System and method for verifying digital signatures on certificates

• US 8,725,643 B2
• Filed: 04/30/2010
• Issued: 05/13/2014
• Est. Priority Date: 10/29/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Brown, Michael K., Brown, Michael S.
• Primary Examiner(s): Reagan, James A
• Application Number:
  US12/771,194
• Publication Number:
  US 20100211795A1
• Time in Patent Office: 1,474 Days
• Field of Search: 705/50
• US Class Current: 705/50
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A system and method for verifying a digital signature on a certificate, which may be used in the processing of encoded messages. In one embodiment, when a digital signature is successfully verified in a signature verification operation, the public key used to verify that digital signature is cached. When a subsequent attempt to verify the digital signature is made, the public key to be used to verify the digital signature is compared to the cached key. If the keys match, the digital signature can be successfully verified without requiring that a signature verification operation in which some data is decoded using the public key be performed.

Claims

1. A method of verifying a digital signature on a certificate on a computing device, the method comprising:

a processor of the computing device storing, in a memory store, a stored public key in response to a first successful verification of the digital signature;

the processor receiving a public key associated with an issuer of the certificate, and a request to verify the digital signature of the certificate using the received public key; and

the processor indicating a second successful verification of the digital signature in response to determining that the public key matches the stored public key.

2. The method of claim 1, wherein the computing device comprises a mobile device.

3. The method of claim 1, further comprising the processor identifying the stored public key as stale if the stored public key has been stored in the memory store for longer than a pre-determined duration.

4. The method of claim 3, further comprising deleting the stored public key from the memory store if the stored public key is identified as stale.

5. The method of claim 1, further comprising the processor marking the stored public key as stale in response to a user request.

6. The method of claim 5, further comprising deleting the stored public key from the memory store if the stored public key is marked as stale.

7. A method of verifying a digital signature on a certificate on a computing device, the method comprising:

a processor of the computing device storing, in a memory store, a stored public key and a prior verification result in response to a first successful verification of the digital signature;

the processor receiving a public key associated with an issuer of the certificate, and a request to verify the digital signature of the certificate using the received public key;

the processor indicating a second successful verification of the digital signature in response to determining that the public key matches the stored public key and that the prior verification result associated with the stored public key was successful; and

the processor indicating unsuccessful verification of the digital signature in response to determining that the public key matches the stored public key, and that the prior verification result was unsuccessful.

8. The method of claim 7, wherein the computing device comprises a mobile device.

9. The method of claim 7, further comprising the processor identifying the stored public key as stale if the stored public key has been stored in the memory store for longer than a pre-determined duration.

10. The method of claim 9, further comprising deleting the stored public key from the memory store if the stored public key is identified as stale.

11. The method of claim 7, further comprising the processor marking the stored public key as stale in response to a user request.

12. The method of claim 11, further comprising deleting the stored public key from the memory store if the stored public key is marked as stale.

13. A device comprising a processor and memory, the processor configured to verify a digital signature on a certificate, wherein the processor is configured to:

store, in a memory store, a stored public key in response to a first successful verification of the digital signature;

receive a public key associated with an issuer of the certificate, and a request to verify the digital signature of the certificate using the received public key; and

indicate a second successful verification of the digital signature in response to determining that the public key matches the stored public key.

14. The device of claim 13, wherein the device comprises a mobile device.

15. The device of claim 13, wherein the processor is further configured to identify the stored public key as stale if the stored public key has been stored in the memory store for longer than a pre-determined duration, and to compare the received public key with the stored public key residing in the memory store and indicate successful verification of the digital signature if the stored public key is not identified as stale.

16. The device of claim 15, wherein the process is further configured to delete the stored public key from the memory store if the stored public key is identified as stale.

17. The device of claim 13, wherein the processor is further configured to mark the stored public key as stale in response to a user request, and to compare the received public key with the stored public key residing in the memory store and indicate successful verification of the digital signature if the stored public key is not marked as stale.

18. The device of claim 17, wherein the processor is further configured to delete the stored public key from the memory store if the stored public key is marked as stale.

19. A device comprising a processor and memory, the processor configured to verify a digital signature on a certificate, wherein the processor is configured to:

store in a memory store, a stored public key and a prior verification result in response to a first successful verification of the digital signature;

receive a public key associated with an issuer of the certificate, and a request to verify the digital signature of the certificate using the received public key;

indicate a second successful verification of the digital signature in response to determining that the public key matches the stored public key, and that the prior verification result associated with the stored public key was successful; and

indicate unsuccessful verification of the digital signature in response to determining that the public key matches the stored public key, and that the prior verification result was unsuccessful.

20. The device of claim 19, wherein the device comprises a mobile device.

21. The device of claim 19, wherein the processor is further configured to identify the stored public key as stale if the stored public key has been stored in the memory store for longer than a pre-determined duration, and to compare the received public key with the stored public key residing in the memory store and indicate successful or unsuccessful verification of the digital signature depending on the prior verification result if the stored public key is not identified as stale.

22. The device of claim 21, wherein the processor is further configured to delete the stored public key from the memory store if the stored public key is identified as stale.

23. The device of claim 19, wherein the processor is further configured to mark the stored public key as stale in response to a user request, and to compare the received public key with the stored public key residing in the memory store and indicate successful or unsuccessful verification of the digital signature depending on the prior verification result if the stored public key is not marked as stale.

24. The device of claim 23, wherein the processor is further configured to delete the stored public key from the memory store if the stored public key is marked as stale.