Authority-neutral certification for multiple-authority PKI environments

• US 8,621,206 B2
• Filed: 08/02/2011
• Issued: 12/31/2013
• Est. Priority Date: 09/28/2001
• Status: Expired due to Term

• Current Assignee: Fintegraph, LLC (Ascend Innovation Management, LLC)
• Original Assignee: Zoralco Fund Limited Liability Company (Intellectual Ventures LLC)
• Inventors: Chang, Kae-por F.
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): KANAAN, SIMON P
• Application Number:
  US13/196,328
• Publication Number:
  US 20120030460A1
• Time in Patent Office: 882 Days
• Field of Search: None
• US Class Current: 713/156
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A method for facilitating electronic certification, and systems for use therewith, are presented in the context of public key encryption infrastructures. Some aspects of the invention provide methods for facilitating electronic certification using authority-neutral service requests sent by an application, which are then formatted by a server comprising a middleware that can convert the authority-neutral request into certification authority specific objects. The server and middleware then return a response from a selected certification authority back to the service requesting application. Thus, the server and/or middleware act as intermediaries that facilitate user transactions in an environment having multiple certification authorities without undue burden on the applications or the expense and reliability problems associated therewith.

Claims

1. A non-transitory computer-readable medium having instructions stored thereon, that in response to execution by a computing device causes the computing device to perform operations comprising:

receiving, at a server, a service request from an application executing on a node separate from the server, the service request containing public key encryption data;

based on user profile data, selecting a certification authority, from a plurality of available certification authorities, wherein the user profile data is pre-stored at the server and customizable based on user preference information;

generating a data object including information associated with information in the service request;

transmitting the data object from the server to the selected certification authority;

receiving, at the server, a response from the selected certification authority;

generating a response object including information associated with information contained in the response; and

transmitting the response object to the application executing on the node.

2. The non-transitory computer-readable medium of claim 1, wherein the service request is certification authority-neutral.

3. The non-transitory computer-readable medium of claim 1, wherein generating the data object comprises converting the data object into a format consistent with an industry-standard protocol.

4. The non-transitory computer-readable medium of claim 3, wherein the industry-standard protocol is the Open Certificate Status Protocol (OCSP).

5. The non-transitory computer-readable medium of claim 1, wherein the operations take place in a public key infrastructure (PKI) environment.

6. The non-transitory computer-readable medium of claim 1, wherein the server is a World Wide Web server adapted for conducting secure transactions.

7. The non-transitory computer-readable medium of claim 1, wherein receiving the service request comprises receiving a HTTPS message from the application.

8. The non-transitory computer-readable medium of claim 1, wherein the response from the selected certification authority is in a format consistent with an industry-standard protocol.

9. The non-transitory computer-readable medium of claim 8, wherein the industry-standard protocol is the Open Certificate Status Protocol (OCSP).

10. The non-transitory computer-readable medium of claim 1, said instructions further causing the computing device to perform operations comprising posting an object to the server using a Post method.

11. The non-transitory computer-readable medium of claim 1, said instructions further causing the computing device to perform operations comprising passing the service request, using a load balancer, to a selected server, the server selected from a plurality of servers.

12. The non-transitory computer-readable medium of claim 1, wherein generating the response object comprises putting the response into a HTTP-compatible format.

13. The non-transitory computer-readable medium of claim 1, wherein the computing device is further operable to perform operations comprising registration of the application using a registration process.

14. The non-transitory computer-readable medium of claim 13, wherein the registration process comprises creating an application preference profile.

15. The non-transitory computer-readable medium of claim 1, wherein the transmitted data object comprises a subset of application-related information, the subset being chosen based on the selected certification authority.