Cryptographic system and methodology for creating and managing crypto policy on certificate servers

• US 6,336,186 B1
• Filed: 09/16/1998
• Issued: 01/01/2002
• Est. Priority Date: 07/02/1998
• Status: Expired due to Term

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Callas, Jonathan David, Dyksterhouse, Marc David, McArdle, Mark James
• Primary Examiner(s): Peeso, Thomas R.
• Assistant Examiner(s): JACK, TODD M
• Application Number:
  US09/156,266
• Time in Patent Office: 1,203 Days
• Field of Search: 380/277, 380/278, 380/282, 380/285, 713/156, 713/168, 713/176
• US Class Current: 713/156
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A cryptosystem having a Certificate (Key) Server for storing and maintaining certificate or key information in a certificate database is described. The Certificate Server allows clients to submit and retrieve keys from a database based on a set of policy constraints which are set for one'"'"'s particular site (e.g., company). Access to the Certificate Server is maintained by a Certificate Policy Agent, which makes sure that the policy is enforced for a given site based on the information supplied during the configuration. During operation, the Certificate Server responds to client requests to add, search for, and retrieve certificates. The server accepts or rejects certificates based on configurable parameters enforced by a Certificate Policy Agent. When a certificate is submitted to the server, the Certificate Policy Agent checks to see if it meets the criteria for a given site based on the settings specified during the configuration. Exemplary types of checks that the Certificate Policy Agent can enforce include checking to see if the key has been signed by the appropriate entities and checking to see if the signatures or User IDs associated with a key are approved for submission. If the submission criteria established during the configuration are met, the key is accepted by the server. If the key being submitted does not pass the policy requirements, it is rejected and (optionally) a copy is placed in a “pending bucket” where the key can subsequently be examined by the system administrator to determine if the key should be allowed on the server.

Claims

1. In a computer environment providing public key cryptography, a method for creating and managing a crypto policy on a server, said server providing a central repository of public keys for use by a plurality of clients, the method comprising:

defining a crypto policy comprising a set of constraints specifying one or more conditions which keys submitted to the server must satisfy before being accepted for storage in the central repository of the server;

receiving a request from a client to store a particular key in the central repository of the server;

determining whether the particular key satisfies said set of constraints;

if the particular key satisfies said set of constraints, storing the particular key in the central repository of the server, so that the key is available to other clients from the server; and

if the particular key does not satisfy said set of constraints, rejecting the particular key from storage in the central repository of the server, so that the key is not available to other clients from the server.

2. The method of claim 1, wherein said set of constraints includes a constraint specifying that the particular key must include a required signature.

3. The method of claim 2, wherein said signature comprises a cryptographic digital signature of a particular entity that has signed the particular key.

4. The method of claim 1, wherein said set of constraints includes a constraint specifying that the particular key may not include a signature which has not been approved.

5. The method of claim 4, further comprising:

removing from the particular key any signature which has not been approved.

6. The method of claim 1, wherein said set of constraints includes a constraint specifying that the particular key may not include a user identifier (ID) which has not been approved.

7. The method of claim 6, further comprising:

removing from the particular key any user ID which has not been approved.

8. The method of claim 1, further comprising:

if the particular key has been rejected, transferring the key to a pending bucket.

9. The method of claim 8, further comprising:

allowing a user with system administrator privileges to inspect the pending bucket for keys which have been rejected.

10. The method of claim 9, further comprising:

allowing the user with system administrator privileges to approve any key which has been placed in the pending bucket.

11. The method of claim 9, further comprising:

allowing the user with system administrator privileges to delete any key which has been placed in the pending bucket.

12. The method of claim 1, wherein said set of constraints is specified by a configuration file.

13. The method of claim 12, wherein said configuration file is configurable only by a user having system administrator privileges.

14. The method of claim 1, further comprising:

receiving a request from a client for a key which has been accepted for storage in the central repository; and

satisfying the request by providing that client with a copy of the requested key.

15. The method of claim 1, wherein said request to store a particular key is communicated to the server using LDAP (Lightweight Directory Access Protocol) protocol.

16. The method of claim 1, wherein said request to store a particular key is communicated to the server using HTTP (Hypertext Transport Protocol) protocol.

17. The method of claim 1, further comprising:

allowing clients to search for keys which have been stored in the central repository.

18. The method of claim 17, wherein keys stored in the central repository may be searched by user-specified criteria selected from one or more of:

e-mail address, user name, key identifier (ID), key type, key size, key creation date, and key expiration date.

19. The method of claim 1, further comprising:

allowing a user with system administrator privileges to disable any key which is stored in the central repository.

20. The method of claim 1, further comprising:

allowing a user with system administrator privileges to manually add keys to or delete keys from the central repository.

21. The method of claim 1, wherein said particular key supports RSA-based cryptography.

22. The method of claim 1, wherein said particular key supports Diffie-Hellman-based cryptography.

23. The method of claim 1, wherein said particular key comprises a PGP-compatible key.

24. The method of claim 1, further comprising:

replicating contents of the central repository to another server.

25. The method of claim 1, further comprising:

defining access privileges for a group of users, for specifying access for those users to keys on the server.

26. The method of claim 25, wherein said access privileges include allowing users to read keys from the server.

27. The method of claim 25, wherein said access privileges include allowing users to add keys to the server.

28. The method of claim 25, wherein said access privileges include allowing users to delete keys from the server.

29. The method of claim 1, wherein said set of constraints includes a constraint specifying that the particular key must include at least one of a plurality of specified signatures.

30. The method of claim 1, wherein said set of constraints includes a constraint specifying that the particular key must include all of a plurality of specified signatures.

31. The method of claim 1, further comprising:

generating an error message for a key which has been rejected.

32. The method of claim 1, wherein said set of constraints includes a constraint specifying that a particular signature is allowed for the particular key.

33. The method of claim 32, wherein said set of constraints includes a constraint specifying that any signature which has not been specified as allowable is removed from the particular key before it is stored in the central repository.

34. The method of claim 1, wherein said client is connected to the server through a TCP/IP connection.

35. The method of claim 34, wherein said client resides at a particular IP address, and wherein said server applies said set of constraints based, at least in part, on the client'"'"'s particular IP address.

36. A method for managing availability of public cryptographic keys for use by a plurality of clients, the method comprising:

defining a set of constraints specifying one or more conditions which keys must satisfy before being made available for use by the clients;

receiving a request to make a particular key available for use by the clients;

automatically applying said set of constraints for determining whether the particular key should be made available for use by the clients; and

if the particular key satisfies said set of constraints prior to storage, making the key available to other clients.

37. The method of claim 36, further comprising:

if the particular key does not satisfy said set of constraints, rejecting the key.

38. The method of claim 37, further comprising:

displaying an error message indicating why the key has been rejected.

39. The method of claim 37, further comprising:

designating any rejected key as pending.

40. The method of claim 39, further comprising:

allowing a user with system administrator privileges to accept a key which has been designated as pending.

41. The method of claim 36, wherein said set of constraints includes a constraint specifying that the particular key must include a required signature.

42. The method of claim 41, wherein said signature comprises a cryptographic digital signature of a particular entity that has signed the particular key.

43. The method of claim 36, wherein said set of constraints includes a constraint specifying that the particular key may not include a signature which has not been approved.

44. The method of claim 43, further comprising:

removing from the particular key any signature which has not been approved.

45. The method of claim 36, wherein said set of constraints includes a constraint specifying that the particular key may not include a user identifier (ID) which has not been approved.

46. A system for managing availability of public cryptographic keys for use by a plurality of clients, the system comprising:

a configuration setting defining a policy specifying one or more conditions which keys must satisfy before being made available for use by the clients; and

an agent, responsive to a request to make a particular key available for use by the clients, for making the key available to other clients only if the particular key satisfies said policy.

47. The system of claim 46, wherein said agent rejects the particular key if the key does not satisfy said policy.

48. The system of claim 47, wherein said agent optionally returns an error message indicating why the key has been rejected.

49. The system of claim 47, wherein said agent designates any rejected key as pending.

50. The system of claim 46, wherein said policy includes a condition specifying that the particular key must include a required signature.