Providing certificate matching in a system and method for searching and retrieving certificates

• US 8,561,158 B2
• Filed: 09/13/2012
• Issued: 10/15/2013
• Est. Priority Date: 09/01/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil Patrick, Brown, Michael Stephen, Little, Herbert Anthony
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US13/615,098
• Publication Number:
  US 20130007447A1
• Time in Patent Office: 397 Days
• Field of Search: 726/6, 713/156, 713/175, 713/176, 709/206
• US Class Current: 726/6
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

A system and method for searching and retrieving certificates, which may be used in the processing of encoded messages. In one broad aspect, certificate identification data that uniquely identifies a certificate associated with a message is generated. The certificate identification data can then be used to determine whether the certificate is stored on a computing device. Only the certificate identification data is needed to facilitate the determination alleviating the need for a user to download the entire message to the computing device in order to make the determination.

Claims

1. A method of searching and retrieving certificates relating to a message received from a sender, the message comprising a first part and a second part, the first part comprising a header and a message body of the message, and the second part comprising data identifying a sender certificate associated with the message, wherein the method comprises:

at a computing device, receiving,

at least some data of the first part of the message but not of the second part of the message, wherein the at least some data of the first part of the message contains first certificate identification data that uniquely identifies the sender certificate;

performing a search on one or more certificate servers, wherein at least one query is submitted to the one or more certificate servers to request retrieval of certificates satisfying a certificate search request;

retrieving at least one certificate satisfying the certificate search request from the one or more certificate servers; and

processing each retrieved certificate using the first certificate identification data to determine if any of the retrieved at least one certificate is the sender certificate associated with the message.

2. The method of claim 1, wherein the processing comprises:

generating second certificate identification data associated with each retrieved certificate; and

comparing the generated second certificate identification data for each retrieved certificate to the first certificate identification data contained in the at least some data of the first part of the message, to identify a certificate of the at least one retrieved certificate matching the sender certificate.

3. The method of claim 2, wherein the generated second certificate identification data associated with each retrieved certificate comprises a serial number and issuer data for the certificate;

and wherein the generating second certificate identification data comprises parsing each retrieved certificate to obtain the serial number and issuer data for the certificate.

4. The method of claim 2, wherein the generated second certificate identification data associated with each retrieved certificate comprises a hash of at least a part of the certificate;

and wherein the generating second certificate identification data comprises applying a hash algorithm to each retrieved certificate to obtain the hash for the certificate.

5. The method of claim 1, wherein the message is received via a server remote from the computing device, and wherein the first certificate identification data was added to the message by the server.

6. The method of claim 1, wherein the computing device comprises a mobile device.

7. The method of claim 6, wherein the performing and retrieving are initiated at a second computing device coupled to the mobile device.

8. The method of claim 7, wherein the second computing device comprises a mobile data server.

9. The method of claim 7, wherein the processing is performed at the second computing device, and wherein the method further comprises downloading, to the mobile device from the second computing device, a certificate of the at least one retrieved certificate if the certificate is the sender certificate associated with the message.

10. The method of claim 7, wherein the processing is performed at the mobile device, and wherein the method further comprises downloading each retrieved certificate to the mobile device from the second computing device.

11. The method of claim 1, further comprising storing a certificate of the at least one retrieved certificate on the computing device, if the certificate is the sender certificate associated with the message.

12. A system for searching and retrieving certificates relating to a message received from a sender, the message comprising a first part and a second part, the first part comprising a header and a message body of the message, and the second part comprising data identifying a sender certificate associated with the message, the system comprising:

a first computing device configured to;

receive at least some data of the first part of the message but not of the second part of the message, wherein the at least some data of the first part of the message contains first certificate identification data that uniquely identifies the sender certificate; and

a second computing device;

wherein at least one of the first computing device and the second computing device is configured to;

perform a search on one or more certificate servers, wherein at least one query is submitted to the one or more certificate servers to request retrieval of certificates satisfying a certificate search request; and

retrieve at least one certificate satisfying the certificate search request from the one or more certificate servers;

and wherein at least one of the first computing device and the second computing device is further configured to process each retrieved certificate using the first certificate identification data to determine if any of the retrieved at least one certificate is the sender certificate associated with the message.

13. The system of claim 12, wherein when processing each retrieved certificate, the at least one of the first computing device and the second computing device is further configured to:

generate second certificate identification data associated with each retrieved certificate; and

compare the generated second certificate identification data for each retrieved certificate to the first certificate identification data contained in the at least some data of the first part of the message, to identify a certificate of the at least one retrieved certificate matching the sender certificate.

14. The system of claim 13, wherein the generated second certificate identification data associated with each retrieved certificate comprises a serial number and issuer data for the certificate;

and wherein when generating the second certificate identification data, the at least one of the first computing device and the second computing device is further configured to parse each retrieved certificate to obtain the serial number and issuer data for the certificate.

15. The system of claim 13, wherein the generated second certificate identification data associated with each retrieved certificate comprises a hash of at least a part of the certificate;

and wherein when generating the second certificate identification data, the at least one of the first computing device and the second computing device is further configured to apply a hash algorithm to each retrieved certificate to obtain the hash for the certificate.

16. The system, of claim 12, wherein the message is received via a server remote from the computing device, and wherein the first certificate identification data was added to the message by the server.

17. The system of claim 12, wherein the first computing device comprises a mobile device.

18. The system of claim 12, wherein the second computing device comprises a mobile data server.

19. The system of claim 12, wherein the second computing device processes each retrieved certificate, and wherein the first computing device is further configured to download from the second computing device, a certificate of the at least one retrieved certificate if the certificate is the sender certificate associated with the message.

20. The system of claim 12, wherein the first computing device processes each retrieved certificate, and wherein prior to the processing, the first computing device is further configured to download each retrieved certificate to the first computing from the second computing device.

21. The system of claim 19, wherein the first computing device is further configured to store the certificate.

22. A non-transitory computer-readable medium storing instructions for execution on at least one of a first computing device and a second computing device, the instructions for performing a method of searching and retrieving certificates relating to a message received from a sender, the message comprising a first part and a second part, the first part comprising a header and a message body of the message, and the second part comprising data identifying a sender certificate associated with the message, wherein when the instructions are executed,

the first computing device:

receives at least some data of the first part of the message but not of the second part of the message, wherein the at least some data of the first part of the message contains first certificate identification data that uniquely identifies the sender certificate;

at least one of the first computing device and the second computing device;

performs a search on one or more certificate servers, wherein at least one query is submitted to the one or more certificate servers to request retrieval of certificates satisfying a certificate search request; and

retrieves at least one certificate satisfying the certificate search request from the one or more certificate servers; and

at least one of the first computing device and the second computing device processes each retrieved certificate using the first certificate identification data to determine if any of the retrieved at least one certificate is the sender certificate associated with the message.