Token renewal

• US 8,683,196 B2
• Filed: 11/24/2009
• Issued: 03/25/2014
• Est. Priority Date: 11/24/2009
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Fu, Christina, Magne, John Garraye
• Primary Examiner(s): Rahman, Mahfuzur
• Application Number:
  US12/625,464
• Publication Number:
  US 20110126002A1
• Time in Patent Office: 1,582 Days
• Field of Search: 713/156
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

A method and system for renewing certificates stored on tokens is described.

Claims

1. A method, implemented by a computing system programmed to perform operations, comprising:

receiving, by the computing system, a token renewal request for renewing an original digital certificate stored on a token, wherein the original digital certificate comprises an original key and an original expiration date; and

renewing, by the computing system, the original digital certificate as a renewed certificate when the token renewal request is approved, wherein the renewed certificate comprises the original key and a new expiration date, wherein the renewed certificate is functionally identical to the original digital certificate, and wherein renewing the original digital certificate comprises;

authenticating the token and a user associated with the token,

determining whether a token policy allows renewal of the token,

when the token policy allows token renewal, sending a certificate renewal request to obtain the renewed certificate, and

when the token policy does not allow token renewal, sending a re-enrollment request to a certificate manager to issue a new certificate comprising a new key pair.

2. The method of claim 1, wherein the renewing comprises:

finding a record of the token in a token database of the computing system;

sending a certificate renewal request with information from the record to a certificate manager to approve the certificate renewal request and to issue the renewed certificate; and

sending the renewed certificate back to the token to store the renewed certificate.

3. The method of claim 1, wherein renewing the original digital certificate further comprises:

finding a record of the token in a token database of the computing system; and

sending the renewed certificate back to the token to store the renewed certificate, wherein sending the certificate renewal request to obtain the renewed certificate comprises;

sending the certificate renewal request with information from the record to a certificate manager to approve the certificate renewal request and to issue the renewed certificate.

4. The method of claim 3, wherein the original digital certificate was previously issued by the certificate manager, and wherein the information comprises a serial number identifying the original digital certificate issued by the certificate manager.

5. The method of claim 3, wherein authenticating the user associated with the token comprises:

receiving user identification information comprising a password; and

authenticating the user against a user database using the user identification information.

6. The method of claim 3, wherein authenticating the user associated with the token comprises:

receiving a Lightweight Directory Access Protocol (LDAP) user identifier and a password to access a LDAP directory; and

authenticating the token against the LDAP directory using the LDAP user identifier and the password.

7. The method of claim 3, wherein authenticating the token sets up a secure channel for the token and a token processing system (TPS) to communicate securely.

8. The method of claim 1, further comprising:

when the token policy does not allow token renewal,

sending the new certificate to a client application to store the new certificate on the token.

9. The method of claim 8, further comprising instructing the client application to store the new certificate and the original digital certificate on the token, wherein the original digital certificate and the new certificate are encryption certificates.

10. The method of claim 1, wherein renewing the original digital certificate further comprises:

finding a record of the token in a token database of the computing system;

determining whether the original digital certificate is eligible for renewal, wherein the token is eligible for renewal when the token policy allows renewal of the token and the original expiration date is not outside a grace period to renew the original digital certificate;

when the token is eligible for renewal, sending the certificate renewal request with information from the record to a certificate manager to approve the certificate renewal request and to issue the renewed certificate; and

sending the renewed certificate back to the token to store the renewed certificate.

11. A method, implemented by a computing system programmed to perform operations, comprising:

receiving, by the computing system, a token renewal request for renewing an original digital certificate stored on a token, wherein the original digital certificate comprises an original key and an original expiration date, wherein the token stores a plurality of digital certificates, including the original digital certificate; and

renewing the plurality of digital certificates as a plurality of renewed certificates, wherein renewing the plurality of digital certificates comprises;

finding a record of the token in a token database of the computing system,

authenticating the token and a user associated with the token,

determining whether a token policy in the record allows renewal of the token,

when the token policy allows renewal of the token,

determining a number of the plurality of digital certificates stored on the token from the record,

determining whether the token policy in the record allows renewal of each of the plurality of digital certificates stored on the token,

sending a certificate renewal request for each of the plurality of digital certificates in the record to a certificate manager to approve the respective certificate renewal request and to issue a renewed certificate when the respective certificate renewal request is approved.

12. The method of claim 11, wherein renewing the plurality of digital certificates further comprises:

sending each of the plurality of renewed certificates back to the token to store each of the plurality of renewed certificates.

13. A method, implemented by a computing system programmed to perform operations, comprising:

receiving, by the computing system, a token renewal request for renewing an original digital certificate stored on a token, wherein the original digital certificate comprises an original key and an original expiration date, wherein the token stores a plurality of digital certificates, including the original digital certificate; and

renewing the plurality of digital certificates as a plurality of renewed certificates, wherein renewing the plurality of digital certificates comprises;

finding a record of the token in a token database of the computing system,

authenticating the token and a user associated with the token,

determining whether a token policy in the record allows renewal of the token,

determining a number of the plurality of digital certificates stored on the token by requesting information for each of the plurality of digital certificates from a client application that communicates with the token,

sending a certificate renewal request for each of the plurality of digital certificates with the information received from the client application to a certificate manager to approve the respective certificate renewal request and to issue a renewed certificate when the respective certificate renewal request is approved, and

sending each of the plurality of renewed certificates back to the token to store each of the plurality of renewed certificates.

14. A method, implemented by a computing system programmed to perform operations, comprising:

receiving, by the computing system, a token renewal request for renewing an original digital certificate stored on a token, wherein the original digital certificate comprises an original key and an original expiration date, wherein the token stores a plurality of digital certificates, including the original digital certificate; and

renewing the plurality of digital certificates as a plurality of renewed certificates, wherein renewing the plurality of digital certificates comprises;

finding a record of the token in a token database of the computing system,

authenticating the token and a user associated with the token,

for each of the plurality of digital certificates, determining whether a token policy in the record allows renewal of the respective certificate, wherein the token policy allows renewal of a first type of certificate, but requires re-enrollment of a second type of certificate,

for each of the plurality of digital certificates of the first type, sending a certificate renewal request with information from the respective certificate to a certificate manager to approve the respective certificate renewal request and to issue a renewed certificate when the respective certificate renewal request is approved,

for each of the plurality of digital certificates of the second type, sending a re-enrollment request to the certificate manager to generate a new certificate comprising a new key pair for the respective certificate, and

sending each of the renewed certificates and each of the new certificates back to the token to be stored.

15. A certificate system, comprising:

a data storage device to store token data associated with a plurality of tokens that store at least one digital certificate; and

a first server, comprising a token processing system (TPS), coupled to the data storage device, wherein the TPS is to receive a token renewal request for renewing an original digital certificate stored on a token, and to renew the original digital certificate as a renewed certificate when the token renewal request is approved using the token data, wherein the original digital certificate comprises an original key and an original expiration date, wherein the renewed certificate comprises the original key and a new expiration date, wherein the renewed certificate is functionally identical to the original digital certificate, and wherein to renew the original digital certificate comprises;

authenticating the token and a user associated with the token,

determining whether a token policy allows renewal of the token,

when the token policy allows token renewal, sending a certificate renewal request to obtain the renewed certificate, and

when the token policy does not allow token renewal, sending a re-enrollment request to a certificate manager to issue a new certificate comprising a new key pair.

16. The certificate system of claim 15, further comprising a second server, comprising a certificate manager, coupled to the first server, wherein the TPS is to send a certificate renewal request to the certificate manager to approve the certificate renewal request and to issue the renewed certificate, and to send the renewed certificate back to the token to store the renewed certificate.

17. The certificate system of claim 15, wherein the data storage device is to manage a token database to store a record for the token, to associate the token with the original digital certificate stored on the token and with the user, wherein the TPS is to find the record of the token in the token database in response to receipt of the token renewal request, and wherein the TPS is to send a certificate renewal request with information from the record to the certificate manager to approve the certificate renewal request and to issue the renewed certificate.

18. The certificate system of claim 17, wherein the token database is managed by a Lightweight Directory Access Protocol (LDAP) directory server coupled to the first server, and wherein the record of the token comprises the token policy that specifies whether the original digital certificate stored on the token can be renewed, and a serial number identifying the original certificate issued by the certificate manager.

19. The certificate system of claim 15, wherein the TPS comprises a token renewal module that comprises:

a TPS engine coupled to receive the token renewal request from a client application that manages the token; and

a token database manager coupled to the TPS engine and the data storage device, wherein the TPS engine is to find a record of the token via the token database manager, and wherein the TPS engine is further to send the certificate renewal request with information from the record to a second server, the second server comprising the certificate manager to approve the certificate renewal request and to issue the renewed certificate, and to send the renewed certificate back to the token to store the renewed certificate.

20. A non-transitory machine-readable storage medium having instructions, which when executed, cause a token processing system (TPS) of a computing system to perform operations comprising:

receiving a token renewal request for renewing an original digital certificate stored on a token, wherein the original digital certificate comprises an original key and an original expiration date; and

renewing, by the TPS, the original digital certificate as a renewed certificate when the token renewal request is approved, wherein the renewed certificate comprises the original key and a new expiration date, wherein the renewed certificate is functionally identical to the original digital certificate, wherein renewing the original digital certificate comprises;

authenticating the token and a user associated with the token,

determining whether a token policy allows renewal of the token,

when the token policy allows token renewal, sending a certificate renewal request to obtain the renewed certificate, and

when the token policy does not allow token renewal, sending a re-enrollment request to a certificate manager to issue a new certificate comprising a new key pair.

21. The non-transitory machine-readable storage medium of claim 20, wherein the renewing comprises:

finding a record of the token in a token database of the computing system;

sending the renewed certificate back to the token to store the renewed certificate, wherein sending the certificate renewal request to obtain the renewed certificate comprises;

sending the certificate renewal request with information from the record to the certificate manager to approve the certificate renewal request and to issue the renewed certificate.

22. The non-transitory machine-readable storage medium of claim 20, wherein the renewing comprises:

finding a record of the token in the token database;

determining whether the token policy in the record allows renewal of the token;

determining whether the original digital certificate is eligible for renewal, wherein the token is eligible for renewal when the token policy allows renewal of the token and the original expiration date is not outside a grace period to renew the original digital certificate;

when the token is eligible for renewal, sending the certificate renewal request with information from the record to the certificate manager to approve the certificate renewal request and to issue the renewed certificate; and

sending the renewed certificate back to the token to store the renewed certificate.