the second version of the trust chain.

11. An electronic processor configured to update certificates in a trust chain including certificates in a hierarchical order and manage versions of the trust chain, comprising:

a memory storing non-transitory computer-executable instructions;

a transceiver; and

wherein the electronic processor is configured to perform a set of functions in response to executing the computer-executable instructions, the set of functions including;

determining that a first certificate in a first level in a hierarchy of the trust chain is to be updated;

updating the first certificate and each certificate in a lower level in the hierarchy of the trust chain that is lower than the first level;

creating a second version of the trust chain including an updated first certificate and an updated certificate at each lower level in the hierarch of the trust chain; and

transmitting the second version of the trust chain to one or more entities.

12. The electronic processor of claim 11, wherein the determining comprises one of monitoring a first version of the trust chain and determining that the first certificate is set to expire at an upcoming date or receiving an update request from a second electronic processor monitoring the trust chain.

13. The electronic processor of claim 11, further requesting that an end entity having an end entity certificate including a first version of the trust chain send an update request for the end entity certificate;

and

subsequent to receiving the update request, updating the end entity certificate with the second version of the trust chain.

14. The electronic processor of claim 11, wherein transmitting the second version of the trust chain comprises transmitting a message including one of the second version of the trust chain or an updated portion of the second version of the trust chain, wherein the message is signed with a private key associated with a first electronic processor certificate.

15. The electronic processor of claim 14, wherein the message includes an instruction to replace a portion of a first version of the trust chain with the updated portion of the second version of the trust chain.

16. The electronic processor of claim 14, further comprising updating the first electronic processor certificate, wherein the message is signed with the private key associated with the first electronic processor certificate and the message includes an updated first electronic processor certificate and instructions to use the updated first electronic processor certificate.

17. The electronic processor of claim 16, further comprising deactivating the first electronic processor certificate and using the updated first electronic processor certificate.

18. The electronic processor of claim 11, further comprising deactivating a first version of the trust chain and using the second version of the trust chain to issue new end entity certificates.

19. The electronic processor of claim 11, further comprising receiving an update request for a first application certificate from an end entity,

determining that the end entity includes a second application certificate including the trust chain;

and

updating the first application certificate and the second application certificate using the second version of the trust chain.