Embedded extrinsic source for digital certificate validation

• US 9,736,146 B2
• Filed: 01/08/2016
• Issued: 08/15/2017
• Est. Priority Date: 03/23/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Reece, Stuart J., Akehurst-Ryan, Andrew D., McKechan, David J.
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Ambaye, Samuel
• Application Number:
  US14/991,530
• Publication Number:
  US 20160127355A1
• Time in Patent Office: 585 Days
• Field of Search: 713157, 713158
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A computer uses the information included within a digital certificate to obtain a current date and time value from a trusted extrinsic trusted source and the computer compares the obtained current date and time value to a validity period included in the digital certificate to determine if the digital certificate is expired. The information included within the digital certificate specifying an extrinsic source for the current date and time value can be included in an extension of the digital certificate, and the information can specify a plurality of extrinsic sources.

Claims

1. A method of creating a digital certificate, the method comprising the steps of:

one or more computer processors creating a digital certificate that includes information defining a validity period and information specifying a first extrinsic source of a current date and time; and

one or more computer processors distributing the digital certificate to a receiving computer, wherein;

the receiving computer is configured to request the current date and time from the first extrinsic source, and the receiving computer is configured to receive the current date and time, and the receiving computer is configured to compare the current date and time that is received to the validity period included within the digital certificate that is created.

2. The method of claim 1, wherein the information specifying the first extrinsic source includes information specifying one of one or more extrinsic sources included within the digital certificate that is created.

3. The method of claim 2 wherein the information specifying the one or more extrinsic sources included within the digital certificate that is created is a uniform resource locator for an online address for each of the one or more extrinsic sources.

4. The method of claim 2, wherein the digital certificate that is created includes an indicator value of criticality asserting that the receiving computer is required to receive the current date and time from the one or more extrinsic sources.

5. The method of claim 1, wherein the information specifying a first extrinsic source is included within an extension of the digital certificate.

6. A computer program product of creating a digital certificate, the computer program product comprising:

one or more computer readable storage media wherein a computer readable storage medium is not a transitory signal per se, and program instructions are stored on the one or more computer readable storage media, the program instructions comprising;

program instructions to create a digital certificate that includes information defining a validity period and information specifying a first extrinsic source of a current date and time; and

program instructions to distribute the digital certificate to a receiving computer, wherein;

the receiving computer is configured to request a current date and time from the first extrinsic source, and the receiving computer is configured to receive the current date and time, and the receiving computer is configured to compare the current date and time that is received to the validity period of the digital certificate that is created.

7. The computer program product of claim 6, wherein the information specifying the first extrinsic source includes information specifying one of one or more extrinsic sources included within the digital certificate that is created.

8. The computer program product of claim 7, wherein the information specifying the one or more extrinsic sources included within the digital certificate that is created is a uniform resource locator of an online address for each of the one or more extrinsic sources.

9. The computer program product of claim 7, wherein the digital certificate that is created includes an indicator value of criticality asserting that the receiving computer is required to receive the current date and time from the one or more extrinsic sources.

10. The computer program product of claim 6, wherein the information specifying a first extrinsic source is included within an extension of the digital certificate.

11. A computer system for validating a first digital certificate, the computer system comprising:

one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more tangible storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the program instructions comprising;

program instructions to receive a first digital certificate that includes information defining a validity period and information specifying an extrinsic source of a current date and time;

program instructions to request the current date and time from the extrinsic source; and

responsive to receiving the current date and time from the extrinsic source, program instructions to compare the current date and time to the validity period of the first digital certificate.

12. The computer system of claim 11, wherein the extrinsic source of the current date and time includes a plurality of extrinsic sources of the current date and time.

13. The method of claim 12, further comprising:

responsive to an absence of response from requesting the current date and time from a first extrinsic source of the plurality of extrinsic sources of the current date and time, requesting the current date and time from a second extrinsic source of the plurality of extrinsic sources included within the first digital certificate.

14. The computer system of claim 11, wherein the information specifying the extrinsic source includes specifying a uniform resource locator to a network location of the extrinsic source.

15. The computer system of claim 12, wherein information specifying a second extrinsic source of the plurality of extrinsic sources of the current date and time, is received from a first extrinsic source of the plurality of extrinsic sources of the current date and time.

16. The computer system of claim 12, wherein the current date and time is provided to a first extrinsic source of the plurality of extrinsic sources by a second extrinsic source of the plurality of extrinsic sources, and wherein the current date and time is received from the first extrinsic source.

17. The computer system of claim 11, wherein program instructions to compare the current date and time that is received from the extrinsic source to the validity period of the first digital certificate further comprises:

program instructions to determine whether the current date and time received from the extrinsic source is within the validity period of first digital certificate.

18. The computer system of claim 11, further comprising:

program instructions to determine whether the first digital certificate includes an indicator value of criticality asserting that the computer is required to receive the current date and time from an extrinsic source; and

in response to determining that the first digital certificate includes an indicator value of criticality asserting that the computer is required to receive the current date and time from an extrinsic source, program instructions to request the current date and time from the extrinsic source.

19. The computer system of claim 11, wherein the information specifying the extrinsic source is included within an extension of the first digital certificate.

20. The computer system of claim 11, wherein the program instructions to receive the current date and time value from the extrinsic source, includes receiving the current date and time value within a second digital certificate sent by the extrinsic source.