Electrical computers and digital processing systems: support – System access control based on user identification by...
Reexamination Certificate
2001-08-07
2002-02-26
Peeso, Thomas R. (Department: 2132)
Electrical computers and digital processing systems: support
System access control based on user identification by...
C713S164000, C713S165000, C713S168000
Reexamination Certificate
active
06351812
ABSTRACT:
TECHNICAL FIELD
This invention relates to a technique for verifying the authenticity of participants engaging in electronic commerce.
BACKGROUND ART
Today, individuals, businesses, and other organizations conduct an ever-increasing amount of commerce electronically either via private interconnected networks, (“intranets”) or via a public interconnected network such as the Internet. For example, many businesses now exchange all types of documents, such as purchase orders, memorandums, contracts, and request for proposals, for example with other businesses and organizations. Many individuals, businesses, and organizations now purchase and sell all types of goods and services electronically. Indeed, some businesses sell exclusively over the Internet and maintain no retail place of business at all.
In most instances, authentication of an individual, or that individual's computer terminal, must occur before that individual can engage in commerce. The manner of authentication depends on the type of encryption used to protect transmitted data. Typically, most electronic commerce relies on public key/private key encryption. Generally, senders encrypt data with a symmetric key and then encrypt the symmetric key with the recipient's public key and send it with a document. Electronic certificates have emerged as the standard method of authenticating an individual's public key. In fact, the International Telecommunications Union (ITU) has established Standard X.509 for such electronic certificates and most individual web browsers and network servers support that standard. Entities, known as Certificate Authorities (CAs) exist to create and distribute such electronic certificates.
Despite the existence of an ITU standard for electronic certificates, problems remain that have impeded the use of such certificates to facilitate electronic commerce. One such problem is verifying that a presented certificate has not been revoked. For example, certificate revocation may occur as the result from compromise of an associated private key. Alternatively, an individual might change his or her public key. In practice, CAs maintain a local record of revoked certificates and periodically generate and publish from these local records lists of revoked certificates, known as Certificate Revocation Lists (CRLs), that report a snapshot of which certificates have been revoked.
The revocation status of a certificate is hereinafter referred to as the certificate's “validity.” The process for determining the revocation status of a particular certificate will hereinafter be referred to as “validating” the certificate. There are two approaches employed to validate a certificate. The first approach is to search through the current CRL(s) during certificate verification operation. This approach has the following shortcomings:
1
. The CA must deliver a copy of each revision of the CRL to every secure application
2
. These redundant copies of CRL must be cached by every secure application
3
. Applications that do not have a facility for caching the CRL will need to request the entire CRL during each certificate validation process
4
. Each application is burdened with searching through the CRL list during every certificate verification operation
5
. Applications must acquire entire CRL in order to verify a single certificate's status
6
. CRLs become outdated and can therefore be inaccurate
7
. Determination that a particular certificate is not on the current CRL may lead an inquiring party to conclude that the certificate in question is valid, when in fact, no certificate exists.
Another approach to certificate validation is to undertake a Real-time inquiry of the CA or a Certificate Status server. This approach, for which an implementation protocol as been proposed (Internet draft X.509 Internet Public Key Infrastructure—Online Certificate Status Protocol—OCSP), has the following shortcomings:
1
. Real-time access of the CA/Certificate Status Server does not afford scalability
2
. This approach is very expensive in terms of network resources
3
. Real time CA/Certificate Status Server inquiry inserts network latency into every certificate verification operation
4
. The CA/Certificate Status Server must participate in every certificate verification operation.
5
. This approach does not allow applications to implement any application-appropriate policy with respect to the required freshness of the certificate status information
6
. Each application must execute an inquiry to the CA for the status of that certificate upon presentation to each different application, potentially resulting in the CA answering the same inquiry repeatedly.
In recognition of the scalability shortcomings of the second (real-time query) approach, an extension to the OCSP proposal has been submitted as another internet draft (Internet Public Key Infrastructure—Caching the Online Certificate Status Protocol) to remedy such shortcomings. The Internet draft proposes a mechanism for caching certificate status responses issued by certificate status authorities in intermediate servers so the primary certificate status server does not have to respond directly to every request. Even as modified with the intermediate server caching mechanism, the real-time query approach still suffers from the following shortcomings:
1
. This approach requires deployment of intermediate servers
2
. Use of intermediate servers is very expensive in terms of network bandwidth
3
. Use of intermediate servers does not allow applications to implement application-appropriate policy with respect to the required freshness of the certificate status information
4
. As a certificate is presented to different applications during the course of a day, each application must execute an inquiry to some certificate status server (intermediate of primary) for the status of that certificate, resulting in those servers answering the same inquiry repeatedly.
To avoid the problems associated with of the delay in updating certificate validation, some Certificate authorities have experimented with issuing short-lived certificates that cannot be revoked. All certificates that comply with the X509v3 standard have a validity period that defines both the start and end of a certificates period of validity. By choosing a very short period, a CA can issue a certificate that will likely not be revoked prior to expiration. This approach incurs the following disadvantages:
1
. Frequent certificate re-issuance imposes a burden on the CA, the network, and the users
2
. An application may be unable to determine if a certificate is no longer valid. (Applications must assume that certificates that have not expired are still valid.)
3
. This approach does not address the issue of non-existent certificates.
Thus, there is a need for a technique for authenticating participants in electronic commerce that overcomes the aforementioned disadvantages of the standard approaches to certificate status verification. In particular, there is a need to overcome the shortcomings of real-time query of the CA which are (1) very expensive in terms of network resources, (2) insertion of network latency in every certificate validation operation and (3) involvement of the CA in each validation operation. There is also a need to overcome the disadvantages of acquiring, caching and searching each CRL, which are (1) requiring redundant CRL copies cached with each resource, and (2) burdening each server with searching through the CRL during each certificate validation operation.
BRIEF SUMMARY OF THE INVENTION
Briefly, the present invention provides a method for conveying to an application during the authentication process, revocation status information regarding an electronic commerce participant's authentication certificate that overcomes the aforementioned shortcomings of the current art. The invention improves on present art by relying on participants to obtain, cache, and deliver the status information to applications through a process that allows applications to enforce application-appropriate policy re
Datar Rajendra
Hurley Daniel F.
Prasad Vishwa
West Earle H.
AT&T Corp
Levy Robert B.
Peeso Thomas R.
LandOfFree
Method and apparatus for authenticating participants in... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Method and apparatus for authenticating participants in..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method and apparatus for authenticating participants in... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2967078