Method and apparatus for retrieving X.509 certificates from an X.500 directory

• US 5,774,552 A
• Filed: 12/13/1995
• Issued: 06/30/1998
• Est. Priority Date: 12/13/1995
• Status: Expired due to Term

• Current Assignee: NCR Corporation
• Original Assignee: NCR Corporation
• Inventors: Grimmer, Francine Gail
• Primary Examiner(s): CANGIALOSI, SALVATORE A
• Application Number:
  US08/572,261
• Time in Patent Office: 930 Days
• Field of Search: 380/25, 380/49
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A method and apparatus for retrieving, verifying, and using information accessible by a directory service agent to authenticate electronic messages is described. The method comprises the steps of transmitting an open connection message to establish communication between a directory user agent and a directory service agent, searching a directory in the directory service agent for authentication certificates, fetching the found authentication certificates, and transmitting the fetched authentication certificates to the directory user agent. In one embodiment of the invention, the method also comprises the step of searching the directory for authentication certificates responsive to a search criteria message in the open connection message.

Claims

1. A method of retrieving an authentication certificate from a directory accessible by a directory service agent in a directory user agent, comprising the steps of:

transmitting an open connection message comprising a search criteria message including certificate attributes to establish communication between the directory user agent and the directory service agent;

searching the directory for authentication certificates responsive to the search criteria message;

fetching the authentication certificates; and

transmitting the fetched authentication certificates to the directory user agent.

2. The method of claim 1 wherein

the step of searching the directory for authentication certificates comprises the step of invoking a search application program interface to retrieve the certificates responsive to the search criteria message.

3. The method of claim 2 wherein the search application program interface resides in the directory user agent.

4. The method of claim 2 wherein the search application program interface resides in the directory service agent.

5. The method of claim 1 wherein each authentication certificate is associated with a name and the step of searching the directory for authentication certificates further comprises the steps of:

generating a list of names associated with certificates responsive to the search criteria message; and

presenting the names list to a user.

6. The method of claim 1 wherein the step of fetching the certificates comprises the steps of:

invoking a search application program interface to retrieve certificates; and

validating the retrieved certificates.

7. The method of claim 6 wherein the step of validating the certificates comprises the step of verifying that a certificate has not been revoked by accessing a certificate revocation list maintained by the directory service agent.

8. The method of claim 6 wherein the directory is accessible to a plurality of directory service agents, said directory service agents in communication with each other and arranged in a hierarchical relationship, and the step of validating the certificates comprises the step of verifying the certificate authority, including the steps of:

accessing a plurality of directory service agents at different hierarchical levels;

obtaining certificates from each of the plurality of directory service agents; and

comparing the certificates obtained from the plurality of directory service agents.

21. The method of claim 1, wherein the step of transmitting an open connection message to establish communication between the directory user agent and the directory service agent comprises the steps of opening and binding a certificate data link library to the directory service agent.

22. The method of claim 1, wherein the open connection message further comprises a search limit and the directory is searched for authentication certificates until the search limit is reached.

23. The method of claim 1, wherein the open connection message comprises a directory service agent name and an associated security level, and the certificate data link library is bound to the directory service agent by generating a bind call from the security level and calling a bind application program interface as a user to the directory service agent.

24. The method of claim 21, wherein the open connection message comprises a binding time value, and the method further comprises the steps of suspending binding if the binding time exceeds the binding time value.

9. An apparatus for retrieving an authentication certificate from a directory accessible by a directory service agent in a directory user agent comprising:

a computer implementing the directory user agent communicatively coupled to the directory service agent;

means, performed by the computer, for transmitting an open connection message comprising a search criteria message including certificate attributes to establish communication between the directory user agent and the directory service agent;

means, performed by the computer, for searching the directory for authentication certificates responsive to the search criteria message;

means, performed by the computer, for fetching the authentication certificates; and

means, performed by the computer, for transmitting the fetched authentication certificates to the directory user agent.

10. The apparatus of claim 9 wherein the means for fetching further comprises means, performed by the computer, for invoking a search application program interface to retrieve the certificates responsive to the search criteria message.

11. The apparatus of claim 10 wherein the search application program interface resides in the directory user agent.

12. The apparatus of claim 10 wherein the search application program interface resides in the directory service agent.

13. The apparatus of claim 9 wherein each authentication certificate is associated with a name and the means for searching the directory for the authentication certificates further comprises:

means for generating a list of names associated with the certificates further comprises;

means for generating a list of names associated with certificates responsive to the search criteria message; and

means for presenting the names to a user.

14. The apparatus of claim 9 wherein fetching means comprises:

means for invoking a search application program interface to retrieve certificates; and

means for validating the retrieved certificates.

15. The apparatus of claim 14 wherein the means validating means comprises means for validating that a certificate has not been revoked by accessing a certificate revocation list maintained by the directory service agent.

16. The apparatus of claim 14 wherein the directory is accessible to a plurality of directory service agents, said directory service agents in communication with each other and arranged in a hierarchical relationship, and the validating means comprises a means for validating the authenticity of the directory service agent, including:

means for accessing a plurality of directory service agents at different hierarchical levels;

means for obtaining certificates from each of the plurality of directory service agents; and

means for comparing the certificates obtained from the plurality of directory service agents.

25. The apparatus of claim 9, wherein the means for transmitting an open connection message to establish communication between the directory user agent and the directory service agent comprises a means for opening and binding a certificate data link library to the directory service agent.

26. The apparatus of claim 9, wherein the open connection message further comprises a search limit and the directory is searched for authentication certificates until the search limit is reached.

27. The apparatus of claim 9, wherein the open connection message comprises a directory service agent name and an associated security level, and the certificate data link library is bound to the directory service agent by generating a bind call from the security level and calling a bind application program interface as a user to the directory service agent.

28. The apparatus of claim 25, wherein the open connection message comprises a binding time value, and the method further comprises the steps of suspending binding if the binding time exceeds the binding time value.

17. A program storage device, readable by a computer, tangibly embodying one or more programs of instructions executable by the computer to perform one or more programs of instruction executable by the computer to perform method steps of retrieving an authentication certificate from a directory accessible by a directory service agent in a directory user agent, the method steps comprising the steps of:

transmitting an open connection message comprising a search criteria message including certificate attributes to establish communication between the directory user agent and the directory service agent;

searching the directory for authentication certificates responsive to the search criteria message;

fetching the authentication certificates; and

transmitting the fetched authentication certificates to the directory user agent.

18. The program storage device of claim 17, wherein the method step of searching the directory for authentication certificates comprises the method step of invoking a search application program interface to retrieve the certificates responsive to the search criteria message.

19. The program storage device of claim 17 wherein the method step of fetching the certificates comprises the method steps of:

invoking a search application program interface to retrieve certificates; and

validating the retrieved certificates.

20. The program storage device of claim 19 wherein the directory is accessible to a plurality of directory service agents, said directory service agents in communication with each other and arranged in a hierarchical relationship, and the step of validating the certificates comprises the method steps of:

verifying that the certificate has not been revoked by accessing a certificate revocation list maintained by the directory service agent; and

verifying the certificate authority, including the method steps of accessing a plurality of directory service agents at different hierarchical levels, obtaining certificates from each of the plurality of directory service agents and comparing the certificates obtained from the plurality of directory service agents.

29. The program storage device of claim 17, wherein the method step of transmitting an open connection message to establish communication between the directory user agent and the directory service agent comprises the method steps of opening and binding a certificate data link library to the directory service agent.

30. The program storage device of claim 17, wherein the open connection message further comprises a search limit and the directory is searched for authentication certificates until the search limit is reached.

31. The program storage device of claim 17, wherein the open connection message comprises a directory service agent name and an associated security level, and the certificate data link library is bound to the directory service agent by generating a bind call from the security level and calling a bind application program interface as a user to the directory service agent.

32. The program storage device of claim 29, wherein the open connection message comprises a binding time value, and the method further comprises the steps of suspending binding if the binding time exceeds the binding time value.