Method of and apparatus for providing secure distributed directory services and public key infrastructure

• US 6,249,873 B1
• Filed: 07/13/1999
• Issued: 06/19/2001
• Est. Priority Date: 02/28/1997
• Status: Expired due to Term

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Xcert Software Incorporated
• Inventors: Richard, Patrick, Knipe, Bruce, Woodward, Bruce, Csinger, Andrew
• Primary Examiner(s): Trammell, James P.
• Assistant Examiner(s): Elisca, Pierre E.
• Application Number:
  US09/352,353
• Time in Patent Office: 707 Days
• Field of Search: 713/200, 713/156, 713/201, 713/171, 713/202, 713/173, 713/175, 380/228, 380/30, 380/45, 709/229, 340/825.31, 340/825.34
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

In an exemplary embodiment, the server receives the client'"'"'s Distinguishing Name (DN), and then searches its directory for identification information and access control rights for this specific context. The server can act as a stand-alone server or in conjunction with other directory services on the network. A client must have a verifiable identity in order for secure communications to continue. A client'"'"'s identity can be said to be fully verifiable if the server has access to the directory service that maintains that client'"'"'s DN. The client receives the server'"'"'s DN, and the client can then determine whether or not to accept a response to a request for information (i.e., trust the response). The client determines the identity of the server using some directory service (the client can act stand-alone or as a client of other directory servers). A server is fully verifiable if the client can identify the directory service that maintains the server'"'"'s DN. In both cases, determining identity is predicated on being able to identify a directory service. Since servers and clients are issued identities (DN'"'"'s) from some directory service before they participate in secure communications, they are able to at least identify their “home” directory service. Their “home” directory service communicates with other directory services, each “serving” their lists of electronic identities to each other using secure directory services. In this manner, a client or server can verify the peer identity of a secure communicator by relying on the trusted “home” directory service. Public Key certificates, certificate revocation lists, pending certificate requests, Certification Authority policy, and other information is stored in the directory server. Access to the directory server is through secure communications; this maintains the integrity and privacy of the information.

Claims

1. A method for providing secure communications between a client at a first workstation and a computer comprising the steps of:

receiving at said computer a request from said client for at least one of information and services, said request including at least one digital certificate identifying said client;

checking at said computer to determine if the issuer of said digital certificate is recognized;

verifying that said digital certificate is valid; and

retrieving, if the digital certificate is valid, an access control rule to apply to the communication session with said client during which at least one of information and services is provided to said client.

2. A method according to claim 1, further including the step of applying said access control rule to the communications session.

3. A method according to claim 2, wherein said client requests access to a web site via said request and wherein said step of applying said access control rules includes the step of permitting the client to perform operations at said web site only in accordance with said access control rules.

4. A method according to claim 1, further including the step of accessing information related to the degree of trust which may be associated with said client.

5. A method according to claim 1, wherein said receiving step includes the step of receiving the client'"'"'s public key.

6. A method according to claim 1, wherein said computer includes an internal data base and wherein said step of checking includes the step of checking to determine if the public key of an identified certifying party is stored in said internal data base.

7. A method according to claim 6, further including the step of accessing information related to the degree of trust which may be associated with said client.

8. A method for providing secure communications between a client at a first workstation and a computer comprising the steps of:

receiving at said computer a request from said client for at least one of information and services, said request uniquely identifying said client;

checking at said computer to determine if the client is recognized by said computer;

retrieving, if the client is recognized, an access control rule to apply to the communication session with said client during which at least one of information and services is provided to said client;

applying said access control rule to the communications session with said client.

9. A method according to claim 8, wherein said receiving step includes the step of uniquely identifying the client via a digital certificate.

10. A method according to claim 9, wherein said computer includes an internal data base and wherein said step of checking includes the step of checking to determine if the public key of an identified certifying party is stored in said internal data base.

11. A method according to claim 8, wherein said receiving step includes the step of receiving data uniquely identifying the client including the client'"'"'s public key.

12. A method according to claim 8, wherein said client requests access to a web site via said request and wherein said step of applying said access control rules includes the step of permitting the client to perform operations at said web site only in accordance with said access control rules.

13. A method according to claim 8, further including the step of accessing information related to the degree of trust which may be associated with said client.

14. A method for providing secure communications between a client at a first workstation and a computer comprising the steps of:

receiving at said computer a request from said client of at least one of information and services, said request including at least one digital certificate identifying said client;

checking at said computer to determine if the digital signature in said digital certificate is valid; and

retreiving an access control rule to apply to the communication session with said client during which at least one of information and services is provided to said client.

15. A method according to claim 14, further including the step of accessing information related to the degree of trust which may be associated with said client.

16. A method according to claim 14, further including the step of applying said access control rules to the communications session with the client.

17. A method according to claim 16, wherein said client requests access to a web site via said request and wherein said step of applying said access control rules includes the step of permitting the client to perform operations at said web site only in accordance with said access control rules.

18. A method according to claim 14, wherein said computer includes an internal data base and wherein said step of checking includes the step of checking to determine if the public key of an identified certified party is stored in said internal data base.

19. A method according to claim 14, further including the step of accessing information related to the degree of trust which may be associated with said client.

20. A method for providing secure communications between a client at a first workstation coupled to a network including a plurality of computers comprising the steps of:

receiving at a first computer a request from said client for at least one of information and services, said request uniquely identifying said client;

checking at said first computer to determine if the client is recognized;

checking at a second computer coupled to said network, to determine if the client is recognized; and

retrieving from said second computer, if the client is recognized, an access control rule to apply to the communication session with said client during which at least one of information and services is provided to said client.

21. A method according to claim 20, further including the step of applying said access control rule to the communications session with said client.

22. A method according to claim 21, wherein said client requests access to a web site via said request and wherein said step of applying said access control rules includes the step of permitting the client to perform operations at said web site only in accordance with said access control rules.

23. A method according to claim 20, further including the step of identifying a second computer for operating as a server which can verify the identity of said client and interconnecting said second computer with said first computer via the Internet.

24. A method according to claim 20, further including the step of accessing information related to the degree of trust which may be associated with said client.

25. A method according to claim 20, wherein said receiving step includes the step of uniquely identifying the client via a digital certificate.

26. A method according to claim 25, further including the step of accessing information related to the degree of trust which may be associated with said client.

27. A method according to claim 20, wherein said receiving step includes the step of receiving data uniquely identifying the client including the client'"'"'s public key.

28. A method according to claim 20, wherein said first computer and said second computer include an internal data base and wherein said step of checking includes the step of checking to determine if the public key of an identified certifying party is stored in said internal data base.