System and method for generating a digital certificate

• US 7,698,557 B2
• Filed: 12/07/2004
• Issued: 04/13/2010
• Est. Priority Date: 12/22/2003
• Status: Active Grant

• Current Assignee: Guardtime SA
• Original Assignee: Guardtime SA
• Inventors: Buldas, Ahto, Saarepera, Mart
• Primary Examiner(s): Vu; Kimyen
• Assistant Examiner(s): Paliwal; Yogesh
• Application Number:
  US11/005,838
• Publication Number:
  US 20050138361A1
• Time in Patent Office: 1,953 Days
• Field of Search: 713/168
• US Class Current: 713/175
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A system and method for generating a digital certificate is provided wherein a new digital record is received and is assigned a sequence value. A first composite digital value is generated by applying a first deterministic function to the digital records stored in a repository. The sequence value and first composite digital value are included in a first certificate. After the digital record is added to the repository, a second composite digital value is generated by applying a second deterministic function to the digital records in the repository. This second composite digital value, and a composite sequence value, are published. An interval digital value which is based upon the first and second composite digital values, and the sequence value, are included in a second certificate which thus verifies the authenticity and sequence value of the digital record.

Claims

1. A method for generating a digital certificate, comprising the steps of:

providing for receiving a new digital record at a service provider computer from a second computer;

providing for assigning a sequence value to the new digital record at the service provider computer, and storing data including digital records and hash values in a repository;

providing for generating a first composite digital value by applying a first function to a first plurality of the data stored in the repository, wherein the first function computes a set of root values for a non-connected binary hash forest;

providing for generating a first digital certificate, wherein the first digital certificate comprises at least the sequence value and the first composite digital value;

providing for adding the new digital record to the repository;

providing for generating a sequence of hash values and storing the sequence of hash values in the repository, by applying a second function to a second plurality of the data stored in the repository, wherein the second plurality of the data includes the new digital record, and wherein the second function computes the non-connected binary hash forest;

providing for generating a composite sequence value;

providing for generating a second composite digital value by applying a third function to a third plurality of the data stored in the repository;

providing for generating an interval digital value by applying a fourth function to a fourth plurality of the data stored in the repository, wherein the interval digital value is based upon the sequence value and the composite sequence value; and

,

providing for generating a second digital certificate, wherein the second digital certificate comprises at least the sequence value and the interval digital value.

2. The method of claim 1, wherein the sequence value is representative of the order in which the new digital record was received.

3. The method of claim 1, further comprising the step of:

applying a digital signature to the first digital certificate.

4. The method of claim 3, wherein the first digital certificate is generated using an asymmetric cryptographic algorithm.

5. The method of claim 1, wherein the step of generating the first composite digital value is performed by applying the first function to all of the digital records stored in the repository.

6. The method of claim 1, wherein the first and third functions are not the same functions.

7. The method of claim 1, wherein the first and third functions are the same functions.

8. The method of claim 1, wherein the step of generating the second composite digital value is performed by applying the third function to all of the digital records stored in the repository.

9. The method of claim 1, wherein the first digital certificate further comprises the new digital record.

10. The method of claim 1, wherein the second digital certificate further comprises at least one of:

the new digital record and the composite sequence value.

11. The method of claim 1, wherein the computer repository of digital records comprises a data structure of non-connected binary hash forest.

12. The method of claim 1, further comprising the step of:

transmitting the second composite digital value to a public forum computer.

13. The method of claim 1, further comprising the step of:

transmitting the composite sequence value to a public forum computer.

14. The method of claim 1, wherein the step of generating the first composite digital value is performed before the step of generating the second composite digital value.

15. A method for generating a plurality of digital certificates, comprising the steps of:

providing for receiving a new digital record at a service provider computer from a second computer;

providing for assigning a sequence value to the new digital record at the service provider computer, wherein the sequence value represents the order in which the new digital record was received;

providing for generating a first composite digital value by applying a first deterministic function having a hash function component to all digital records stored in a repository, wherein the new digital record is not stored in the service provider computer repository when the first deterministic function is applied, and wherein the first deterministic function computes at least one root hash value for a non-connected binary hash forest;

providing for generating a first digital certificate, wherein the first digital certificate comprises the sequence value, the first composite digital value, and the new digital record;

providing for applying a digital signature to the first digital certificate, wherein the digital signature is applied using an asymmetric cryptographic algorithm;

providing for adding the new digital record to the repository, and applying a second deterministic function having a hash function component to all of the digital records stored in the repository;

providing for generating a second composite digital value by applying a third deterministic function having a hash function component to all of the digital records stored in the repository;

providing for generating a composite sequence value, wherein the composite sequence value is equal to the number of digital records stored in the service provider computer repository when the second composite digital value is generated;

providing for generating an interval digital value, wherein the interval digital value is generated by the application of a fourth deterministic function having a hash function component to a plurality of the data stored in the repository; and

,

providing for generating a second digital certificate, wherein the second digital certificate comprises at least the sequence value, the new digital record, the composite sequence value, and the interval digital value.