System and method for installing and using a temporary certificate at a remote site

• US 6,233,341 B1
• Filed: 05/19/1998
• Issued: 05/15/2001
• Est. Priority Date: 05/19/1998
• Status: Expired due to Term

• Current Assignee: Blackberry Limited
• Original Assignee: Visto Corporation (Blackberry Limited)
• Inventors: Riggins, Mark D.
• Primary Examiner(s): Peeso, Thomas R.
• Assistant Examiner(s): Jack, Todd
• Application Number:
  US09/081,268
• Time in Patent Office: 1,092 Days
• Field of Search: 380/277, 380/278, 713/156, 713/158, 713/175
• US Class Current: 380/277
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A system installs and enables the use of a temporary certificate at a remote site. The system comprises a global server site, a temporary client site and a web site. The global server site includes a security module that identifies and authenticates the user at the temporary client site, and a web server engine that downloads a key generation downloadable and a certificate request engine downloadable upon user authentication to the client site. The client site includes a web engine that executes the key generation downloadable to generate a public key and a private key, and executes the certificate request engine downloadable to send the a temporary certificate request (including the public key) to the global server site. A temporary certificate generator at the global server site generates a temporary certificate having the public key and a validity period. The web server on the global server site sends the temporary certificate and a certificate installation downloadable to the web engine on the client site, which executes the downloadable thereby installing the temporary certificate. The web server on the global server site can also send a certificate maintenance downloadable and a certificate de-installation downloadable to the client site. The web server engine maintains a revocation list that contains information identifying revoked temporary certificates, so that a revoked but thusfar unexpired certificate cannot be improperly used. The web site reviews the temporary certificate for authenticity and contacts the global server site to review the revocation list and determine whether the temporary certificate has been revoked.

Claims

1. A computer-based method for installing a temporary certificate on a client site, comprising the steps of:

receiving a public key from a client site;

generating a temporary certificate containing the public key and a validity period; and

delivering the temporary certificate and a certificate installation downloadable to the client site, thereby enabling installing of the certificate on the client site without requiring network transfer of a client private key.

2. The method of claim 1, wherein the client site is unconfigured.

3. The method of claim 1, wherein the certificate installation downloadable includes code for causing the client site to install the temporary certificate in a web engine.

4. The method of claim 3, wherein the certificate installation downloadable includes an application program interface for communicating with the web engine.

5. The method of claim 1, further comprising the step of identifying and authenticating the user at the client site before generating the temporary certificate.

6. The method of claim 1, further comprising the step of establishing a secure channel with the client site before downloading the temporary certificate.

7. The method of claim 1, further comprising the step of forwarding to the client site a key generation downloadable for causing the client site to generate the public key and an associated private key.

8. The method of claim 7, further comprising the step of receiving a validity period duration request.

9. The method of claim 8, wherein the temporary certificate is a self-certified limited certificate.

10. The method of claim 8, further comprising the step of digitally signing the temporary certificate.

11. The method of claim 1, further comprising the step of forwarding to the client a certificate maintenance downloadable for causing the client site to monitor the validity period of the temporary certificate.

12. The method of claim 11, wherein the certificate maintenance downloadable further enables the client site to update the temporary certificate before expiration.

13. The method of claim 1, further comprising the step of downloading a certificate de-installation downloadable for causing the client site to de-install the temporary certificate from the client site.

14. The method of claim 13, wherein the de-installation downloadable stores information identifying an unexpired temporary certificate in a revocation list.

15. A system for installing a temporary certificate in a client site, comprising:

a server for receiving a public key from a client site;

a temporary certificate generator coupled to the server for generating a temporary certificate containing the public key and a validity period; and

a certificate installation downloadable coupled to the server for causing the client site to install the temporary certificate, thereby enabling installing of the certificate in the client site without requiring network transfer of a client private key.

16. The system of claim 15, wherein the client site is unconfigured.

17. The system of claim 15, wherein the certificate installation downloadable enables the client site to install the temporary certificate in a web engine.

18. The system of claim 17, wherein the certificate installation downloadable includes an application program interface for communicating with the web engine.

19. The system of claim 15, further comprising a security module coupled to the server for identifying and authenticating the user at the client site.

20. The system of claim 15, wherein the server generates a secure communications channel with the client site.

21. The system of claim 15, further comprising a key generation downloadable for causing the client site to generate the public key and a private key.

22. The system of claim 21, wherein the temporary certificate generator receives a validity period duration request from the client site and uses the duration request to determine the validity period.

23. The system of claim 22, wherein the temporary certificate generator digitally signs the temporary certificate.

24. The system of claim 23, wherein the server includes a server private key, and the temporary certificate generator uses the server private key to digitally sign the temporary certificate.

25. The system of claim 15, further comprising a certificate maintenance downloadable coupled to the server for causing the client site to monitor the validity window of the temporary certificate.

26. The system of claim 25, wherein the certificate maintenance downloadable coupled to the server further enables the client site to update the temporary certificate before expiration.

27. The system of claim 15, further comprising a certificate de-installation downloadable coupled to the server for causing the client site to de-install the temporary certificate from the client site.

28. The system of claim 27, wherein the de-installation downloadable stores information identifying an unexpired temporary certificate in a revocation list.

29. A computer-readable storage medium storing program code for causing a computer to perform the steps of:

receiving a public key from a client site;

generating a temporary certificate containing the public key and a validity period; and

delivering the temporary certificate and a certificate installation downloadable to the client site, thereby enabling installation of the certificate at the client site without requiring network transfer of a client site private key.

30. A method for installing a temporary certificate in a web engine, comprising the steps of:

generating a public key and a private key;

sending the public key to a certificate authority;

providing identification and authentication information to the certificate authority;

if identified and authenticated, receiving a certificate installation downloadable and a temporary certificate having a short validity period from the certificate authority; and

using the certificate installation downloadable to install the temporary certificate and the private key in the web engine, thereby enabling installing of the certificate at a client site corresponding to the web engine without requiring network transfer of the private key.

31. The method of claim 30, wherein the web engine is currently unconfigured.

32. The method of claim 30, further comprising the step of sending a temporary certificate duration request to the certificate authority.

33. The method of claim 32, wherein the validity period is based on the temporary certificate duration request.

34. A system for installing a temporary certificate on an unconfigured web engine, comprising:

a key generation module for generating a public and private key pair;

a certificate request module for transmitting the pubic key to a certificate authority;

a certificate installation module for installing a temporary certificate having a short validity period and the private key in an unconfigured web engine, thereby creating a temporarily configured web engine; and

a certificate maintenance module for monitoring the short validity period to determine if the temporary certificate has expired, thereby enabling installing of the certificate at a client site corresponding to the web engine without requiring network transfer of the private key.

35. The system of claim 34, wherein one of the modules is part of the web engine.

36. The system of claim 34, wherein one of the modules was downloaded from a remote computer.

37. The system of claim 34, wherein one of the modules is a stand-alone application program.

38. The system of claim 34, further comprising a certificate de-installation module for de-installing the temporary certificate upon expiration.

39. The system of claim 34, wherein the certificate maintenance module enables re-issuing the temporary certificate with a new short validity period.

40. The system of claim 34, wherein the certificate request module sends a request which includes the public key and identification and authentication information to the certificate authority.

41. A method of generating a self-certified temporary certificate, comprising the steps of:

receiving a temporary public key and user-identification information from a remote client;

retrieving a long-term public key certificate and a long-term private key from memory;

packaging the temporary public key, the user-identification information, a validity period and the long-term public certificate into a package; and

using the long-term private key to sign the package, thereby generating a self-certified temporary certificate without requiring network transfer of the long-term private key.

42. A method of examining a self-certified temporary certificate, comprising the steps of:

receiving a self-certified temporary certificate, which includes a signature, a validity period, a temporary public key, and a long-term public certificate containing a long-term public key and signed by a certificate authority private key associated with a certificate authority;

using a well-known public key associated with the certificate authority private key to verify the certificate authority signing the long-term certificate;

using the long-term public key to verify the signature of the temporary certificate, and thus to verify the client; and

enabling access to services during the validity period if the certificate authority and the temporary certificate have been verified, thereby enabling examining of the certificate of the client without requiring network transfer of a client private key.

43. A method of installing a temporary certificate, comprising the steps of:

generating a public and private key pair;

receiving a user-selected certificate duration request;

packaging the public key and the user-selected certificate duration request into a certificate generation request;

sending the certificate generation request to a certificate authority;

receiving a temporary certificate containing the public key and a limited validity period based on the user-selected temporary certificate duration request;

installing the temporary certificate and the private key in a web engine, thereby enabling installing of the certificate at the client without requiring network transfer of the client private key.

44. A method of generating a temporary certificate, comprising the steps of:

receiving a certificate generation request containing a public key and a user-selected certificate duration request from a remote client;

packaging the public key and a certificate validity period based on the user-selected certificate duration request into a package;

signing the package, thereby generating a temporary certificate; and

transmitting the temporary certificate to the remote client, thereby enabling generating of the certificate of the remote client without requiring network transfer of a remote client private key.