Scalable system and method for management and notification of electronic certificate changes

• US 6,922,776 B2
• Filed: 01/30/2001
• Issued: 07/26/2005
• Est. Priority Date: 05/19/2000
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Cook, Jeffrey V., Dinsmore, Peter, Heyman, Michael
• Primary Examiner(s): Song, Hosuk
• Assistant Examiner(s): Dada, Beemnet W
• Application Number:
  US09/771,684
• Publication Number:
  US 20040215959A1
• Time in Patent Office: 1,638 Days
• Field of Search: 713156-158, 713/173, 713/175, 713/201, 709/225, 709/227
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A scalable system for notification of a change in condition of an electronic certificate is provided. The system includes a network of servers capable of providing notification of changes in conditions of electronic certificate to an unlimited number of users. The system includes a first server comprising a detection module and a notification module. The system having at least one server capable of actively monitoring and detecting changes in conditions of a certificate. Other CAP servers in the system may and/or may not actively monitor electronic certificates at the same time. That is, these CAP servers may actively monitor conditions of electronic certificates at the same time they play passive roles (e.g., not monitoring the electronic certificates for which they will be notified of changes from another CAP server). The change in condition that will trigger the notification action of the present invention includes changes to the content of the electronic certificate and/or changes of the status of the electronic certificates including, but not limited to, the revocation of, roll-over of, disablement of, expiration of the electronic certificate. An example of the type of information that the present invention may provide to users includes, but are not limited to, notice that a certificate has expired and an updated electronic certificate. Because the present invention is scalable, an unlimited number of users may be serviced. Further, the various CAP Servers may be configured to monitor specific certificates or types of changes to the certificates, while depending on another CAP Server for monitoring other certificates so as to be more efficient. In fact, one CAP Server may be configured to support notification to a number of users of one company and depend upon other servers to monitor for changes to the conditions of various electronic certificates. The present invention provides many variations in configurations of CAP server-user networks that provides notification services to an unlimited number of users

Claims

1. A system for detecting changes to conditions of electronic certificates, comprising:

a first computer system monitoring said electronic certificates to detect changes to conditions of said electronic certificates; and

a second computer system coupled to said first computer system, said second computer system being notified by said first computer system of changes in conditions of said electronic certificate;

wherein a plurality of computer systems is logically divided into a plurality of sections including a primary tier, a secondary tier, a tertiary tier, and a fourth tier;

wherein said computer systems in said primary tier are adapted for monitoring changes to conditions of said electronic certificates and notifying said computer systems in said secondary tier of said changes to conditions of said electronic certificates;

wherein said computer systems in said primary tier are adapted for contracting with said computer systems in said secondary tier for determining a type of said changes to conditions of said electronic certificates said computer systems in said secondary tier are notified of by said computer systems in said primary tier;

wherein said computer systems in said secondary tier are adapted for notifying said computer systems in said tertiary tier of said changes to conditions of said electronic certificates;

wherein said computer systems in said secondary tier are adapted for contracting with said computer systems in said tertiary tier for determining a type of said changes to conditions of said electronic certificates said computer systems in said tertiary tier are notified of by said computer systems in said secondary tier;

wherein said computer systems in said tertiary tier are adapted for monitoring changes to conditions of said electronic certificates and notifying said computer systems in said fourth tier of said changes to conditions of said electronic certificates;

wherein said computer systems in said tertiary tier are adapted for contracting with said computer systems in said fourth tier for determining a type of said changes to conditions of said electronic certificates said computer systems in said fourth tier are notified of by said computer systems in said tertiary tier;

wherein said computer systems in said secondary tier are notified of said type of said changes to conditions of said electronic certificates associated with contracts between said computer systems in said primary tier and said computer systems in said secondary tier;

said computer systems in said tertiary tier are notified of said type of said changes to conditions of said electronic certificates associated with said contracts between said computer systems in said primary tier and said computer systems in said secondary tier, and contracts between said computer systems in said secondary tier and said computer systems in said tertiary tier; and

said computer systems in said fourth tier are notified of said type of said changes to conditions of said electronic certificates associated with said contracts between said computer systems in said primary tier and said computer systems in said secondary tier, said contracts between said computer systems in said secondary tier and said computer systems in said tertiary tier, and contracts between said computer systems in said tertiary tier and said computer systems in said fourth tier;

wherein said computer systems in said primary, secondary, tertiary and fourth tiers are logically organized as a tree.

2. The system of claim 1, wherein said first computer system includes a detecting module for monitoring changes to conditions of said electronic certificates and a notifying module for notifying said second computer system.

3. The system of claim 2, wherein said first computer system further includes a processor for executing said detecting module and notifying module.

4. The system of claim 3, wherein said second computer system includes a notification module.

5. The system of claim 4, wherein said first computer system further includes a contracting module for negotiating a contract.

6. The system of claim 5, where said first computer system further includes an electronic certificate server for providing access to said electronic certificates.

7. The system of claim 5, wherein said first computer system is coupled to an electronic certificate server including said electronic certificates.

8. The system of claim 1, wherein said first computer system includes an electronic certificate server for providing access to said electronic certificates.

9. The system of claim 1, wherein said first computer system is coupled to an electronic certificate server for providing access to said electronic certificates.

10. The system of claim 1, wherein said second computer system includes a notification module.

11. The system of claim 1, wherein said second computer system is notified by said first computer system through a third computer system.

12. The system of claim 3, wherein said second computer system is notified by said first computer system through a third computer system.

13. The system of claim 4, wherein said second computer system is notified by said first computer system through a third computer system.

14. The system of claim 10, wherein said second computer system is notified by said first computer system through a third computer system.

15. The system of claim 1, wherein said first computer system is a first server and said second computer system is a second server.

16. The system of claim 1, wherein said first computer system is a first CAP server and said second computer system is a second CAP server.

17. An electronic certificates system, comprising:

logic for monitoring one or more electronic certificates to detect a change to conditions of said electronic certificates; and

logic for providing notification of said change to conditions of said electronic certificates;

wherein a plurality of computer systems is logically divided into a plurality of sections including a primary tier, a secondary tier, a tertiary tier, and a fourth tier;

wherein said computer systems in said primary tier are adapted for monitoring changes to conditions of said electronic certificates and notifying said computer systems in said secondary tier of said changes to conditions of said electronic certificates;

wherein said computer systems in said primary tier are adapted for contracting with said computer systems in said secondary tier for determining a type of said changes to conditions of said electronic certificates said computer systems in said secondary tier are notified of by said computer systems in said primary tier;

wherein said computer systems in said secondary tier are adapted for a monitoring changes to conditions of said electronic certificates and notifying said computer systems in said tertiary tier of said changes to conditions of said electronic certificates;

wherein said computer systems in said secondary tier are adapted for contracting with said computer systems in said tertiary tier for determining a type of said changes to conditions of said electronic certificates said computer systems in said tertiary tier are notified of by said computer systems in said secondary tier;

wherein said computer systems in said tertiary tier are adapted for monitoring changes to conditions of said electronic certificates and notifying said computer systems in said fourth tier of said changes to conditions of said electronic certificates;

wherein said computer systems in said tertiary tier are adapted for contracting with said computer systems in said fourth tier for determining a type of said changes to conditions of said electronic certificates said computer systems in said fourth tier are notified of by said computer systems in said tertiary tier;

wherein said computer systems in said secondary tier are notified of said type of said changes to conditions of said electronic certificates associated with contracts between said computer systems in said primary tier and said computer systems in said secondary tier, said computer systems in said tertiary tier are notified of said type of said changes to conditions of said electronic certificates associated with said contracts between said computer systems in said primary tier and said computer systems in said secondary tier, and contracts between said computer systems in said secondary tier and said computer systems in said tertiary tier; and

said computer systems in said fourth tier are notified of said type of said changes to conditions of said electronic certificates associated with said contracts between said computer systems in said primary tier and said computer systems in said secondary tier, said contracts between said computer systems in said secondary tier and said computer systems in said tertiary tier, and contracts between said computer systems in said tertiary tier and said computer systems in said fourth tier;

wherein said computer systems in said primary, secondary, tertiary and fourth tiers are logically organized as a ring.

18. A method, comprising the steps of:

detecting a change to a condition of an electronic certificate with a first computer system; and

providing notification to a second computer system of said detected change to a condition of an electronic certificate detected by said first computer system;

wherein a plurality of computer systems is logically divided into a plurality of sections including a primary tier, a secondary tier, a tertiary tier, and a fourth tier;

wherein said computer systems in said primary tier are adapted for monitoring changes to conditions of said electronic certificates and notifying said computer systems in said secondary tier of said changes to conditions of said electronic certificates;

wherein said computer systems in said primary tier are adapted for contracting with said computer systems in said secondary tier for determining a type of said changes to conditions of said electronic certificates said computer systems in said secondary tier are notified of by said computer systems in said primary tier;

wherein said computer systems in said secondary tier are adapted for notifying said computer systems in said tertiary tier of said changes to conditions of said electronic certificates;

wherein said computer systems in said secondary tier are adapted for contracting with said computer systems in said tertiary tier for determining a type of said changes to conditions of said electronic certificates said computer systems in said tertiary tier are notified of by said computer systems in said secondary tier;

wherein said computer systems in said tertiary tier are adapted for monitoring changes to conditions of said electronic certificates and notifying said computer systems in said fourth tier of said changes to conditions of said electronic certificates;

wherein said computer systems in said tertiary tier are adapted for contracting with said computer systems in said fourth tier for determining type of said changes to conditions of said electronic certificates said computer systems in said fourth tier are notified of by said computer systems in said tertiary tier;

wherein said computer systems in said secondary tier are notified of said type of said changes to conditions of said electronic certificates associated with contracts between said computer systems in said primary tier and said computer systems in said secondary tier;

said computer systems in said tertiary tier are notified of said type of said changes to conditions of said electronic certificates associated with said contracts between said computer systems in said primary tier and said computer systems in said secondary tier, and contracts between said computer systems in said secondary tier and said computer systems in said tertiary tier; and

said computer systems in said fourth tier are notified of said type of said changes to conditions of said electronic certificates associated with said contracts between said computer systems in said primary tier and said computer systems in said secondary tier, said contracts between said computer systems in said secondary tier and said computer systems in said tertiary tier, and contracts between said computer systems in said tertiary tier and said computer systems in said fourth tier;

wherein said computer systems in said primary, secondary, tertiary and fourth tiers are logically organized as a web.

19. The method of claim 18, further comprising the step of creating an agreement between said first computer system and said second computer system defining which changes in conditions should trigger a notification.

20. The method of claim 18, further comprising the step of recording said detected change in condition in said first computer system.

21. The method of claim 18, further comprising the step of determining whether said detected change of condition is of interest to said second computer system.

22. The method of claim 19, further comprising the step of determining whether said detected change of condition is of interest to said second computer system.

23. The method of claim 20, further comprising the step of determining whether said detected change of condition is of interest to said second computer system.

24. The method of claim 18, further comprising the step of determining a method of notification and a type of information to be relayed to said second computer system for said detected change to a condition of an electronic certificate.

25. The method of claim 19, further comprising the step of determining a method of notification and a type of information to be relayed to said second computer system for said detected change to a condition of an electronic certificate.

26. The method of claim 20, further comprising the step of determining a method of notification and a type of information to be relayed to said second computer system for said detected change to a condition of an electronic certificate.

27. The method of claim 23, further comprising the step of determining a method of notification and a type of information to be relayed to said second computer system for said detected change to a condition of an electronic certificate.

28. The method of claim 18, wherein said first computer system is a first server and said second computer system is a second server.

29. The method of claim 18, wherein said first computer system is a first CAP server and said second computer system is a second CAP server.