Document management system with public key infrastructure

• US 8,166,525 B2
• Filed: 09/08/2005
• Issued: 04/24/2012
• Est. Priority Date: 09/08/2005
• Status: Expired due to Fees

• Current Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Original Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Inventors: Gaucas, Dale Ellen, Austin, Paul Ronald
• Primary Examiner(s): BROWN, CHRISTOPHER J
• Application Number:
  US11/221,529
• Publication Number:
  US 20070055882A1
• Time in Patent Office: 2,420 Days
• Field of Search: 726/5, 726/6, 726/10, 713/156
• US Class Current: 726/5
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Apparatus are provided, including a document management system and a private certificate authority. The private certificate authority is private to the document management system, and includes a certificate authority public key, a certificate authority private key, a key pair generator, and a digital certificate issuer. The key pair generator generates key pairs for respective authorized users of the document management system. The digital certificate issuer issues digital certificates regarding the respective authorized users of the document management system. The private certificate authority includes software instantiated by or with the document management system.

Claims

1. Apparatus comprising:

a processor;

computer-readable media;

a document management system including a private certificate authority installation trigger configured to cause the installation of a private certificate authority upon the occurrence of a certain event;

the private certificate authority private to the document management system, the private certificate authority including a certificate authority public key, a certificate authority private key, a key pair generator to generate key pairs for respective authorized users of the document management system, a digital certificate issuer to issue digital certificates regarding the respective authorized users of the of the document management system, and a certificate revocation mechanism to support a certificate revocation list; and

the private certificate authority including software, the software being installed at the behest of the document management system, the software being installed at the behest of the document management system upon the certain event which is a user selecting a private certificate authority option while interfacing with the document management system.

2. The apparatus according to claim 1, wherein the private certificate authority is within a firewall of the document management system.

3. The apparatus according to claim 1, wherein the private certificate authority includes a security interface compatible with a security interface of the document management system.

4. The apparatus according to claim 3, wherein the security interface of the private certificate authority and of the document management system include a secure Internet mail interface.

5. The apparatus according to claim 4, wherein the secure internet mail interface includes an S/MIME internet mail interface.

6. The apparatus according to claim 1, wherein the private certificate authority includes software installed subsequent to an installation of the document management system.

7. The apparatus according to claim 6, wherein the document management system further includes an option that can be selected by a user to provide a private certificate authority for public key infrastructure capabilities of the document management system.

8. The apparatus according to claim 1, further comprising a document management system account creation portion of the document management system, the document management system account creation portion including a user information input, an account creator, and an account denying mechanism, the user information input receiving user-specific information from a prospective document management system account holder.

9. The apparatus according to claim 8, wherein the user-specific information includes a name, a user name, a password, and an email address.

10. The apparatus according to claim 8, further comprising a private certificate authority communication mechanism to send at least portions of the user-specific information to the private certificate authority, the private certificate authority incorporating the sent user-specific information into the issuance of the digital certificate for a given document management system account holder and the generation of a key pair for the given document management system account holder.

11. The apparatus according to 10, wherein an alias associated with the key pair for the given document management system account holder is based on the user-specific information of the given document management account holder.

12. The apparatus according to claim 10, wherein a given authorized user digital certificate issued by the private certificate authority includes a digital certificate password for access to the digital certificate, the digital certificate password being the same as a password of the given document management system account holder.

13. The apparatus according to claim 7, further comprising a private certificate authority facilitator, responsive to the creation of a document management system account for a document management system user, to allow or request a private certificate authority to generate a document management system user key pair and to issue a document management system user digital certificate.

14. Apparatus comprising:

a document management system;

a processor;

computer-readable media;

a private certificate authority private to the document management system, the private certificate authority including a certificate authority public key, certificate authority private key, a key pair generator to generate key pairs for respective authorized users of the document management system, a digital certificate issuer to issue digital certificates regarding the respective authorized users of the document management system, and a certificate revocation mechanism to support a certificate revocation list;

the private certificate authority including software installed by or with the document management system as part of the installation of the document management system;

wherein the private certificate authority includes software installed subsequent to an installation of the document management system;

wherein the document management system further includes an option that can be selected by a user to provide a private certificate authority for a public key infrastructure capabilities of the document management system;

the apparatus further comprising a private certificate authority facilitator, responsive to the creation of a document management system account for a document management system user, to allow or request a private certificate authority to generate a document management system user key pair and to issue a document management system user digital certificate; and

wherein the private certificate authority facilitator includes a mechanism to automatically cause a private certificate authority to generate a document management system user key pair and to issue a document management system digital certificate when the document management system account is created for the given document management system user.

15. A method comprising:

providing a processor and computer-readable media;

managing storage, naming, and access to documents through a document management system installed on a given computer platform, the document management system including a private certificate authority installation trigger configured to cause the installation of a private certificate authority upon the occurrence of a certain event; and

providing the private certificate authority private to the document management system, the private certificate authority including a certificate authority public key and a certificate authority private key, generating key pairs for respective authorized users of the document management system, and issuing digital certificates regarding the respective authorized users of the document management system;

the private certificate authority including software, the software being installed at the behest of the document management system, the software being installed at the behest of the document management system upon the certain event which is a user selecting a private certificate authority option while interfacing with the document management system; and

using the document management system storage, access control, and download mechanisms to maintain and issue keys and certificates.

16. The method according to claim 15, further comprising providing a document management system account creation portion of the document management system, and providing a user information input to receive user-specific information from a prospective document management system account holder.

17. The method according to claim 16, further comprising providing a private certificate authority communication mechanism to send at least portions of the user-specific information for a given document management system account holder to the private certificate authority, the private certificate authority incorporating the sent user-specific information into the issuance of a digital certificate and into the generation of a key pair for the given document management system account holder.

18. Non-transitory computer-readable media encoded with data, the data being interoperable with a machine to cause:

managing storage, naming, and access to documents through a document management system installed on a given computer platform, the document management system including a private certificate authority installation trigger configured to cause the installation of a private certificate authority upon the occurrence of a certain event; and

providing a private certificate authority private to the document management system, the private certificate authority including a certificate authority public key and certificate authority private key, generating key pairs for respective authorized users of the document management system, and issuing digital certificates regarding the respective authorized users of the document management system;

the private certificate authority including software, the software being installed at the behest of the document management system, the software being installed at the behest of the document management system upon the certain event which is a user selecting a private certificate authority option while interfacing with the document management system; and

using the document management system storage, access control, and download mechanisms to maintain and issue keys and certificates.

19. The non-transitory computer-readable media according to claim 18, further encoded with data to cause providing a private certificate authority communication mechanism to send at least portions of user-specific information for a given document management system account holder to the private certificate authority, the private certificate authority incorporating the sent user-specific information into the issuance of a digital certificate and into the generation of a key pair for the given document management system account holder.