Transparent on-demand certificate provisioning for secure email

• US 7,502,924 B2
• Filed: 01/25/2005
• Issued: 03/10/2009
• Est. Priority Date: 01/25/2005
• Status: Active Grant

• Current Assignee: Dropbox, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Myers, Andrew S., Wray, John C., Miller, David J.
• Primary Examiner(s): JUNG, DAVID YIUK
• Application Number:
  US11/042,559
• Publication Number:
  US 20060168443A1
• Time in Patent Office: 1,505 Days
• Field of Search: 713/156, 713/155, 713/150
• US Class Current: 713/156
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

The present invention provides a method, system, and computer program product for transparent on-demand certificate provisioning for secure email. The method comprises: generating a keypair and a self-signed certificate; requesting a certificate from a certification authority; temporarily securing email using the self-signed certificate; and securing email using the requested certificate, after receipt of the requested certificate from the certification authority. The present inventions uses self-signed certificates as an initial, interim security mechanism, provides automatic submission of certificate requests and renewal requests, provides an administrative policy to specify when keypairs and self-signed certificates are generated by a user'"'"'s client system, and when certificate requests are submitted, and provides automatic transition from end-user defined trust to delegated trust based upon CA-issued certificates.

Claims

1. A method for certificate provisioning, comprising:

generating a keypair and a self-signed certificate;

requesting a certificate from a certification authority;

temporarily securing email using the self-signed certificate;

securing email using the requested certificate, after receipt of the requested certificate from the certification authority; and

displaying a secure email associated with the requested certificate.

2. The method of claim 1, further comprising:

automatically performing the generating, requesting, and securing steps in response to a starting of a client system.

3. The method of claim 1, further comprising:

automatically performing the generating, requesting, and securing steps in response to a user attempting to send secure email.

4. The method of claim 1, wherein the request for the certificate is explicitly initiated by a user.

5. The method of claim 1, wherein the step of temporarily securing email using the self-signed certificate is performed for a predetermined period of time.

6. The method of claim 5, wherein the predetermined period of time corresponds to an expected length of time required to receive the requested certificate from the certification authority.

7. The method of claim 5, wherein the predetermined period of time is set by an administrative policy.

8. The method of claim 1, further comprising:

determining when the certificate is to be requested from the certification authority, based on an administrative policy.

9. The method of claim 1, further comprising:

receiving an email secured using the self-signed certificate.

10. The method of claim 9, further comprising:

determining if the self-signed certificate in the received email is trusted; and

verifying a signature associated with the self-signed certificate if it is determined that the self-signed certificate is trusted.

11. The method of claim 9, further comprising:

selectively marking the self-signed certificate as trusted for a period of time defined by an administrative policy.

12. The method of claim 9, farther comprising:

receiving an email secured using the certificate received from the certification authority;

determining if the self-signed certificate and the certificate received from the certification authority are associated with a same key; and

purging the self-signed certificate if the self-signed certificate and the certificate received from the certification authority are associated with the same key.

13. Deploying an application for certificate provisioning, comprising:

providing a computer infrastructure being operable to perform the method of claim 1.

14. Computer software embodied in a propagated signal for certificate provisioning, the computer software comprising instructions to cause a computer system to perform the method of claim 1.

15. A system for certificate provisioning, comprising:

at least one computer comprising;

a system for generating a keypair and a self-signed certificate;

a system for requesting a certificate from a certification authority;

a system for temporarily securing email using the self-signed certificate; and

a system for securing email using the requested certificate, after receipt of the requested certificate from the certification authority.

16. The system of claim 15, wherein the system for generating, system for requesting, and system for securing operate automatically in response to a starting of a client system.

17. The system of claim 15, further comprising:

wherein the system for generating, system for requesting, and system for securing operate automatically in response to a user attempting to send secure email.

18. The system of claim 15, wherein the request for the certificate is explicitly initiated by a user.

19. The system of claim 15, wherein the system for temporarily securing email using the self-signed certificate secures email for a predetermined period of time.

20. The system of claim 19, wherein the predetermined period of time corresponds to an expected length of time required to receive the requested certificate from the certification authority.

21. The system of claim 19, wherein the predetermined period of time is set by an administrative policy.

22. The system of claim 15, further comprising:

a system for determining when the certificate is to be requested from the certification authority, based on an administrative policy.

23. The system of claim 15, further comprising:

a system for receiving an email secured using the self-signed certificate.

24. The system of claim 23, further comprising:

a system for determining if the self-signed certificate in the received email is trusted; and

a system for verifying a signature associated with the self-signed certificate if it is determined that the self-signed certificate is trusted.

25. The system of claim 23, further comprising:

a system for selectively marking the self-signed certificate as trusted for a period of time defined by an administrative policy.

26. The system of claim 23, farther comprising:

a system for receiving an email secured using the certificate received from the certification authority;

a system for determining if the self-signed certificate and the certificate received from the certification authority are associated with a same key; and

a system for purging the self signed certificate if the self-signed certificate and the certificate received from the certification authority are associated with the same key.

27. A program product stored on a computer recordable medium for certificate provisioning, the computer readable medium comprising program code, which when executed by a computer, performs the following steps:

generating a keypair and a self-signed certificate;

requesting a certificate from a certification authority;

temporarily securing email using the self-signed certificate; and

securing email using the requested certificate, after receipt of the requested certificate from the certification authority.