System and method for installing trust anchors in an endpoint

• US 20060174124A1
• Filed: 01/25/2005
• Published: 08/03/2006
• Est. Priority Date: 01/25/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Dexter, Douglas Q., Bell, Robert T.
• Granted Patent: US 8,312,263 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

According to one embodiment of the present invention, a method of updating a certificate trust list on a first endpoint includes receiving an initial certificate trust list at the first endpoint. The initial certificate trust list includes authentication data for at least a second endpoint. Digitally signed information is received at the first endpoint and authentication is initiated against the authentication data for the at least a second endpoint. The authentication occurs only if the digital signature is complementary to the authentication data for the at least a second endpoint. After successful authentication, the initial certificate trust list is updated with the information to yield an updated certificate trust list.

Claims

1. A method of updating a certificate trust list on a first endpoint, comprising:

receiving an initial certificate trust list at the first endpoint, the initial certificate trust list comprising authentication data for at least a second endpoint;

receiving information at the first endpoint, the information signed with a digital signature;

initiating authentication of the digital signature against the authentication data for the at least a second endpoint, the authentication occurring only if the digital signature is complementary to the authentication data for the at least a second endpoint; and

after successful authentication, updating the initial certificate trust list with the information to yield an updated certificate trust list.

2. The method of claim 1, further comprising:

verifying a privilege of the at least a second endpoint prior to updating the initial certificate trust list, wherein the initial certificate trust list is updated only if the at least a second endpoint has a privilege of an administrator.

3. The method of claim 1, wherein updating the initial certificate trust lists further comprises:

adding authentication data corresponding to at least a third endpoint.

4. The method of claim 1, wherein updating the initial certificate trust list further comprises:

removing authentication data corresponding to the at least a second endpoint.

5. The method of claim 1, wherein updating the initial certificate trust list further comprises:

renewing authentication data corresponding to the at least a second endpoint.

6. A method of updating a certificate trust list on a first endpoint, comprising:

digitally signing information with a digital signature of a second endpoint;

transmitting the information to the first endpoint wherein;

the first endpoint comprises an initial certificate trust list comprising authentication data for the second endpoint;

the first endpoint authenticates the digital signature with the authentication data for the second endpoint; and

after successful authentication, the first endpoint updates the initial certificate trust list with the information to yield an updated certificate trust list.

7. A system for updating a certificate trust list on a first endpoint, the system comprising:

a communication medium, operable to transmit information to the first endpoint, the information signed with a digital signature of at least a second endpoint; and

the first endpoint comprising;

memory operable to store a certificate trust list, the certificate trust list comprising authentication data corresponding to at least a second endpoint; and

logic encoded in media, operable to;

initiate authentication of the digital signature against authentication data for the at least a second endpoint, the authentication occurring only if the digital signature is complementary to the authentication data for the at least a second endpoint, and

after successful authentication, update the initial certificate trust list with the information to yield an updated certificate trust list.

8. Logic encoded in media such that when executed is operable to:

digitally sign information with a digital signature of a second endpoint; and

transmit the information to the first endpoint wherein;

the first endpoint comprises an initial certificate trust list comprising authentication data for the second endpoint;

the first endpoint authenticates the digital signature with the authentication data for the second endpoint; and

after successful authentication, the first endpoint updates the initial certificate trust list with the information to yield an updated certificate trust list.

9. An apparatus comprising:

means for digitally signing information with a digital signature of a second endpoint; and

means for transmitting the information to the first endpoint wherein;

the first endpoint comprises an initial certificate trust list comprising authentication data for the second endpoint;

the first endpoint authenticates the digital signature with the authentication data for the second endpoint; and

after successful authentication, the first endpoint updates the initial certificate trust list with the information to yield an updated certificate trust list.

10. Logic encoded in media such that when executed is operable to:

receive an initial certificate trust list at a first endpoint, the initial certificate trust list comprising authentication data for at least a second endpoint;

receive information at the first endpoint, the information signed with a digital signature;

initiate authentication of the digital signature against authentication data for the at least a second endpoint, the authentication occurring only if the digital signature is complementary to the authentication data for the at least a second endpoint; and

after successful authentication, update the initial certificate trust list with the information to yield an updated certificate trust list.

11. The logic of claim 10, further operable:

verify a privilege of the at least a second endpoint prior to the update of the initial certificate trust list, wherein the initial certificate trust list will update only if the at least a second endpoint has a privilege of an administrator.

12. The logic of claim 10, wherein the logic in the update to the initial certificate trust list is further operable to:

add authentication data corresponding to at least a third endpoint in the update to the initial certificate trust list.

13. The logic of claim 10, wherein the logic in the update to the initial certificate trust list is further operable to:

remove authentication data corresponding to the at least a second endpoint in the update to the initial certificate trust list.

14. The logic of claim 10, wherein the logic in the update to the initial certificate trust list is further operable to:

renew authentication data corresponding to the at least a second endpoint in the update to the initial certificate trust list.

15. An apparatus comprising:

means for receiving an initial certificate trust list at the first endpoint, the initial certificate trust list comprising authentication data for at least a second endpoint;

means for receiving information at the first endpoint, the information signed with a digital signature;

means for initiating authentication of the digital signature against the authentication data for the at least a second endpoint, the authentication occurring only if the digital signature is complementary to the authentication data for the at least a second endpoint; and

after successful authentication, means for updating the initial certificate trust list with the information to yield an updated certificate trust list.

16. The apparatus of claim 15, further comprising:

means for verifying a privilege of the at least a second endpoint prior to updating the initial certificate trust list, wherein the initial certificate trust list is updated only if the at least a second endpoint has a privilege of an administrator.

17. The apparatus of claim 15, wherein the means for updating the initial certificate trust lists further comprises:

means for adding authentication data corresponding to at least a third endpoint.

18. The apparatus of claim 15, wherein the means for updating the initial certificate trust list further comprises:

means for removing authentication data corresponding to the at least a second endpoint.

19. The apparatus of claim 15, wherein the means for updating the initial certificate trust list further comprises:

means for renewing authentication data corresponding to the at least a second endpoint.

20. A method of updating a certificate trust list on a first endpoint, comprising:

receiving an initial certificate trust list at the first endpoint, the initial certificate trust list comprising authentication data for at least a second endpoint;

receiving information at the first endpoint, the information signed with a digital signature;

initiating authentication of the digital signature against the authentication data for the at least a second endpoint, the authentication occurring only if the digital signature is complementary to the authentication data for the at least a second endpoint;

verifying that the at least a second endpoint has a privilege of an administrator; and

after successful authentication and verification, updating the initial certificate trust list with the information to yield an updated certificate trust list.