System and method for validating certificate issuance notification messages

• US 8,255,685 B2
• Filed: 03/17/2009
• Issued: 08/28/2012
• Est. Priority Date: 03/17/2009
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: Truskovsky, Alexander, Tu, Van Quy, Mok, Cheryl, Gandhi, Shivangi, Jackson, Eli, Adams, Neil Patrick
• Primary Examiner(s): Chea, Philip
• Assistant Examiner(s): David, Dorianne Alvarado
• Application Number:
  US12/405,366
• Publication Number:
  US 20100241851A1
• Time in Patent Office: 1,260 Days
• Field of Search: 713155-157, 709/227, 709/238, 726/10
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/106 Packet or message integrity

Abstract

To validate a received certificate issuance notification message, a device may verify that the certificate issuance notification message conforms to expected norms or authenticate a signature associate with the certificate issuance notification message. Upon validating, the device may then transmit a uniform resource locator, extracted from the certificate issuance notification message, to a network entity configured for processing certificate issuance.

Claims

1. A method, for being performed by a mail server having a receiver, a processor and a transmitter, of validating a certificate issuance notification message, said method comprising:

receiving, at said receiver, a message;

determining, at said processor, that said message comprises a certificate issuance notification message;

extracting a plurality of uniform resource locators from said certificate issuance notification message;

determining that a quantity of said plurality of said extracted uniform resource locators is less than a maximum expected count of uniform resource locators, thereby verifying, at said processor, that said certificate issuance notification message conforms to expected norms specific to certificate issuance notification messages; and

responsive to said verifying, transmitting, at said transmitter, a selected uniform resource locator, from among said plurality of uniform resource locators extracted from said certificate issuance notification message, to a network entity configured for processing certificate issuance.

2. The method of claim 1 wherein said determining that said message comprises a certificate issuance notification message comprises determining that a sender of said message is a certificate authority.

3. The method of claim 1 wherein said verifying that said certificate issuance notification message conforms to expected norms specific to certificate issuance notification messages comprises determining that a size of said message is less than a predetermined maximum message size.

4. The method of claim 1 further comprising:

receiving an instruction from said network entity; and

responsive to said instruction, activating certificate issuance notification message handling.

5. A mail server comprising:

a receiver adapted to receive a message;

a processor adapted to;

determine that said message comprises a certificate issuance notification message;

extract a plurality of uniform resource locators from said certificate issuance notification message;

determine that a quantity of said plurality of said extracted uniform resource locators is less than a maximum expected count of uniform resource locators, to thereby verify that said certificate issuance notification message conforms to expected norms specific to certificate issuance notification messages; and

a transmitter adapted to transmit a selected uniform resource locator, from among said plurality of uniform resource locators, to a network entity configured for processing certificate issuance.

6. A non-transitory computer-readable medium containing computer-executable instructions that, when performed by a processor in a mail server, cause said processor to:

receive a message;

determine that said message comprises a certificate issuance notification message;

extract a plurality of uniform resource locators from said certificate issuance notification message;

determine that a quantity of said plurality of said extracted uniform resource locators is less than a maximum expected count of uniform resource locators, to thereby verify that said certificate issuance notification message conforms to expected norms specific to certificate issuance notification messages;

transmit a selected uniform resource locator, from among said plurality of uniform resource locators, to a network entity configured for processing certificate issuance.

7. A method, for being performed by a mail server having a receiver, a processor and a transmitter, of validating a certificate issuance notification message, said method comprising:

receiving, at said receiver, a message;

determining, at said processor, that said message comprises a certificate issuance notification message;

determining, at said processor, that said message is associated with a signature;

authenticating, at said processor, said signature;

responsive to said authenticating, extracting, at said processor, a uniform resource locator from said certificate issuance notification message;

confirming that a prefix of said uniform resource locator matches a prefix associated with one of a set of certificate authorities from which identity certificates are retrieved; and

transmitting, at said transmitter, said uniform resource locator to a network entity configured for processing certificate issuance.

8. The method of claim 7 wherein said determining that said message comprises a certificate issuance notification message comprises determining that a sender of said message is a certificate authority.

9. A mail server comprising:

a receiver adapted to receive a message;

a processor adapted to;

determine that said message comprises a certificate issuance notification message;

determine that said message is associated with a signature;

authenticate said signature; and

extract a uniform resource locator from said certificate issuance notification message;

confirm that a prefix of said uniform resource locator matches a prefix associated with one of a set of certificate authorities from which identity certificates are retrieved; and

a transmitter adapted to transmit said uniform resource locator to a network entity configured for processing certificate issuance.

10. A non-transitory computer-readable medium containing computer-executable instructions that, when performed by a processor in a mail server, cause said processor to:

receive a message;

determine that said message comprises a certificate issuance notification message;

determine that said message is associated with a signature;

authenticate said signature;

extract a uniform resource locator from said certificate issuance notification message;

confirm that a prefix of said uniform resource locator matches a prefix associated with one of a set of certificate authorities from which identity certificates are retrieved; and

transmit said uniform resource locator to a network entity configured for processing certificate issuance.