Method and system for the digital certificate generation and distribution

• US 6,826,685 B1
• Filed: 06/10/1998
• Issued: 11/30/2004
• Est. Priority Date: 06/10/1998
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Douglas, Daniel Graham
• Primary Examiner(s): Vu, Kim
• Assistant Examiner(s): Song, Hosuk
• Application Number:
  US09/095,230
• Publication Number:
  US 20040250062A1
• Time in Patent Office: 2,365 Days
• Field of Search: 713/168-170, 713/155-157, 713/175, 713/201
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Method and system aspects for automated generation and distribution of certificates in a computer network of computer systems are described. These aspects include generating a request by a first computer system for a certificate from a second computer system, and responding to the request in the second computer system by automatically generating the certificate and distributing the certificate to the first computer system. Further, generating a request includes issuing a POST/CERTREQ request, and sending a self-signed certificate from the first computer system to the second computer system using HTTP. Automatically generating the certificate includes sending a sequence of certificates to the first computer system, the sequence of certificates including the newly generated certificate of the first computer system with a signature from the second computer system and a self-signed certificate from the second computer system.

Claims

1. A system for automated generation and distribution of certificates within a computer network of computer systems, the system comprising:

a first computer system, the first computer system acting as an agent system, the agent system making a request for a certificate authenticating the agent system via a first registration/discovery port of the agent system; and

a second computer system, the second computer system acting as a manager system, the manager system receiving the request and automatically generating the certificate authenticating the agent system in response to the request from the agent system via a second registration/discovery port of the manager system, wherein each of the first and second registration/discovery ports identifies computer systems in the computer network such that the agent system and the manager system achieve authenticated channel communication without reliance on a certificate authority.

2. The system of claim 1 wherein the request is formed according to a hypertext transfer protocol.

3. The system of claim 2 wherein the request is in a POST request format.

4. The system of claim 1 wherein the agent system further sends a self signed certificate to the manager system when making the request.

5. The system of claim 4 wherein the manager system generates the certificate as part of a sequence of certificates.

6. The system of claim 5 wherein the sequence of certificates comprises the newly generated certificate for the agent with a manager system signature and a manager self-signed certificate.

7. The system of claim 1 wherein the agent system and the manager system perform the request and response with resources of a Java development kit.

8. A method for automated generation and distribution of certificates in a computer network of computer systems, the method comprising:

generating a request by a first computer system for a certificate authenticating the first computer system from a second computer system via a first registration/discovery port of the first computer system; and

responding to the request in the second computer system by automatically generating the certificate authenticating the first computer system and distributing the certificate to the first computer system via a second registration/discovery port of the second computer system, wherein each of the first and second registration/discovery ports identifies computer systems in the computer network such that certificate generation occurs without reliance on a certificate authority.

9. The method of claim 8 wherein generating a request further comprises issuing a POST/CERTREQ request.

10. The method of claim 8 wherein generating a request further comprises sending a self-signed certificate from the first computer system to the second computer system.

11. The method of claim 10 wherein automatically generating the certificate further comprises sending a sequence of certificates to the first computer system.

12. The method of claim 11 wherein sending a sequence of certificates further comprises the newly generated certificate of the first computer system with a signature from the second computer system and a self-signed certificate from the second computer system.

13. The method of claim 8 wherein the certificate is formed through resources of a Java development kit.

14. A computer readable medium containing program instructions for automated generation and distribution of certificates in authenticated channel communication over an insecure computer network of computer systems, the program instructions comprising:

supporting a request by a first computer system for a certificate authenticating the first computer system from a second computer system via a first registration/discovery port of the first computer system; and

providing a response to the request in the second computer system by automatically generating the certificate authenticating the first computer system and distributing the certificate to the first computer system via a second registration/discovery port of the second computer system, wherein each of the first and second registration/discovery ports identifies computer systems in the insecure computer network such that certificate generation occurs without reliance on a certificate authority.

15. The program instructions of claim 14 wherein the request further comprises issuing a POST/CERTREQ request.

16. The program instructions of claim 14 wherein the request further comprises sending a self-signed certificate from the first computer system to the second computer system.

17. The program instructions of claim 16 wherein automatically generating the certificate further comprises sending a sequence of certificates to the first computer system.

18. The program instructions of claim 17 wherein sending a sequence of certificates further comprises sending the newly generated certificate of the first computer system with a signature from the second computer system and a self-signed certificate from the second computer system.

19. The program instructions of claim 14 further being provided through resources of a Java development kit.

20. A network that allows for automated generation and distribution of certificates, the system comprising:

a plurality of computer systems, each of the computer systems including a port for making a request for a certificate authenticating the computer system and for generating a certificate authenticating another computer system in response to a request from another computer system, wherein the port identifies each of the plurality of computer systems such that authenticated channel communication can be achieved without reliance on a certificate authority.

21. A computer system which is utilized in a network which allows for automated generation and distribution of certificates, the computer system comprising:

a network device; and

a port coupled to the network device, the port for making a request for a certificate authenticating the computer system and for generating a certificate authenticating another computer system in response to a request from another computer system, wherein the port identifies each of the other computer systems on the network such that authenticated channel communication can be achieved without reliance on a certificate authority.

22. A system for automated generation and distribution of certificates within a computer network of computer systems, the system comprising:

a first computer system, the first computer system acting as an agent system, the agent system making a request for a certificate authenticating the agent system via a first registration/discovery port of the agent system; and

a second computer system, the second computer system acting as a manager system, the manager system receiving the request and automatically generating the certificate authenticating the agent system in response to the request from the agent system via a second registration/discovery port of the manager system, wherein each of the first and second registration/discovery ports identifies computer systems in the computer network such that the agent system and the manager system achieve authenticated channel communication without reliance on a certificate authority,

wherein the agent system further sends a self-signed certificate to the manager system when making the request, and the manager system generates the certificate as part of a sequence of certificates, wherein the sequence of certificates comprises the newly generated certificate for the agent with a manager system signature and a manager self-signed certificate.

23. A method for automated generation and distribution of certificates in a computer network of computer systems, the method comprising:

generating a request by a first computer system for a certificate authenticating the first computer system from a second computer system via a first registration/discovery port of the first computer system, wherein generating a request further comprises sending a self-signed certificate from the first computer system to the second computer system; and

responding to the request in the second computer system by automatically generating the certificate authenticating the first computer system and distributing the certificate to the first computer system via a second registration/discovery port of the second computer system, wherein each of the first and second registration/discovery ports identifies computer systems in the computer network such that certificate generation occurs without reliance on a certificate authority, and wherein automatically generating the certificate further comprises sending a sequence of certificates to the first computer system, wherein the sequence of certificates comprises the newly generated certificate of the first computer system with a signature from the second computer system and a self-signed certificate from the second computer system.

24. A computer readable medium containing program instructions for automated generation and distribution of certificates in authenticated channel communication over an insecure computer network of computer systems, the program instructions comprising:

supporting a request by a first computer system for a certificate authenticating the first computer system from a second computer system via a first registration/discovery port of the first computer system, wherein the request further comprises sending a self-signed certificate from the first computer system to the second computer system; and

providing a response to the request in the second computer system by automatically generating the certificate authenticating the first computer system and distributing the certificate to the first computer system via a second registration/discovery port of the second computer system, wherein each of the first and second registration/discovery ports identifies computer systems in the insecure computer network such that certificate generation occurs without reliance on a certificate authority,

wherein automatically generating the certificate further comprises sending a sequence of certificates to the first computer system, and wherein sending a sequence of certificates further comprises sending the newly generated certificate of the first computer system with a signature from the second computer system and a self-signed certificate from the second computer system.