Digital certificate issuer-correlated digital signature verification

• US 8,959,337 B2
• Filed: 06/25/2012
• Issued: 02/17/2015
• Est. Priority Date: 06/25/2012
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Dixon, Bret W., Rumsey, Jonathan L.
• Primary Examiner(s): KIM, TAE K
• Application Number:
  US13/532,155
• Publication Number:
  US 20130346743A1
• Time in Patent Office: 967 Days
• Field of Search: 713155-159
• US Class Current: 713/157
• CPC Class Codes: H04L 2209/64 Self-signed certificates
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model

Abstract

A message including a digital signature is received at a processor. It is determined whether a specific authorized certificate issuer is configured for a message originator within a data protection policy. In response to determining that the specific authorized certificate issuer is configured for the message originator within the data protection policy, it is determined whether a message originator certificate used to generate the digital signature is issued by the configured specific authorized certificate issuer.

Claims

1. A system, comprising:

a memory configured to store a data protection policy, where the data protection policy comprises one of a system-wide data protection policy and a target queue-level data protection policy, and if the data protection policy comprises the target queue-level data protection policy and a separate system-wide data protection policy is also specified, then the target queue-level data protection policy takes precedence over the separate system-wide data protection policy; and

a processor programmed to;

receive a message comprising a digital signature of a message originator;

determine, in response to determining that the message originator is authorized by the data protection policy to originate the message, whether a specific authorized certificate issuer is configured for the message originator within the data protection policy; and

in response to determining that the specific authorized certificate issuer is configured for the message originator within the data protection policy;

determine whether a message originator certificate used to generate the digital signature of the message originator is issued by the specific authorized certificate issuer configured for the message originator within the data protection policy.

2. The system of claim 1, where, in being programmed to determine whether the message originator certificate used to generate the digital signature of the message originator is issued by the specific authorized certificate issuer configured for the message originator within the data protection policy, the processor is programmed to:

identify an indicated certificate issuer of the message originator identified within the message originator certificate;

compare the indicated certificate issuer of the message originator identified within the message originator certificate with the specific authorized certificate issuer configured for the message originator within the data protection policy; and

determine whether the indicated certificate issuer matches the specific authorized certificate issuer configured for the message originator within the data protection policy.

3. The system of claim 1, where the processor is further programmed to identify, in response to determining that the message originator certificate used to generate the digital signature is not issued by the specific authorized certificate issuer configured for the message originator within the data protection policy, the digital signature as an invalid digital signature.

4. The system of claim 1, where the processor is further programmed to identify, in response to determining that the message originator certificate used to generate the digital signature is issued by the specific authorized certificate issuer configured for the message originator within the data protection policy, the digital signature as a valid digital signature.

5. The system of claim 4, where the processor is further programmed to verify, in response to identifying the digital signature as the valid digital signature, the digital signature of the message originator within the received message.

6. A computer program product comprising a computer readable storage medium including computer readable program code, where the computer readable program code when executed on a computer causes the computer to:

receive a message comprising a digital signature of a message originator;

determine, in response to determining that the message originator is authorized by a data protection policy to originate the message, whether a specific authorized certificate issuer is configured for the message originator within the data protection policy, where the data protection policy comprises one of a system-wide data protection policy and a target queue-level data protection policy, and if the data protection policy comprises the target queue-level data protection policy and a separate system-wide data protection policy is also specified, then the target queue-level data protection policy takes precedence over the separate system-wide data protection policy; and

in response to determining that the specific authorized certificate issuer is configured for the message originator within the data protection policy;

determine whether a message originator certificate used to generate the digital signature of the message originator is issued by the specific authorized certificate issuer configured for the message originator within the data protection policy.

7. The computer program product of claim 6, where, in causing the computer to determine whether the message originator certificate used to generate the digital signature of the message originator is issued by the specific authorized certificate issuer configured for the message originator within the data protection policy, the computer readable program code when executed on the computer causes the computer to:

identify an indicated certificate issuer of the message originator identified within the message originator certificate;

compare the indicated certificate issuer of the message originator identified within the message originator certificate with the specific authorized certificate issuer configured for the message originator within the data protection policy; and

determine whether the indicated certificate issuer matches the specific authorized certificate issuer configured for the message originator within the data protection policy.

8. The computer program product of claim 6, where the computer readable program code when executed on the computer further causes the computer to identify, in response to determining that the message originator certificate used to generate the digital signature is not issued by the specific authorized certificate issuer configured for the message originator within the data protection policy, the digital signature as an invalid digital signature.

9. The computer program product of claim 6, where the computer readable program code when executed on the computer further causes the computer to identify, in response to determining that the message originator certificate used to generate the digital signature is issued by the specific authorized certificate issuer configured for the message originator within the data protection policy, the digital signature as a valid digital signature.

10. The computer program product of claim 9, where the computer readable program code when executed on the computer further causes the computer to verify, in response to identifying the digital signature as the valid digital signature, the digital signature of the message originator within the received message.