Pushing certificate chains to remote devices

• US 8,341,709 B2
• Filed: 03/25/2009
• Issued: 12/25/2012
• Est. Priority Date: 10/22/2008
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: Mok, Cheryl, Tu, Van Quy
• Primary Examiner(s): Chea, Philip
• Assistant Examiner(s): ALVARADO DAVID, DORIANNE
• Application Number:
  US12/410,597
• Publication Number:
  US 20100100731A1
• Time in Patent Office: 1,371 Days
• Field of Search: None
• US Class Current: 726/6
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/106 Packet or message integrity

Abstract

Rather than managing a certificate chain related to a newly issued identity certificate at a terminal to which a wireless device occasionally connects, a certificate server can act to determine the identity certificates in a certificate chain related to the newly issued identity certificate. The certificate server can also act to obtain the identity certificates and transmit the identity certificates towards the device that requested the newly issued identity certificate. A mail server may receive the newly issued identity certificate and the identity certificates in the certificate chain and manage the timing of the transmittal of the identity certificates. By transmitting the identity certificates in the certificate chain before transmitting the newly issued identity certificate, the mail server allows the user device to verify the authenticity of the newly issued identity certificate.

Claims

1. A method of handling a newly issued identity certificate, said method comprising:

receiving, at a certificate server, said newly issued identity certificate for use by a user device, said newly issued identity certificate generated by a certificate authority;

responsive to said receiving, determining, at said certificate server, a certificate chain related to said newly issued identity certificate, said certificate chain including an identity certificate associated with said certificate authority;

responsive to said determining, obtaining, at said certificate server, each identity certificate in said certificate chain;

responsive to said obtaining, transmitting, from said certificate server, each said identity certificate to a database, where said database is external to said user device; and

transmitting, at said certificate server, said newly issued identity certificate to said database.

2. The method of claim 1, wherein said database is monitored by an email server associated with said user device.

3. The method of claim 1 wherein said database is associated with a server of said user device.

4. The method of claim 1 further comprising, responsive to said obtaining, storing, in local storage, each said identity certificate.

5. The method of claim 4 wherein said obtaining comprises retrieving at least one of said identity certificates from said local storage.

6. A certificate server comprising:

a processor and a memory device configured to;

receive a newly issued identity certificate for use by a user device, said newly issued identity certificate generated by a certificate authority;

responsive to said receiving, determine a certificate chain related to said newly issued identity certificate, said certificate chain including an identity certificate associated with said certificate authority;

responsive to said determining, obtain each identity certificate in said certificate chain;

responsive to said obtaining, transmit each said identity certificate to a database; and

transmit said newly issued identity certificate to said database, wherein said database is external to said user device.

7. A non-transitory computer readable medium containing computer-executable instructions that, when performed by a processor, cause said processor to:

receive a newly issued identity certificate for use by a user device, said newly issued identity certificate generated by a certificate authority;

responsive to said receiving, determine a certificate chain related to said newly issued identity certificate, said certificate chain including an identity certificate associated with said certificate authority;

responsive to said determining, obtain each identity certificate in said certificate chain;

responsive to said obtaining, transmit each said identity certificate to a database;

and transmit said newly issued identity certificate to said database, wherein said database is external to said user device.

8. A method of handling a newly issued identity certificate on behalf of a particular user device, said method comprising:

obtaining, at an email server, said newly issued identity certificate, wherein said newly issued identity certificate is associated with a certificate chain defined as a set of identity certificates;

responsive to said obtaining, determining, at said email server, a first subset of said set, said first subset including all of said identity certificates, in said set, that have previously been transmitted to said particular user device;

responsive to said obtaining, determining, at said email server, a second subset of said set, said subset including all of said identity certificates, in said set, that have not previously been transmitted to said particular user device;

responsive to said determining said second subset, transmitting, from said email server to said particular user device, each identity certificate in said second subset; and

transmitting, to said particular user device, said newly issued identity certificate.

9. The method of claim 8 further comprising transmitting messages to said particular user device over a first channel, wherein said transmitting said certificates comprises transmitting over a second channel.

10. An email server comprising:

a processor and a memory device configured to;

obtain a newly issued identity certificate, wherein said newly issued identity certificate is associated with a certificate chain defined as a set of identity certificates;

responsive to said obtaining, determine a first subset of said set, said first subset including all of said identity certificates, in said set, that have previously been transmitted to said particular user device;

responsive to said obtaining, determine a second subset of said set, said subset including all of said identity certificates, in said set, that have not previously been transmitted to said particular user device;

responsive to said determining said second subset, transmit, to said particular user device, each identity certificate in said second subset; and

transmit, to said particular user device, said newly issued identity certificate.

11. A non-transitory computer readable medium containing computer-executable instructions that, when performed by a processor, cause said processor to:

obtain a newly issued identity certificate, wherein said newly issued identity certificate is associated with a certificate chain defined as a set of identity certificates;

responsive to said obtaining, determine a first subset of said set, said first subset including all of said identity certificates, in said set, that have previously been transmitted to said particular user device;

responsive to said obtaining, determine a second subset of said set, said subset including all of said identity certificates, in said set, that have not previously been transmitted to said particular user device;

responsive to said determining said second subset, transmit, to said particular user device, each identity certificate in said second subset; and

transmit, to said particular user device, said newly issued identity certificate.