Efficient digital certificate processing in a data processing system

• US 6,321,333 B1
• Filed: 10/14/1998
• Issued: 11/20/2001
• Est. Priority Date: 10/14/1998
• Status: Expired due to Term

• Current Assignee: ESW Holdings, Inc. (ESW Capital, LLC)
• Original Assignee: Wave Systems Corporation
• Inventors: Murray, Eric
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/173,474
• Time in Patent Office: 1,133 Days
• Field of Search: 713/156, 713/168, 713/175, 713/176, 713/180
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model

Abstract

The present invention is directed toward efficient digital certificate processing. In one aspect a system for efficient digital certificate processing comprises a computer and a secure certificate cache coupled to a computer. The secure certificate cache stores pre-verified digital certificates. In a second aspect, a method for efficient digital certificate processing in a data processing system comprises providing a secure certificate cache and receiving a digital certificate. The method further includes determining if the digital certificate is within the secure certificate cache. The method finally includes verifying the validity of the digital certificate if the digital certificate is within the secure certificate cache. The system and method in accordance with the present invention provides efficient processing of digital certificates in that it advantageously avoids unnecessary repetitive verification of commonly used digital certificates and also requires less memory to verify a certificate chain than conventional systems. Pre-verified digital certificates are maintained in the secure certificate cache to facilitate accelerated certificate chain validation and avoid repeat verification in the future.

Claims

1. A system for efficient digital certificate processing comprising:

a computer; and

a secure certificate cache coupled to the computer, the secure certificate cache for storing pre-verified digital certificates.

2. The system of claim 1 wherein the computer includes:

means for receiving a digital certificate;

means for determining whether the digital certificate is within the secure certificate cache; and

means for verifying the validity of the digital certificate if the digital certificate is within the secure certificate cache.

3. The system of claim 2 wherein the computer further includes:

means for determining whether an issuer digital certificate exists in the secure certificate cache if the digital certificate cache is not in the secure certificate cache;

first means for verifying that signature for the issue digital certificate exists in the secure certificate cache if issuer digital certificate exists in the secure certificate cache;

second means for verifying the validity and extensions of the digital certificate responsive to the first verifying means; and

means for providing a cache entry in the secure certificate cache responsive to the digital certificate being valid.

4. The system of claim 3, wherein the validity and extensions comprise the start and stop dates on the digital certificate.

5. A method for efficient digital certificate processing in a data processing system comprising the steps of:

a) providing a secure certificate cache for storing digital certificates which have been validated;

b) receiving a digital certificate;

c) determining if the received digital certificate is within the secure certificate cache; and

d) validating the received digital certificate if the digital certificate is within the secure certificate cache.

6. The method of claim 5, further comprising the step (e) of performing a certificate chain verification if the received digital certificate is not within the secure certificate cache.

7. The method of claim 6, wherein step (e) further includes the steps of:

e) determining whether an issuer digital certificate exists in the secure certificate cache if the digital certificate is not in the secure certificate cache;

f) verifying that a signature for the issuer exists in the secure certificate cache if the issuer digital certificate exists in the secure certificate cache;

g) verifying the validity and extensions of the digital certificate if the signature exists in the secure certificate cache; and

h) providing a cache entry in the secure certificate cache responsive to the digital certificate being valid.

8. The method of claim 7 wherein the validity and extensions comprise the start and stop dates on the digital certificate.

9. A system for efficient digital certificate processing comprising:

a non-secure computing environment;

a secure computing environment;

a host interface coupled between the non-secure computing environment and the secure computing environment by the host interface so that access by the non-secure computer environment to data processed in the secure environment is restricted; and

a certificate cache within the secure computing environment, the certificate cache coupled to the host interface for storing pre-verified digital certificates.

10. The system of claim 9 wherein the secure computing environment includes:

means for receiving a digital certificate;

means for determining whether the digital certificate is within the secure certificate cache; and

means for verifying the validity of the digital certificate if the digital certificate is within the secure certificate cache.

11. The system of claim 9 wherein the secure computing environment further includes:

means for determining whether an issuer digital certificate exists in the secure certificate cache if the digital certificate cache is not in the secure certificate cache;

first means for verifying that signature for the issue digital certificate exists in the secure certificate cache if issuer digital certificate exists in the secure certificate cache;

second means for verifying the validity and extensions of the digital certificate responsive to the first verifying means; and

means for providing a cache entry in the secure certificate cache responsive to the digital certificate being valid.

12. The system of claim 11, wherein the validity and extensions comprise the start and stop dates on the digital certificate.

13. The system of claim 12, wherein the secure computing environment further includes a co-processor coupled between the host interface and the certificate cache for controlling secure data processing.

14. The system of claim 13, wherein the host interface further includes a virtual firewall interface for implementing the restriction of access to data processed in the secure environment including the digital certificates data stored in the secure certificate cache.

15. The system of claim 14, wherein the virtual firewall interface includes an interface communication protocol for managing digital certificates.

16. A computer readable medium containing program instructions for efficient digital certificate processing in a data processing system, the program instructions for:

providing a secure certificate cache;

receiving a digital certificate;

determining if the digital certificate is within the secure certificate cache; and

verifying the validity of the digital certificate if the digital certificate is within the secure certificate cache.

17. The computer readable medium of claim 16 which includes program instructions for performing a certificate chain verification.

18. The computer readable medium of claim 17 which includes program instructions for:

determining whether an issuer digital certificate exists in the secure certificate cache if the digital certificate is not in the secure certificate cache;

verifying that a signature for the issuer exists in the secure certificate cache if the issuer digital certificate exists in the secure certificate cache;

verifying the validity and extensions of the digital certificate if the signature exists in the secure certificate cache; and

providing a cache entry in the secure certificate cache responsive to the digital certificate being valid.

19. The computer readable medium of claim 18 wherein the validity and extensions comprise the start and stop dates on the digital certificate.