Key ring organizer for an electronic business using public key infrastructure

• US 6,539,093 B1
• Filed: 12/31/1998
• Issued: 03/25/2003
• Est. Priority Date: 12/31/1998
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Brown, Michael A., Gupta, Adarsh, Kohli, Manjit Singh, Sebastian, J. Matthew, Asad, Khalid
• Primary Examiner(s): Darrow, Justin T.
• Application Number:
  US09/223,803
• Time in Patent Office: 1,545 Days
• Field of Search: 380/279, 380/280, 713/152, 713/153, 713/156, 713/159, 713/168, 713/175, 713/176, 713/201, 705/67, 705/71
• US Class Current: 380/279
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Users and security aware applications are able to request operations on and manipulate role based digital certificates (and their corresponding private keys) distributed among multiple key rings through the use of a Key Ring Organizer (KRO). In a typical use of the KRO, the computer network is coupled to a secure server and at least one end-user terminal; a Registration Authority; and an organization server hosting secure applications. The end-user terminal includes a general purpose Web browser with a KRO plug-in module and a KRO managing a set of key rings, where each key ring may contain multiple keys. The KRO components include the KRO, a set of KRO catalogs (typically one), a built-in key ring, and multiple external key rings. A key ring can be of any type, including a smart card, key disk, or remote file. A catalog (typically a file) contains a set of entries in which each entry contains a set of attributes and a reference to a key record stored in a key ring. Public key data is stored in a catalog during key generation and later verified against the certificate to be stored in a key ring in order to maintain the integrity of the association between references in a catalog and the key pairs to which they refer. A built-in key ring is contained within each catalog and is managed by end-users like any other key ring; however, outside the KRO environment, a built-in key ring is not accessed independently from the catalog which contains it. This mechanism greatly increases mobility. In a typical client-server session the KRO is accessed by a secure server application using Key Ring Organizer Language (KROL) messages sent to the KRO plug-in over a secure protocol (e.g., SSL) to generate, store and select role based keys for use in signing documents or authenticating end-users. The KRO provides a mechanism whereby signature requests are always authorized by the owner of the signing private key. The KRO also allows digital key parameters to be configured by the end-user so that authentication request must be authorized by the user as well.

Claims

1. A computer network including a secure server and at least one end-user terminal for managing and storing keys for use in signing information or authenticating end-users for secure client/server applications, comprising:

a) at least one end-user terminal including a general purpose Web browser;

a key ring; and

a Key Ring Organizer (KRO) as a server responsive to web applications;

b) crypto keys used for signing and authentication of messages between the end-user terminal and the secure server;

c) KRO means for storing and managing the keys in the key ring by key reference, client and server attributes; and

d) catalog means coupled to the KRO for organizing the digital keys and key ring information enabling applications and end-users to select and identify a specific key for a particular use.

2. The computer network of claim 1 further comprising means for describing each key in the KRO with a reference number and a plurality of attributes.

3. The computer network of claim 1 further comprising means in the browser for interfacing the secure server and the KRO.

4. The computer network of claim 1 further comprising

KRO means for generating role-based public/private pair key pairs for storage in the catalog.

5. The computer network of claim 1 further comprising

KRO means for storing role-based private keys and certificates in key rings.

6. The computer network of claim 1 further comprising:

KRO means for locating a certificate in a catalog in response to a web or end user application request for authentication.

7. The computer network of claim 1 further comprising KRO means for locating a certificate in the catalog for signing a document.

8. The computer network of claim 1 further comprising KRO means for certifying public keys for third party servers.

9. The computer network of claim 1 further comprising a Smart Card coupled to the end-user terminal for key mobility.

10. The computer network of claim 1 further comprising a KROL language for communications between the end-user terminal and the secure server in conducting KRO operations.

11. In a computer network including a secure server and at least one end-user terminal for managing and storing keys for use in signing or authenticating end-users for secure client/server applications, a method for operating a Key Ring Organizer (KRO), comprising the steps of:

a) sending a request from a secure server application in the form of a KROL language message to the end-user'"'"'s Web browser for the exchange of data with the secure server application running in the secure server;

b) recognizing a KROL Multipurpose Internet Mail Extension (MIME) type which allows the interchange of data between the KRO and the web-based application;

c) initiating a KRO Plug-in and launching the KRO, if not already running;

d) passing the KROL message to the KRO; and

e) acting on the KROL message the KRO performs the requested key operations and sends a response to Plug-in for the Web-based application whereupon the interaction between the KRO and the Web application ends.

12. In a computer network including a secure server and at least one end-user terminal for managing and storing keys for use in signing or authenticating end-users for secure client/server applications, a method for operating a Key Ring Organizer (KRO), comprising the steps of:

a) sending a request in the form of a KROL language message to the end-user'"'"'s Web browser for the exchange of data with an application running in the secure server;

b) recognizing a KROL Multipurpose Internet Mail Extension (MIME) type which allows the interchange of data between the KRO and the web-based application;

c) initiating a KRO Plug-in and launching the KRO, if not already running;

d) passing the KROL message to the KRO;

e) acting on the KROL message the KRO performs the requested key operations and sends a response to Plug-in for the Web-based application whereupon the interaction between the KRO and the Web application ends;

f) initiating a GENKEY request in which the server initiates the command GENKEY as a KROL tag and transmits the request to the browser using SSLv2 or v3;

g) receiving the KROL tag by a KRO plug-in and forwarding the request to the KRO;

h) generating a public-private key pair and storing the pairs in a catalog and marking a record PENDING;

i) sending the public key to the KRO Plug-in using the tag KRO-PUBLIC-KEY=KEY; and

j) forwarding the tag KRO-PUBLIC-KEY=KEY to the application.

13. In a computer network including a secure server and at least one end-user terminal for managing and storing keys for use in signing or authenticating end-users for secure client/server applications, a method for operating a Key Ring Organizer (KRO), comprising the steps of:

a) sending a request in the form of a KROL language message to the end-user'"'"'s Web browser for the exchange of data with an application running in the secure server;

b) recognizing a KROL Multipurpose Internet Mail Extension (MIME) type which allows the interchange of data between the KRO and the web-based application;

c) initiating a KRO Plug-in and launching the KRO, if not already running;

d) passing the KROL message to the KRO;

e) acting on the KROL message the KRO performs the requested key operations and sends a response to Plug-in for the Web-based application whereupon the interaction between the KRO and the Web application ends;

f) generating the KROL tags <

STORE KEY>

<

X509 CERT>

Certificate followed by optional tags for server <

SERVER ATTRIBUTE> and

users <

USER ATTRIBUTE>

as key value pairs, as follows;

Server Attribute KEY=VALUE;

User Attribute KEY=VALUE;

g) transmitting the KROL request from the server to the browser using SSLv2 or v3;

h) receiving the STORE KEY request by a KRO Plug-in in a browser and forwarding to a KRO;

i) matching the public key in the certificate with the public key in a catalog and matching and verifying the public key in the key ring with the private key in the key ring;

j) storing the certificate in the Key Ring containing the private key corresponding to the public key in the certificate;

k) caching some of the certificate attributes in the catalog and marking a record COMPLETE;

l) forwarding the tag <

STOREKEY_RESPONSE=SUCCESS or CANCEL>

to the KRO Plug-in in the browser; and

m) forwarding the tag <

KRO_STOREKEY_RESPONSE=SUCCESS or CANCEL>

to the application.

14. In a computer network including a secure server and at least one end-user terminal for managing and storing keys for use in signing or authenticating end-users for secure client/server applications, a method for operating a Key Ring Organizer (KRO), comprising the steps of:

a) sending a request from a secure server application in the form. of a KROL language message to the end-user'"'"'s Web browser for the exchange of data with the secure server application running in the secure server;

b) recognizing a KROL Multipurpose Internet Mail Extension (MIME) type which allows the interchange of data between the KRO and the web-based application;

c) initiating a KRO Plug-in and launching the KRO, if not already running;

d) passing the KROL message to the KRO;

e) acting on the KROL message the KRO performs the requested key operations and sends a response to Plug-in for the Web-based application whereupon the interaction between the KRO and the Web application ends;

f) initiating a request to the KRO for client authentication using the KROL tag <

SELECT AND AUTHENTICATE>

, the request containing certificate and/or server attributes for locating the authentication certificate;

g) receiving the KROL request by a Plug-in and forwarding to the KRO, the request also including a challenge string in the form of a random string or nonce;

h) using selection criteria or attributes specified in the request to locate the certificate in a catalog;

i) determining if there is an exact match in which case no interaction occurs with the end-user is required;

otherwise, if there is no match or more than one match, prompting the end-user to select a certificate;

j) using the private key corresponding to the selected certificate to encrypt the challenge string;

k) sending the selected certificate and encrypted challenge string back to the Plug-in which forwards the certificate and challenge to the application;

l) checking the validity of the certificate and if valid extracting the public key to verify that the decrypted nonce matches the original nonce sent in step b; and

m) determining if there is a match in which case the end-user authentication is successful.

15. In a computer network including a secure server and at least one end-user terminal for managing and storing keys for use in signing or authenticating end-users for secure client/server applications, a method for operating a Key Ring Organizer (KRO), comprising the steps of:

a) sending a request from a secure server application in the form of a KROL language message to the end-user'"'"'s Web browser for the exchange of data with the secure server application running in the secure server;

b) recognizing a KROL Multipurpose Internet Mail Extension (MIME) type which allows the interchange of data between the KRO and the web-based application;

c) initiating a KRO Plug-in and launching the KRO, if not already running;

d) passing the KROL message to the KRO;

e) acting on the KROL message the KRO performs the requested key operations and sends a response to Plug-in for the Web-based application whereupon the interaction between the KRO and the Web application ends;

f) submitting a signature request to the KRO using the KROL tag <

SELECT AND SIGN>

, the request containing certificate and/or server attributes to locate a specific certificate;

g) receiving the KROL request by the Plug-in and forwarding to the KRO, the request message also including the document to be signed and the document type;

h) using the selection criteria specified in the message to locate the certificate in the catalog;

i) determining if there is an exact message then no interaction with end-user is needed;

otherwise, the end-user is prompted to select a certificate if there is no match or more than one match;

j) displaying a document to the end-user and prompting the end-user for a password before signing which unlocks the private key used for signing the document; and

k) using the private key corresponding to the selected certificate to sign the document;

l) returning the certificate, document and signature to the Plug-in which returns the certificate, document and signature to the application.

16. In a computer network including a secure server and at least one end-user terminal for managing and storing keys for use in signing or authenticating end-users for secure client/server applications, a method for operating a Key Ring Organizer (KRO), comprising the steps of:

a) Sending a request from a secure server application in the form of a KROL language message to the end-user'"'"'s Web browser for the exchange of data with the secure server application running in the secure server;

b) recognizing a KROL Multipurpose Internet Mail Extension (MIME) type which allows the interchange of data between the KRO and the web-based application;

c) initiating a KRO Plug-in and launching the KRO, if not already running;

d) passing the KROL message to the KRO;

e) acting on the KROL message the KRO performs the requested key operations and sends a response to Plug-in for the Web-based application whereupon the interaction between the KRO and the Web application ends;

f) invoking a server certificate request by the application through a KROL tag <

SERVER CERT REQUEST>

which is sent to a Plug-in;

g) receiving the request message by a Plug-in and forwarding the message to the KRO;

h) displaying a file dialog window to an administrator for selecting the server certificate request file for processing;

d) after selection of the file, sending the certificate request to the Plug-in which transmits the certificate request to a Registration Authority for approval and certification by a Certification Authority;

i) after Registration Authority approval of the request, creating a server certificate;

j) sending another KROL message with the tag <

SERVER CERT> and

includes the server certificate;

k) receiving server certificate by the Plug-in and forwarding to the KRO;

l) displaying another dialog for the administrator and prompting the administrator to choose the file for storing the server certificate; and

m) wrapping the server certificate in an appropriate format for the specified server and writing it out to the selected certificate.