Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Central trusted authority provides computer authentication
Reexamination Certificate
1998-12-22
2002-08-06
Peeso, Thomas R. (Department: 2132)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Central trusted authority provides computer authentication
C713S161000, C713S175000, C380S277000, C380S278000
Reexamination Certificate
active
06430688
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Field of the Invention
The present invention relates to systems and methods for securing transmission and receipt of electronic data, and in particular to a method and system providing a web-based digital certificate authority.
2. Description of the Related Art
In recent years, the use of the internet and other electronic communication and message transfer methods have become widespread. While these communication methods have numerous advantages, they are vulnerable to unauthorized tampering. Persons transmitting electronic messages must be assured that their messages are not opened or disclosed to unauthorized persons. Further, the addressee of the electronic message should be certain of the identity of the sender and that the message was not tampered with at some point during transmission. Many methods have been developed to secure the integrity of electronic messages during transmission. Simple encryption is the most common method of securing data. Both secret key encryption such as DES (Data Encryption Standard) and public key encryption methods which use both a public and a private key are implemented.
Although public and private key encryption methods allow users to send internet and e-mail messages without concern that the message will be read by unauthorized persons or that its contents will be tampered with, key cryptographic methods alone do not protect the receiver of the message. That is, they do not allow the recipient to authenticate the validity of the public key or to validate the identity of the sender of the electronic message.
One method for validating the authenticity of a public key is the use of digital certificates. A digital certificate is a signed document attesting to the identity and public key of the person signing the message. Digital certificates prevent impersonation using a phony key pair.
Digital certificates are issued by a digital certificate authority (CA). Certificate authorities typically run in a trustworthy manner and are highly secure. Consequently, although they provide a high degree of security, they are difficult and expensive to implement, and are therefore unsuitable for widespread application, particularly where near-bulletproof security is not necessary or desired. Consider, for example, a driver's license and an auto club card. Both are analogous to a “certificate” in the sense that they certify to a certain extent that the person in possession of the card is who they say they are. The driver's license is issued by a trusted “certificate authority” (the state department of motor vehicles), and is therefore globally accepted (by the issuing CA and all instances that trust the issuing CA) as a genuine indication of the bearer's identity. The auto club card is issued by a “local” certificate authority (the auto club itself), and is not globally accepted as a genuine indication of the bearer's identity and his attributes (i.e. gold membership). However, for the auto club's purposes, it is sufficient to show that the bearer has paid for the auto club's services, and from the auto-club's perspective, is adequate to permit transactions between the bearer and the club.
Digital libraries and other vendors who could benefit from the user of digital certificates are currently faced with the choice of either using a third party CA's services or developing their own CA. Using a third party CA minimizes development costs, but does not allow the vendor to customize the CA to meet its particular requirements. Also, third party CAs generally provide much more security and overhead than is desired or needed, and at a higher cost. Vendors may develop their own CA with certificate toolkits, but the vendor must program everything on its own, and this can be a daunting and expensive task for most. What is needed is a digital certificate authority that provides a less trusted, but more easily implemented indication of identity, and one which allows for easy vendor customization. The present invention satisfies that need.
SUMMARY OF THE INVENTION
To address the requirements described above, the present invention discloses a method, apparatus, and article of manufacture for issuing digital certificates.
The method comprises the steps of accepting a digital certificate request from a client in a web server, the digital certificate request comprising at least one client parameter, passing the client parameter to a user exit external to the servlet to determine if a digital certificate should be issued to the client, and if the external processing module indicates that the digital certificate should be issued to the client, transmitting the digital certificate to the client. The article of manufacture comprises a data storage device tangibly embodying instructions to perform the method steps described above.
The apparatus comprises means for accepting a digital certificate request with client parameters from a client in a web server, means for passing the client parameter to an external processing module to determine, among other things, if the digital certificate should be issued to the client, for creating certificates, and a means for transmitting the digital certificate to the client.
REFERENCES:
patent: 5606617 (1997-02-01), Brands
patent: 5671279 (1997-09-01), Elgamal
patent: 5729594 (1998-03-01), Klingman
patent: 5737419 (1998-04-01), Ganesan
patent: 5922074 (1999-07-01), Richard et al.
patent: 5978484 (1999-11-01), Apperson et al.
patent: 5982898 (1999-11-01), Hsu et al.
Bruno, L., “Banking on Trust,” Data Communications, vol. 27, No. 8, May 21, 1998, pp. 42-46, 48, and 50.
Kohl Ulrich W.
Xu Ling Elizabeth
Gates & Cooper LLP
International Business Machines - Corporation
Peeso Thomas R.
LandOfFree
Architecture for web-based on-line-off-line digital... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Architecture for web-based on-line-off-line digital..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Architecture for web-based on-line-off-line digital... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2913690