System and method for enabling bulk retrieval of certificates

• US 7,430,663 B2
• Filed: 08/09/2004
• Issued: 09/30/2008
• Est. Priority Date: 08/09/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil P., Brown, Michael S., Little, Herbert A., Tapuska, David F.
• Primary Examiner(s): NGUYEN, MINH DIEU T
• Application Number:
  US10/913,693
• Publication Number:
  US 20060036848A1
• Time in Patent Office: 1,513 Days
• Field of Search: 713/156, 726/3, 707/3, 455/410, 709201-203
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0433 Key management protocols
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching

Abstract

A system and method for searching and retrieving certificates, which may be used in the processing of encoded messages. In one embodiment, a certificate synchronization application is programmed to perform certificate searches by querying one or more certificate servers for all of the certificates on those certificate servers. If all of the certificates on a certificate server cannot be successfully retrieved using a single search query, due to a search quota on the certificate server being exceeded for example, the search is re-performed through multiple queries, each corresponding to a narrower subsearch. The invention enables large amounts of certificates to be automatically searched for and retrieved from certificate servers, thereby minimizing the need for users to manually search for individual certificates.

Claims

1. A method for searching and retrieving certificates comprising:

a) performing a search on each of one or more certificate servers for a respective plurality of certificates, wherein at least one query is submitted to the certificate server to request retrieval of the respective plurality of certificates;

b) for each certificate server that returns all of the respective plurality of certificates as a result of the search performed thereon, downloading the respective plurality of certificates to a computing device;

c) for each certificate server that does not return all of the respective plurality of certificates as a result of the search performed thereon, performing a plurality of substeps comprising

i) dividing the respective search into a plurality of subsearches,

ii) performing the subsearches recursively, wherein at least one query is submitted to the respective certificate server for each subsearch, wherein the respective certificate server returns at least a subset of the respective plurality of certificates as a collective result of the subsearches of the respective search, and

iii) downloading the at least a subset of the respective plurality of certificates to the computing device; and

d) storing at least a subset of certificates downloaded to the computing device in one or more certificate stores comprising a certificate store on a mobile device, wherein the at least a subset of certificate is transmitted from the computing device to the mobile device.

2. The method of claim 1, wherein said method is performed by a certificate synchronization application executing and residing on the computing device upon initiation of the search at the computing device.

3. The method of claim 1, wherein the plurality of substeps is performed for each certificate server that does not return all of the respective plurality of certificates due to a search quota on the certificate server being exceeded.

4. The method of claim 1, further comprising storing at least a subset of certificate downloaded to the computing device in a certificate store on the computing device.

5. The method of claim 1, further comprising:

generating a list of certificates identifying one or more certificates downloaded to the computing device;

displaying the list of certificates identifying one or more certificates downloaded to the computing device;

and receiving user selections of selected certificates identified in the list;

wherein the at least a subset of certificates stored in the one or more certificate stores comprises the selected certificates.

6. The method of claim 1, further comprising:

filtering out duplicate downloaded certificates prior to storing the at least a subset of certificates in the one or more certificate stores.

7. The method of claim 1, wherein the one or more certificate servers comprises one or more Lightweight Directory Access Protocol servers.

8. The method of claim 1, wherein the dividing substep comprises dividing the respective search into subsearches, each subsearch for searching certificates issued to names beginning with one of a plurality of prefixes.

9. The method of claim 8, wherein each of the plurality of prefixes includes only alphabetic characters.

10. The method of claim 8, wherein each subsearch of the respective search corresponds to a letter of the alphabet.

11. A software application for execution on a computing device, the application comprising a plurality of instructions stored on a computer-readable medium, the instructions for a method of searching and retrieving certificates, the method comprising:

a) performing a search on each of one or more certificate servers for a respective plurality of certificates, wherein at least one query is submitted to the certificate server to request retrieval of the respective plurality of certificates;

b) for each certificate server that returns all of the respective plurality of certificates as a result of the search performed thereon, downloading the respective plurality of certificates to the computing device;

c) for each certificate server that does not return all of the respective plurality of certificates as a result of the search performed thereon, performing a plurality of substeps comprising

i) dividing the respective search into a plurality of subsearches,

ii) performing the subsearches recursively, wherein at least one query is submitted to the certificate server for each subsearch, wherein the certificate server returns at least a subset of the respective plurality of certificates as a collective result of the subsearches of the respective search, and

iii) downloading the at least a subset of the respective plurality of certificates to the computing device; and

d) storing at least a subset of certificates downloaded to the computing device in one or more certificate stores comprising a certificate store on a mobile device, wherein the at least a subset of certificates is transmitted from the computing device to the mobile device.

12. A system for searching and retrieving certificates comprising at least one computing device, wherein a certificate synchronization application executes and resides on a computing device of the at least one computing device, the certificate synchronization application programmed to:

a) perform a search on each of one or more certificate servers for a respective plurality of certificates, wherein at least one query is submitted to the certificate server to request retrieval of the respective plurality of certificates;

b) for each certificate server that returns all of the respective plurality of certificates as a result of the search performed thereon, download the respective plurality of certificates to the computing device of the at least one computing device;

c) for each certificate server that does not return all of the respective plurality of certificates as a result of the search performed thereon, perform a plurality of substeps comprising

i) dividing the respective search into a plurality of subsearches,

ii) performing the subsearches recursively, wherein at least one query is submitted to the certificate server for each subsearch, wherein the certificate server returns at least a subset of the respective plurality of certificates as a collective result of the subsearches of the respective search, and

iii) downloading the at least a subset of the respective plurality of certificates to a computing device of the at least one computing device; and

d) store at least a subset of the downloaded certificates in one or more certificate stores comprising a certificate store on a mobile device, wherein the at least a subset of certificates is transmitted from the computing device to the mobile device.

13. The system of claim 12, wherein the plurality of substeps is performed for each certificate server that does not return all of the respective plurality of certificates due to a search quota on the certificate server being exceeded.

14. The system of claim 12, wherein the at least a subset of downloaded certificates is stored in a certificate store on the computing device.

15. The system of claim 12, wherein the certificate synchronization application is further programmed to:

generate a list of certificates identifying one or more certificates downloaded to the computing device;

display the list of certificates identifying one or more certificates downloaded to the computing device; and

receive user selections of selected certificates identified in the list;

wherein the at least a subset of certificates stored in the one or more certificate stores comprises the selected certificates.

16. The system of claim 12, wherein the certificate synchronization application is further programmed to:

filtering out duplicate downloaded certificates prior to storing the at least a subset of certificates in the one or more certificate stores.

17. The system of claim 12, wherein the one or more certificate servers comprises one or more Lightweight Directory Access Protocol servers.

18. The system of claim 12, wherein the dividing substep comprises dividing the respective search into subsearches, each subsearch for searching certificates issued to names beginning with one of a plurality of prefixes.

19. The system of claim 17, wherein each of the plurality of prefixes includes only alphabetic characters.

20. The system of claim 17, wherein each subsearch of the respective search corresponds to a letter of the alphabet.