Electrical computers and digital processing systems: multicomput – Computer network managing – Computer network access regulating
Reexamination Certificate
2000-04-04
2004-11-09
Barot, Bharat (Department: 2155)
Electrical computers and digital processing systems: multicomput
Computer network managing
Computer network access regulating
C709S203000, C709S217000, C709S227000, C709S229000, C713S156000, C713S169000, C713S175000
Reexamination Certificate
active
06816900
ABSTRACT:
TECHNICAL FIELD
This invention relates to supporting secure network connections, and more particularly to updating trusted root certificates on a client computer.
BACKGROUND OF THE INVENTION
Computer technology is continually advancing, resulting in continually evolving uses for computers. One such use is with other computers over a network, such as the Internet, to obtain or exchange information, purchase or sell goods or services, etc. To assist in such communication, the Internet supports the “World Wide Web”, which is a collection of facilities that links together documents (each referred to as a “web page”). Web pages can be located on the same server or distributed among multiple servers worldwide.
The uses for the Internet and the World Wide Web are continually increasing, and have expanded into “secure” areas. Maintaining security in a large public network such as the Internet can be a difficult task. Different mechanisms for maintaining security have been developed, such as the Secure Sockets Layer (SSL) security protocol. The SSL protocol uses a public key infrastructure to maintain security. In establishing an SSL connection between a client computer and a server computer hosting a web page, the server computer transmits a certificate to the client computer for verification. If a trusted certifying authority has approved the server computer (or web page) for secure connections, then a root certificate that is maintained at the client and issued by a root certifying authority (CA) will verify the certificate received from the server.
Currently, many different certifying authorities exist and new certifying authorities are continually being established. The root certificates maintained at the client computer are typically included as part of an application, such as a web browser (which allows a user to access web pages) or an operating system. Problems arise with the use of root certificates because new certifying authorities are being established that would like to include new root certificates at the client computers, or existing certifying authorities may want to add new root certificates, after the application has been distributed to consumers. However, adding new root certificates to an application that has already been distributed to consumers can be a difficult and cumbersome process.
One solution to this problem is to re-distribute the application including the root certificates (e.g., a web browser or operating system) each time a new root certificate is to be added. However, this is cumbersome on both the application developer and distributors as well as the consumer because new versions would have to be continually distributed (e.g., changes in root certificates could occur as frequently as weekly or daily), and the consumer would be required to install each new version of the application. Such continual installation is burdensome on the consumer, particularly since the consumer may not actually use the new certificates.
Another solution to this problem is to require the user to manually install new root certificates. However, this solution is also burdensome on the consumer because the consumer is required to know that he or she needs a new certificate, as well as how to obtain such a certificate, verify the integrity of the certificate, and proceed with manually adding the certificate to his or her computer. Such manual installation is unlikely to be attempted, much less successful, by anyone except the most experienced users.
Thus, it would be beneficial to provide a more user-friendly way in which root certificates at a client computer can be updated. The updating of trusted root certificates on a client computer described below addresses these disadvantages, providing a more user-friendly approach to updating root certificates.
SUMMARY OF THE INVENTION
Updating trusted root certificates on a client computer is described herein. An update process is used to update the root certificates on the client computer, allowing the integrity of existing root certificates as well as any new root certificates to be maintained.
According to one aspect of the invention, a root certificate store on the client computer is updated by adding trusted root certificates to the store, removing root certificates from the store, or modifying usage restrictions of root certificates in the store. A cryptographically signed message including a certificate trust list, as well as any new root certificates to be added to the store, is accessed by an update root control to update the root certificates in the store. The certificate trust list includes a subject usage indication indicating that the certificates identified by the list are root certificates, and a set of one or more hash values that correspond to the root certificates being updated. The certificate trust list may also optionally include one or more hash attributes corresponding to the hash values. These hash attributes can indicate whether the root certificate corresponding to the hash value is to be added to the store, removed from the store, or what modifications are to be made to the root certificate in the store.
According to another aspect of the invention, during the update process the update root control obtains the cryptographically signed message and a signer certificate from the signer of the message. The control verifies the integrity of the message, and thus the integrity of the certificate trust list contained therein, by establishing a certificate chain from the signer certificate to a root certificate in the client's root certificate store. Once such integrity is verified, the update root control proceeds to update the root certificate store in accordance with the information in the certificate trust list. The update root control can further use the hash values in the certificate trust list to verify the integrity of root certificates in the signed message, as well as verify which root certificates in the root certificate store are to be removed or modified.
According to another aspect of the invention, root certificates in the client's root certificate store are updated when a World Wide Web web page is accessed by the client. A check is made during the access as to whether the client's root certificate store should be updated (e.g., a new root certificate is needed in order to access the web page). If the store should be updated, then the client is redirected to another web page that hosts the update root control. The update root control executes to update the client's certificate store, and then redirects the client back to the originally requested web page.
REFERENCES:
patent: 5717757 (1998-02-01), Micali
patent: 5949877 (1999-09-01), Traw et al.
patent: 6058484 (2000-05-01), Chapman et al.
patent: 6094485 (2000-07-01), Weinstein et al.
patent: 6128740 (2000-10-01), Curry et al.
patent: 6134550 (2000-10-01), Van Oorschot et al.
patent: 6134551 (2000-10-01), Aucsmith
patent: 6226743 (2001-05-01), Naor et al.
patent: 6301658 (2001-10-01), Koehler
patent: 6301659 (2001-10-01), Micali
patent: 6308277 (2001-10-01), Vaeth et al.
patent: 6367013 (2002-04-01), Bisbee et al.
patent: 6370249 (2002-04-01), Van Oorschot
patent: 6421781 (2002-07-01), Fox et al.
patent: 6430688 (2002-08-01), Kohl et al.
patent: 6438550 (2002-08-01), Doyle et al.
patent: 6442688 (2002-08-01), Moses et al.
patent: 6463534 (2002-10-01), Geiger et al.
patent: 6487658 (2002-11-01), Micali
patent: 6513116 (2003-01-01), Valente
patent: 6636975 (2003-10-01), Khidekel et al.
patent: 6671803 (2003-12-01), Pasieka
patent: 2001/0016877 (2001-08-01), Dancs et al.
patent: 2002/0152382 (2002-10-01), Xiao
“PKCS #7: Cryptographic Message Syntax Standard,” An RSA Laboratories Technical Note, Version 1.5, Revised Nov. 1, 1993, pp 1-30 (RSA Data Security, Inc. Public-Key Cryptography Standards (PKCS)).
Russell Housley, et al., “Internet X.509 Public Key Infrastructure Certificate and CRL Profile,” Standards Track, Jan. 1999, pp. 1-129.
“The AIS Login Mechanism” web pages—CERN—European Laboratory for Particle Physics, Administ
Chase Charlie D.
Hallin Philip J.
Thomas Louis K.
Vogel Keith R.
Yiu Kelvin S.
Barot Bharat
Lee & Hayes PLLC
Microsoft Corporation
LandOfFree
Updating trusted root certificates on a client computer does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Updating trusted root certificates on a client computer, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Updating trusted root certificates on a client computer will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3305173