System and method for verifying digital signatures on certificates

• US 9,621,352 B2
• Filed: 04/11/2014
• Issued: 04/11/2017
• Est. Priority Date: 10/29/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Brown, Michael K., Brown, Michael S.
• Primary Examiner(s): Reagan, James A
• Application Number:
  US14/250,493
• Publication Number:
  US 20140223186A1
• Time in Patent Office: 1,096 Days
• Field of Search: 705 50
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A system and method for verifying a digital signature on a certificate, which may be used in the processing of encoded messages. In one embodiment, when a digital signature is successfully verified in a signature verification operation, the public key used to verify that digital signature is cached. When a subsequent attempt to verify the digital signature is made, the public key to be used to verify the digital signature is compared to the cached key. If the keys match, the digital signature can be successfully verified without requiring that a signature verification operation in which some data is decoded using the public key be performed.

Claims

1. A non-transitory computer readable medium storing instructions executable by a processor of a computing device, which, when executed by the processor, cause the processor to:

store, in a memory store, a stored public key in response to a first successful verification of a digital signature on a certificate on the computing device, the first successful verification resulting from performing a signature verification operation on the digital signature using the stored public key;

receive a public key associated with an issuer of the certificate, and a request to verify the digital signature of the certificate using the received public key;

compare the received public key to the stored public key, in lieu of performing the signature verification operation on the digital signature using the received public key; and

indicate a second successful verification of the digital signature in response to determining that the received public key matches the stored public key.

2. The non-transitory computer readable medium of claim 1, wherein the computing device comprises a mobile device.

3. The non-transitory computer readable medium of claim 1, wherein the instructions, when executed by the processor, further cause the processor to identify the stored public key as stale if the stored public key has been stored in the memory store for longer than a pre-determined duration.

4. The computer readable medium of claim 3, wherein the instructions, when executed by the processor, further cause the processor to compare the received public key with the stored public key residing in the memory store.

5. The non-transitory computer readable medium of claim 4, wherein the instructions, when executed by the processor, further cause the processor to indicate successful verification of the digital signature if the stored public key is not identified as stale.

6. The non-transitory computer readable medium of claim 3, wherein the instructions, when executed by the processor, further cause the processor to delete the stored public key from the memory store if the stored public key is identified as stale.

7. The non-transitory computer readable medium of claim 1, wherein the instructions, when executed by the processor, further cause the processor to mark the stored public key as stale in response to a user request.

8. The non-transitory computer readable medium of claim 7, wherein the instructions, when executed by the processor, further cause the processor to compare the received public key with the stored public key residing in the memory store.

9. The non-transitory computer readable medium of claim 8, wherein the instructions, when executed by the processor, further cause the processor to indicate successful verification of the digital signature if the stored public key is not marked as stale.

10. The non-transitory computer readable medium of claim 7, wherein the instructions, when executed by the processor, further cause the processor to delete the stored public key from the memory store if the stored public key is marked as stale.

11. A non-transitory computer readable medium storing instructions executable by a processor of a computing device, which, when executed by the processor, cause the processor to:

store, in a memory store, a stored public key and a prior verification result in response to a first successful verification of a digital signature on a certificate on the computing device, the first successful verification resulting from performing a signature verification operation on the digital signature using the stored public key;

receive a public key associated with an issuer of the certificate, and a request to verify the digital signature of the certificate using the received public key;

compare the received public key to the stored public key, in lieu of performing the signature verification operation on the digital signature using the received public key;

indicate a second successful verification of the digital signature in response to determining that the received public key matches the stored public key, and that the prior verification result associated with the stored public key was successful; and

indicate unsuccessful verification of the digital signature in response to determining that the received public key matches the stored public key, and that the prior verification result was unsuccessful.

12. The non-transitory computer readable medium of claim 11, wherein the computing device comprises a mobile device.

13. The non-transitory computer readable medium of claim 11, wherein the instructions, when executed by the processor, further cause the processor to identify the stored public key as stale if the stored public key has been stored in the memory store for longer than a pre-determined duration.

14. The non-transitory computer readable medium of claim 13, wherein the instructions, when executed by the processor, further cause the processor to compare the received public key with the stored public key residing in the memory store.

15. The non-transitory computer readable medium of claim 14, wherein the instructions, when executed by the processor, further cause the processor to indicate successful or unsuccessful verification of the digital signature depending on the prior verification result if the stored public key is not identified as stale.

16. The non-transitory computer readable medium of claim 13, wherein the instructions, when executed by the processor, further cause the processor to delete the stored public key from the memory store if the stored public key is identified as stale.

17. The non-transitory computer readable medium of claim 11, wherein the instructions, when executed by the processor, further cause the processor to mark the stored public key as stale in response to a user request.

18. The non-transitory computer readable medium of claim 17, wherein the instructions, when executed by the processor, further cause the processor compare the received public key with the stored public key residing in the memory store.

19. The non-transitory computer readable medium of claim 18, wherein the instructions, when executed by the processor, further cause the processor to indicate successful or unsuccessful verification of the digital signature depending on the prior verification result if the stored public key is not marked as stale.

20. The non-transitory computer readable medium of claim 17, wherein the instructions, when executed by the processor, further cause the processor to delete the stored public key from the memory store if the stored public key is marked as stale.