Method of aggregating multiple certificate authority services

• US 7,937,583 B2
• Filed: 06/17/2009
• Issued: 05/03/2011
• Est. Priority Date: 08/15/2003
• Status: Active Grant

• Current Assignee: Venafi,Inc.
• Original Assignee: Venafi,Inc.
• Inventors: Thornton, Russell S., Seegmiller, Jayson, Hodson, Benjamin
• Primary Examiner(s): Kim; Jung
• Assistant Examiner(s): Nobahar; Abdulhakim
• Application Number:
  US12/486,704
• Publication Number:
  US 20090319783A1
• Time in Patent Office: 685 Days
• Field of Search: 713/155, 713/156, 713/157, 713/158, 713/168, 713/175, 715741-746, 709/225, 709/229, 726 2- 6, 726 26- 29
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

The disclosure relates to the management of PKI digital certificates, including certificate discovery, installation, verification and replacement for endpoints over an insecure network. A database of certificates may be maintained through discovery, replacement and other activities. Certificate discovery identifies certificates and associated information including network locations, methods of access, applications of use and non-use, and may produce logs and reports. Automated requests to certificate authorities for new certificates, renewals or certificate signing requests may precede the installation of issued certificates to servers using installation scripts directed to a particular application or product, which may provide notification or require approval or intervention. An administrator may be notified of expiring certificates, using a database or scanning or server agents. Detailed information on various example embodiments of the inventions are provided in the Detailed Description below, and the inventions are defined by the appended claims.

Claims

1. A method for providing a unified certificate request interface to a plurality of certificate authorities, said method comprising the steps of:

presenting a uniform interface for receiving information pertaining to the submission of an individual certificate signing request to the plurality of certificate authorities, said interface providing a uniform set of entries for information items required in a certificate signing request generally;

presenting a selectable object whereby a choice of one of the plurality of certificate authorities may be entered;

receiving entry items through the uniform interface and a selection of a certificate authority;

storing items of identification sufficient to identify a requesting entity to each of the plurality of certificate authorities; and

communicating with a certificate authority interface of the selected certificate authority, the communicating presenting at least the received entry items required by the selected certificate authority, the communication in its totality presenting a certificate signing request to the selected certificate authority, the communication further presenting items of identification whereby a requesting entity may be associated to the certificate signing request.

2. A method according to claim 1, further comprising the steps of:

providing for the setting of a default certificate authority of the plurality of certificate authorities; and

in presenting a selectable object, providing a selection of the default certificate authority setting.

3. A method according to claim 1, further comprising the step of executing a script from a stored set of scripts whereby a selected certificate authority of a plurality of certificate authorities may be communicated with to present a certificate signing request.

4. A method according to claim 1, further comprising the step of reading a certificate authority records containing at least one default setting usable in presenting a certificate signing request to the selected certificate authority of the plurality of certificate authorities.

5. A method according to claim 1, wherein the uniform interface presented has an interaction substantially similar to the interaction of a true certificate authority.

6. A method for providing a unified certificate request interface to a plurality of certificate authorities, said method comprising the steps of:

providing for the setting of a default certificate authority of the plurality of certificate authorities;

presenting a uniform interface for receiving information pertaining to the submission of an individual certificate signing request to the plurality of certificate authorities, said interface providing a uniform set of entries for information items required in a certificate signing request generally;

presenting a selectable object whereby a choice of one of the plurality of certificate authorities may be entered, whereby the selectable object is presented with the default certificate authority selected;

reading at least one of a set of certificate authority records, each of the certificate authority records containing at least one default setting usable in presenting a certificate signing request to one of the certificate authorities of the plurality of certificate authorities;

receiving entry items through the uniform interface and a selection of a certificate authority;

storing items of identification sufficient to identify a requesting entity to each of the plurality of certificate authorities; and

communicating with a certificate authority interface of the selected certificate authority, the communicating presenting at least the received entry items required by the selected certificate authority, the communication in its totality presenting a certificate signing request to the selected certificate authority, the communication further presenting items of identification whereby a requesting entity may be associated to the certificate signing request.

7. A method according to claim 6, further comprising the step of executing a script from a stored set of scripts whereby a selected certificate authority of a plurality of certificate authorities may be communicated with to present a certificate signing request.

8. A method according to claim 6, wherein the uniform interface presented has an interaction substantially similar to the interaction of a true certificate authority.