US5745574A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Security infrastructure for electronic transactions
Assignee: Intellectual Ventures II LLC
•
Filing: 1995-12-15
•
Granted: 1998-04-28
•
Expires: 2015-12-15
Abstract
Abstract A plurality of certification authorities connected by an open network are interrelated through an authentication and certification system for providing and managing public key certificates. The certification system with its multiple certification and its policies constitute a public key infrastructure facilitating secure and authentic transactions over an unsecure network. Security services for applications and users in the network are facilitated by a set of common certification functions accessible by well-defined application programming interface which allows applications to be developed independently of the type of underlying hardware platforms used, communication networks and protocols and security technologies.
Inventors
- 👤 Sead Muftic
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 22:03
CPC Classifications
H; H04; H04L; H04L9/00; H04L9/32; H04L9/3263; H04L9/3268; H04L9/006; H04L9/007; H04L2209/00; H04L2209/34; H04L2209/56
Claims Analysis
Total Claims: 42
Claim 1
Independent Claim
180 words
A certification system for issuance, distribution and verification of public key certificates which may be used for secure and authentic electronic transactions over open networks, comprising computer processes implementing certification servers, certification clients and certification protocols, in which: a. one or more first computer processes are associated with at least one initial (root) registration authority, b. one or more second computer processes are associated with policy certification authorities, c. one or more third computer processes are associated with certification authorities, and d. one or more end-user computer processes or application computer processes are associated with respective end-users or user applications, and e. said one or more second computer processes hold a data structure certified by said registration authority, said one or more third computer processes hold a data structure certified either by one of said policy certification authorities or other certification authorities, and end-user or application computer processes hold a data structure certified by one or more of said certification authorities, whereby users and applications of said system are logically located at end-points of certification chains in a certification infrastructure.
Claim 2
Dependent Claim
180 words
A certification system for issuance, distribution and verification of public key certificates which may be used for secure and authentic electronic transactions over open networks, comprising computer processes implementing certification servers, certification clients and certification protocols, in which: a. one or more first computer processes are associated with at least one initial (root) registration authority, b. one or more second computer processes are associated with policy certification authorities, c. one or more third computer processes are associated with certification authorities, and d. one or more end-user computer processes or application computer processes are associated with respective end-users or user applications, and e. said one or more second computer processes hold a data structure certified by said registration authority, said one or more third computer processes hold a data structure certified either by one of said policy certification authorities or other certification authorities, and end-user or application computer processes hold a data structure certified by one or more of said certification authorities, whereby users and applications of said system are logically located at end-points of certification chains in a certification infrastructure.
Claim 3
Dependent Claim
19 words
The system of claim 1 in which some of said certification authorities may also function as Trusted Third Parties.
Claim 4
Dependent Claim
18 words
The system of claim 1 in which some of said certification authorities may also function as Escrow Agencies.
Claim 5
Dependent Claim
25 words
The system of claim 1 in which some of said certification authorities may also function as a clearing house for or insurer of electronic transactions.
Claim 6
Dependent Claim
18 words
The system of claim 1 in which some of said certification authorities may also function as Electronic Notaries.
Claim 7
Dependent Claim
26 words
The system of claim 1 in which some of said certification authorities may also function as common repositories for electronic identities and public key certificates (Directories).
Claim 8
Dependent Claim
32 words
The repository systems of claim 6 in which said common repositories may hold electronic identities and/or public key certificates of other certification authorities, users, applications and other components in the certification system.
Claim 9
Dependent Claim
28 words
The repository systems of claim 6 in which said common certificate repositories may also hold certificate revocation lists for a plurality of computer processes in the certification system.
Claim 10
Dependent Claim
32 words
The certification system of claim 1 in which one or more computer processes may access a storage area for storing various identification, authentication and authorization data structures, certificates and certificate revocation lists.
Claim 11
Dependent Claim
35 words
The system of claim 1 in which one or more computer processes of the certification system may access storage areas for storing or fetching network configuration information, error codes and messages, or entity identification information.
Claim 12
Dependent Claim
21 words
The certification system of claim 1 in which said data structures may be electronic addresses, electronic identities or public key certificates.
Claim 13
Dependent Claim
36 words
The certification system of claim 1 in which each computer process may utilize a common application programming interface (API) either for remote access to that process or for access to encryption, certification and other local services.
Claim 14
Dependent Claim
27 words
The certification system of claim 12 in which each computer process utilizes said common application programming interface comprising a set of programming primitives implementing certification protocol steps.
Claim 15
Dependent Claim
37 words
The set of programming primitives of claim 13 in which one or more members of the set can be invoked by commands, by messages, by remote procedure calls or by any other type of computer procedure invocations.
Claim 16
Dependent Claim
18 words
The API system of claim 12 in which the applications programming interfaces may be invoked by http commands.
Claim 17
Dependent Claim
18 words
The API system of claim 12 in which the applications programming interfaces may be invoked by E-mail messages.
Claim 18
Dependent Claim
21 words
The API system of claim 12 in which the applications programming interfaces may be invoked by a program to program communication.
Claim 19
Dependent Claim
107 words
In a certification system for secure communications containing computer processes arranged in a certification infrastructure, a method of requesting and issuing a public key certificate, comprising: a. at a requesting computer process, generating a data structure containing the data items required for a public key certificate, including a public key, self-signing the data structure and sending the signed data structure as a certificate signature request to a computer process authorized as an issuing certification authority, and b. at said computer process authorized as an issuing certification authority, verifying the authenticity of said request, and if authentic, certifying and returning the data structure in a certificate signature reply.
Claim 20
Dependent Claim
107 words
In a certification system for secure communications containing computer processes arranged in a certification infrastructure, a method of requesting and issuing a public key certificate, comprising: a. at a requesting computer process, generating a data structure containing the data items required for a public key certificate, including a public key, self-signing the data structure and sending the signed data structure as a certificate signature request to a computer process authorized as an issuing certification authority, and b. at said computer process authorized as an issuing certification authority, verifying the authenticity of said request, and if authentic, certifying and returning the data structure in a certificate signature reply.
Claim 21
Dependent Claim
17 words
The method of claim 18, further comprising: storing the received signed certificate at said requesting computer process.
Claim 22
Dependent Claim
23 words
The method of claim 18 further comprising: storing the received signed certificate or copy of a signed certificate at a common certificate repository.
Claim 23
Dependent Claim
27 words
The method of claim 18 performed when adding a new entity to a certification infrastructure, which entity may be policy certification authority, certification authority, application or end-user.
Claim 24
Dependent Claim
26 words
The method of claim 18, performed upon expiration of an existing certificate, where the new certificate may contain either the existing or a new public key.
Claim 25
Dependent Claim
71 words
In a global network with secure communications containing computer processes arranged in a certification infrastructure, a method of verifying a signed data structure sent from a sender to a receiver, comprising: a. obtaining a public key certificate for every computer process in the infrastructure between the sender and a common point of trust in the infrastructure and, b. verifying the authenticity of signatures iteratively, beginning with the common point of trust.
Claim 26
Dependent Claim
71 words
In a global network with secure communications containing computer processes arranged in a certification infrastructure, a method of verifying a signed data structure sent from a sender to a receiver, comprising: a. obtaining a public key certificate for every computer process in the infrastructure between the sender and a common point of trust in the infrastructure and, b. verifying the authenticity of signatures iteratively, beginning with the common point of trust.
Claim 27
Dependent Claim
38 words
The method of verifying of claim 23 in which a public key certificate for every computer process in the infrastructure between the sender and a common point of trust is also verified against all relevant certificate revocation lists.
Claim 28
Dependent Claim
32 words
The method of verifying of claim 23 in which a public key certificate of a sender may also be verified by a direct inquiry to the certification authority which issued that certificate.
Claim 29
Dependent Claim
37 words
The method of verifying of claim 23 in which a public key certificate for every computer process in the infrastructure between the sender and a common point of trust may be obtained from respective individual computer processes.
Claim 30
Dependent Claim
28 words
The method of verifying of claim 23 in which a public key certificate for every computer process in the infrastructure may also be obtained from a common repository.
Claim 31
Dependent Claim
79 words
In a certification system for secure communications containing computer processes arranged in a certification infrastructure, a method of validating public key certificates comprising: using the certificate revocation lists of each computer process between a computer process or user whose certificate is being validated and a point of trust in common with the computer process or user which is validating the certificate to ensure the certificates being used in the validation process do not appear on any certificate revocation list.
Claim 32
Dependent Claim
79 words
In a certification system for secure communications containing computer processes arranged in a certification infrastructure, a method of validating public key certificates comprising: using the certificate revocation lists of each computer process between a computer process or user whose certificate is being validated and a point of trust in common with the computer process or user which is validating the certificate to ensure the certificates being used in the validation process do not appear on any certificate revocation list.
Claim 33
Dependent Claim
24 words
The method of claim 28 in which retrieved certificate revocation lists are stored locally in the computer at which the certificate is being validated.
Claim 34
Dependent Claim
146 words
In a computer system for secure communications containing computer processes arranged in a certification infrastructure, a method of updating certificates comprising: a. at a first computer process, which possesses a certificates to be updated, updating the current certificate by a.1. receiving a new signed certificate from a computer process which is authorized to issue the new signed certificate, a.2. revoking the current certificate previously used for verification of certificates of subordinate computer processes, a.3. issuing new certificates to all subordinate computer processes for which certificates had been previously signed by the first computer process and copying to all subordinate computer processes the new certificate to be used for verification of new subordinate certificates, and b. iteratively performing the distribution of the new certificate to all subsequent subordinate computer processes, until all computer processes subordinate in the infrastructure to said first computer process have the new certificates.
Claim 35
Dependent Claim
146 words
In a computer system for secure communications containing computer processes arranged in a certification infrastructure, a method of updating certificates comprising: a. at a first computer process, which possesses a certificates to be updated, updating the current certificate by a.1. receiving a new signed certificate from a computer process which is authorized to issue the new signed certificate, a.2. revoking the current certificate previously used for verification of certificates of subordinate computer processes, a.3. issuing new certificates to all subordinate computer processes for which certificates had been previously signed by the first computer process and copying to all subordinate computer processes the new certificate to be used for verification of new subordinate certificates, and b. iteratively performing the distribution of the new certificate to all subsequent subordinate computer processes, until all computer processes subordinate in the infrastructure to said first computer process have the new certificates.
Claim 36
Dependent Claim
111 words
In a certification system for secure communications containing computer processes arranged in a certification infrastructure, a method of adding a new computer process to the infrastructure comprising: a. adding a new component to a representation of a certification infrastructure at a location indicative of where the said computer process is to be added, b. creating entries in a certificate storage database at least at both said new computer process and at the computer process authorized to certify the said new process, c. obtaining a signed certificate for the said new computer process from said computer process authorized to certify the new process and storing it at the said new computer process.
Claim 37
Dependent Claim
111 words
In a certification system for secure communications containing computer processes arranged in a certification infrastructure, a method of adding a new computer process to the infrastructure comprising: a. adding a new component to a representation of a certification infrastructure at a location indicative of where the said computer process is to be added, b. creating entries in a certificate storage database at least at both said new computer process and at the computer process authorized to certify the said new process, c. obtaining a signed certificate for the said new computer process from said computer process authorized to certify the new process and storing it at the said new computer process.
Claim 38
Dependent Claim
107 words
In a certification system for secure communications containing computer processes arranged in a certification infrastructure, a method of deleting an existing computer process from the infrastructure comprising: a. notifying at least all computer processes certified by the existing process being deleted that said existing computer process is being deleted, b. revoking all certificates signed by said first computer process at said computer processes certified by the existing process being deleted, if any; c. obtain new certificates for each computer process previously being certified by the said existing computer process being deleted from another certification authority being authorized to certify these computer processes in the new certification infrastructure.
Claim 39
Dependent Claim
107 words
In a certification system for secure communications containing computer processes arranged in a certification infrastructure, a method of deleting an existing computer process from the infrastructure comprising: a. notifying at least all computer processes certified by the existing process being deleted that said existing computer process is being deleted, b. revoking all certificates signed by said first computer process at said computer processes certified by the existing process being deleted, if any; c. obtain new certificates for each computer process previously being certified by the said existing computer process being deleted from another certification authority being authorized to certify these computer processes in the new certification infrastructure.
Claim 40
Dependent Claim
16 words
The method of claim 32 further comprising: adding all certificates revoked to a certificate revocation list.
Claim 41
Dependent Claim
56 words
In a certification system for secure communications containing computer processes arranged in a certification infrastructure, a method of restructuring at least part of the certification infrastructure by deleting one or more certification authorities and adding said one or more certification authorities or new certification authorities so as to derive a modified form of the certification infrastructure.
Claim 42
Dependent Claim
56 words
In a certification system for secure communications containing computer processes arranged in a certification infrastructure, a method of restructuring at least part of the certification infrastructure by deleting one or more certification authorities and adding said one or more certification authorities or new certification authorities so as to derive a modified form of the certification infrastructure.
References Cited (Backward Citations)
US4200770A
Cited
US4218582A
Cited
US4405829A
Cited
US4424414A
Cited
US4562305A
Cited
US5214702A
Cited
US4995082A
Cited
US5347580A
Cited
US5497421A
Cited
US5369705A
Cited
US5420927A
Cited
US5420927B1
Cited
US5509071A
Cited
US5606617A
Cited
US5604804A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-04-27 | 2001-10-27 | 2002-04-28 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-04-27 | 2005-10-27 | 2006-04-28 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-04-27 | 2009-10-27 | 2010-04-28 | $7700.00 | Window Closed / Lapsed |