Digital certificate cross-referencing

Details Digital certificate cross-referencing Digital certificate cross-referencing

1998-06-30

2003-09-02

Hayes, Gail (Department: 2131)

Electrical computers and digital processing systems: support

Multiple computer communication using cryptography

Central trusted authority provides computer authentication

C713S157000, C713S158000

Reexamination Certificate

active

06615347

ABSTRACT:

BACKGROUND OF THE INVENTION
1. Technical Field
This invention relates generally to digital certificates issued by a certification authority, digital signatures, and public key cryptography, all of which are part of a security infrastructure for on-line transactions. More particularly, this invention relates to the cross-referencing of such digital certificates.
2. Background Art
As a result of the continuous development of new technologies, particularly in the areas of computer networks and communications, the use of large computer networks, such as the Internet, is becoming more widespread. This has resulted in an increase in electronic commerce and other electronic transactions conducted over these networks, with a corresponding need for security for these transactions.
Public key cryptography, as described in Bruce Schneier,
Applied Cryptography
(John Wiley & Sons, Inc., New York, 1996), is one technology addressing this need for security. A public key infrastructure (PKI) is based on assigning key pairs to entities. Each key pair includes a private key and a public key. Either key may be used to encrypt a message; the other key must be used to decrypt the message. The private key is securely held by the entity to which it is assigned; while the public key is made widely available.
The use of these key pairs addresses many of the inherent security problems in an open network such as the Internet. However, without more, two significant problems remain. First, parties must be able to access the public keys in an efficient manner. Second, since communications and transactions are secured by the key pairs and entities are associated with and in some sense identified by their public keys, there must be a secure method for third parties to verify that a certain public key corresponds to a certain entity.
Digital certificates are one method for addressing both of these problems. A trusted third party, commonly known as a certification authority or issuer, issues digital certificates to subscribers. Each digital certificate typically includes the subscriber's public key along with other information about the subscriber. One purpose of the digital certificate is to document in a trustworthy manner that the public key is associated with the subscriber. In other words, the digital certificate “binds” the subscriber to the public key. The trustworthiness is typically provided by having the issuer of the digital certificate “digitally sign” the certificate, thereby securing its contents against subsequent tampering. Third parties who wish to verify that a certain public key corresponds to a certain subscriber may do so by examining the corresponding digital certificate.
For security and other reasons, digital certificates typically are valid only for a limited period of time. For example, when digital certificates are issued, they typically have an expiration date after which they are no longer valid. Alternately, a digital certificate may be compromised prior to its expiration date, in which case, the issuer may actively revoke the digital certificate. In these and other cases, the subscriber must obtain a new digital certificate to replace the old digital certificate and, over any significant period of time, a subscriber will likely have had an entire series of digital certificates.
It is often desirable to be able to efficiently determine the relationship between two digital certificates, particularly if one digital certificate is a replacement for the other. For example, an on-line merchant may have accumulated significant amounts of information about a specific subscriber, who is identified primarily by his public key and the corresponding digital certificate. If this digital certificate is replaced by a new digital certificate, it would be desirable for the merchant to ascertain this so that he may associate the accumulated information with the new digital certificate.
Thus, there is a need for cross-referencing of digital certificates.
DISCLOSURE OF INVENTION
One aspect of the present invention is a computer readable medium (
120
) storing a first digital certificate (
200
). The first digital certificate (
200
) is issued by a first certification authority (
104
) to a first subscriber (
102
), binds the first subscriber (
102
) to a first public key (
210
), and is digitally signed by the first certification authority (
104
). The first digital certificate (
200
) includes subscriber information (
206
) pertaining to the first subscriber (
102
) and related certificate information (
216
) at least partially identifying a second digital certificate (
200
). The second digital certificate (
200
) is issued by a second certification authority (
104
) to a second subscriber (
102
), binds the second subscriber (
102
) to a second public key (
210
), and is digitally signed by the second certification authority (
104
). The first subscriber (
102
) is matched to the second subscriber (
102
).
Another aspect of the present invention is a method (
400
) for creating such a first digital certificate (
200
). A second digital certificate (
200
), the subscriber (
102
) of which matches the first subscriber (
102
), is identified (
402
). Subscriber information (
206
) pertaining to the first subscriber (
102
) and related certificate information (
216
) at least partially identifying the second digital certificate (
200
) are included (
404
) in the first digital certificate (
200
). The first digital certificate (
200
) is digitally signed by an issuer (
104
).
Another aspect of the invention is a method (
600
,
700
) for processing such first digital certificates (
200
). The first digital certificate (
200
) is authenticated (
602
,
702
). The first digital certificate (
200
) includes related certificate information (
216
) at least partially identifying a second digital certificate (
200
) with a matching subscriber. Based on this related certificate information (
216
), a status of the second digital certificate (
200
) is determined (
606
,
706
). The first digital certificate (
200
) is then processed (
608
,
708
) responsive to the status of the second digital certificate (
200
).
The present invention is particularly advantageous because information (
216
) concerning related digital certificates (
200
) is securely recorded on the digital certificate (
200
) itself. Hence, users (
108
) of the digital certificate (
200
) can determine the relationship of the digital certificate (
200
) to the other digital certificates (
200
) and can tailor their actions accordingly.


REFERENCES:
patent: 4868877 (1989-09-01), Fischer
patent: 5136646 (1992-08-01), Haber et al.
patent: 5214702 (1993-05-01), Fischer
patent: 5666416 (1997-09-01), Micali
patent: 5699431 (1997-12-01), Van Oorschot et al.
patent: 5745574 (1998-04-01), Muftic
patent: 5903882 (1999-05-01), Asay et al.
patent: 5956404 (1999-09-01), Schneier et al.
ITU-T Recommendation X.509, Telecommunication Standardization Sector of ITU, Nov. 1993.*
RSA Data Security, Inc., PKCS#6: Extended-Certificate Syntax Standard, RSA Security, Jun. 3, 1991, entire document.*
RSA Data Security, Inc., PKCS#9: Selected Attribute Types, RSA Security, Nov. 1, 1993, entire document.*
ISO/IEC et al, Draft Amendments DAM 4 to ISO/IEC 9594-2 on Certificate Extensions, Collaborative Editing Meeting on the Directory, Geneva, Apr. 1996, all.*
Wayner, Peter, Who Goes There?, BYTE Magazine, Jun. 1997, all.

Affiliated with

Also associated with

Rating

Digital certificate cross-referencing does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Digital certificate cross-referencing, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Digital certificate cross-referencing will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3027334