ASSISTED CERTIFICATE ENROLLMENT

• US 20130311779A1
• Filed: 07/29/2013
• Published: 11/21/2013
• Est. Priority Date: 09/20/2011
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: SHERKIN, Alexander, CARRARA, Michael Anthony, Truskovsky, Alexander
• Granted Patent: US 8,909,934 B2
• Time in Patent Office: Days
• US Class Current: 713/175
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A certificate enrolment assistant module may be provided to inject a challenge password into a certificate signing request to be sent, to a Certificate Authority, from a computing device. The certificate enrolment assistant module, thereby, acts as a trusted proxy to assist the computing device in building a valid certificate signing request without the computing device having access to the challenge password.

Claims

1. A method of assisting a computing device to request a certificate, said method comprising:

receiving, from a computing device, a certificate signing request;

amending said certificate signing request to include a challenge password to produce a password-carrying certificate signing request;

determining a hash of said password-carrying certificate signing request;

transmitting said hash to said computing device;

receiving, from said computing device, said certificate signing request and a signature;

amending said certificate signing request to include a challenge password to produce a signed, password-carrying certificate signing request;

encrypting said signed, password-carrying certificate signing request to produce an encrypted signed, password-carrying certificate signing request; and

transmitting, to said computing device, said encrypted, signed, password-carrying certificate signing request.

2. The method of claim 1 further comprising, subsequent to said receiving said certificate signing request, authenticating said certificate signing request.

3. The method of claim 1 further comprising, subsequent to said receiving said certificate signing request, updating said certificate signing request to include further information.

4. The method of claim 1 further comprising:

receiving a certificate including a public cryptographic key;

wherein said encrypting comprises using said public cryptographic key to encrypt said signed, password-carrying certificate signing request.

5. The method of claim 4 wherein said certificate comprises a Registration Authority certificate.

6. A certificate enrolment assistant module comprising:

a communication subsystem operable to;

receive, from a computing device, a certificate signing request;

transmit a hash to said computing device;

receive, from said computing device, said certificate signing request and a signature;

transmit, to said computing device, an encrypted, signed, password-carrying certificate signing request.

a processor adapted to;

amend said certificate signing request to include a challenge password to produce a password-carrying certificate signing request;

determine said hash of said password-carrying certificate signing request;

amend said certificate signing request to include a challenge password to produce a signed, password-carrying certificate signing request;

encrypt said signed, password-carrying certificate signing request to produce said encrypted signed, password-carrying certificate signing request.

7. A corporate communication infrastructure within which the certificate enrolment assistant module of claim 6 is deployed.

8. A computer-readable medium containing computer-executable instructions that, when performed by a processor in a computing device, cause said processor to:

receive, from a computing device, a certificate signing request;

amend said certificate signing request to include a challenge password to produce a password-carrying certificate signing request;

determine a hash of said password-carrying certificate signing request;

transmit said hash to said computing device;

receive, from said computing device, said certificate signing request and a signature;

amend said certificate signing request to include a challenge password to produce a signed, password-carrying certificate signing request;

encrypt said signed, password-carrying certificate signing request to produce an encrypted signed, password-carrying certificate signing request; and

transmit, to said computing device, said encrypted, signed, password-carrying certificate signing request.