US5922074A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method of and apparatus for providing secure distributed directory services and public key infrastructure
Assignee: Xcert Software Inc
•
Filing: 1997-02-28
•
Granted: 1999-07-13
•
Expires: 2017-02-28
Abstract
Abstract In an exemplary embodiment, the server receives the client's Distinguishing Name (DN), and then searches its directory for identification information and access control rights for this specific context. The server can act as a stand-alone server or in conjunction with other directory services on the network. A client must have a verifiable identity in order for secure communications to continue. A client's identity can be said to be fully verifiable if the server has access to the directory service that maintains that client's DN. The client receives the server's DN, and the client can then determine whether or not to accept a response to a request for information (i.e., trust the response). The client determines the identity of the server using some directory service (the client can act stand-alone or as a client of other directory servers). A server is fully verifiable if the client can identify the directory service that maintains the server's DN. In both cases, determining identity is predicated on being able to identify a directory service. Since servers and clients are issued identities (DN's) from some directory service before they participate in secure communications, they are able to at least identify their "home" directory service. Their "home" directory service communicates with other directory services, each "serving" their lists of electronic identities to each other using secure directory services. In this manner, a client or server can verify the peer identity of a secure communicator by relying on the trusted "home" directory service. Public Key certificates, certificate revocation lists, pending certificate requests, Certification Authority policy, and other information is stored in the directory server. Access to the directory server is through secure communications; this maintains the integrity and privacy of the information.
Inventors
- 👤 Patrick Richard
- 👤 Andrew Csinger
- 👤 Bruce Knipe
- 👤 Bruce Woodward
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-01 14:49
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; H; H04; H04L; H04L61/00; H04L61/45; H04L63/00; H04L63/04; H04L63/0428; H04L63/0442; H04L63/08; H04L63/0823; H04L63/10; H04L63/101; H04L63/102; H04L9/00; H04L9/40; G06F2211/00; G06F2211/007; G06F2211/008
Claims Analysis
Total Claims: 33
Claim 1
Independent Claim
149 words
A method for providing secure communications between a client at a first workstation and a computer, comprising the steps of: receiving at said computer, a request from said client for at least one of information and services, said request including at least one digital certificate identifying said client; checking at said computer to determine if the issuer of said digital certificate is recognized; verifying that said digital certificate is valid; retrieving, if the digital certificate is valid, an access control rule to apply to the communication session with said client during which at least one of information and services is provided to said client; applying said access control rule to the communications session; and wherein said computer includes a directory and wherein said step of applying said access control rules includes the step of permitting the client to access said directory only in accordance with said access control rules.
Claim 2
Independent Claim
149 words
A method for providing secure communications between a client at a first workstation and a computer, comprising the steps of: receiving at said computer, a request from said client for at least one of information and services, said request including at least one digital certificate identifying said client; checking at said computer to determine if the issuer of said digital certificate is recognized; verifying that said digital certificate is valid; retrieving, if the digital certificate is valid, an access control rule to apply to the communication session with said client during which at least one of information and services is provided to said client; applying said access control rule to the communications session; and wherein said computer includes a directory and wherein said step of applying said access control rules includes the step of permitting the client to access said directory only in accordance with said access control rules.
Claim 3
Independent Claim
138 words
A method for providing secure communications between a client at a first workstation and a computer, comprising the steps of: receiving at said computer a request from said client for at least one of information and services, said request uniquely identifying said client; checking at said computer to determine if the client is recognized by said computer; retrieving, if said client is recognized, an access control rule to apply to the communication session with said client during which at least one of information and services is provided to said client; and applying said access control rule to the communications session with said clients, wherein said computer includes a directory and wherein said step of applying said access control rules includes the step of permitting the client to access said directory only in accordance with said access control rules.
Claim 4
Independent Claim
138 words
A method for providing secure communications between a client at a first workstation and a computer, comprising the steps of: receiving at said computer a request from said client for at least one of information and services, said request uniquely identifying said client; checking at said computer to determine if the client is recognized by said computer; retrieving, if said client is recognized, an access control rule to apply to the communication session with said client during which at least one of information and services is provided to said client; and applying said access control rule to the communications session with said clients, wherein said computer includes a directory and wherein said step of applying said access control rules includes the step of permitting the client to access said directory only in accordance with said access control rules.
Claim 5
Independent Claim
140 words
A method for providing secure communications between a client at a first workstation and a computer, comprising the steps of: receiving, at said computer, a request from said client of at least one of information and services, said request including at least one digital certificate identifying said client; checking at said computer to determine if the digital signature in the digital certificate is valid; retrieving an access control rule to apply to the communication session with said client during which at least one of information and services is provided to said client; and applying said access control rule to the communications session with the client, wherein said computer includes a directory and wherein said step of applying said access control rules includes the step of permitting the client to access said directory only in accordance with said access control rules.
Claim 6
Independent Claim
140 words
A method for providing secure communications between a client at a first workstation and a computer, comprising the steps of: receiving, at said computer, a request from said client of at least one of information and services, said request including at least one digital certificate identifying said client; checking at said computer to determine if the digital signature in the digital certificate is valid; retrieving an access control rule to apply to the communication session with said client during which at least one of information and services is provided to said client; and applying said access control rule to the communications session with the client, wherein said computer includes a directory and wherein said step of applying said access control rules includes the step of permitting the client to access said directory only in accordance with said access control rules.
Claim 7
Independent Claim
163 words
A method for providing secure communications between a client at a first workstation coupled to a network including a plurality of computers, comprising the steps of: receiving at a first computer a request from said client for at least one of information and services, said request uniquely identifying said client; checking at said first computer to determine if the client is recognized; checking at a second computer coupled to said network, to determine if the client is recognized; retrieving from said second computer, if the client is recognized, an access control rule to apply to the communications session with said client during which at least one of information and services is provided to said client; and applying said access control rule to the communications session with said client, wherein said computer includes a directory and wherein said step of applying said access control rules includes the step of permitting the client to access said directory only in accordance with said access control rules.
Claim 8
Independent Claim
163 words
A method for providing secure communications between a client at a first workstation coupled to a network including a plurality of computers, comprising the steps of: receiving at a first computer a request from said client for at least one of information and services, said request uniquely identifying said client; checking at said first computer to determine if the client is recognized; checking at a second computer coupled to said network, to determine if the client is recognized; retrieving from said second computer, if the client is recognized, an access control rule to apply to the communications session with said client during which at least one of information and services is provided to said client; and applying said access control rule to the communications session with said client, wherein said computer includes a directory and wherein said step of applying said access control rules includes the step of permitting the client to access said directory only in accordance with said access control rules.
Claim 9
Independent Claim
111 words
A method for providing secure directory services communications between a client at a first workstation and a computer comprising the steps of: transmitting from a client's workstation a request for directory services to said computer for at least one of information and services, said request including digital information for uniquely establishing that said client has a known identity which can subsequently be unambiguously verified; checking to determine if the client is recognized by said computer; retrieving an access control rule to apply to the communication session with said client during which directory services is provided to said client; and applying said access control rule to the communications session with said client.
Claim 10
Independent Claim
111 words
A method for providing secure directory services communications between a client at a first workstation and a computer comprising the steps of: transmitting from a client's workstation a request for directory services to said computer for at least one of information and services, said request including digital information for uniquely establishing that said client has a known identity which can subsequently be unambiguously verified; checking to determine if the client is recognized by said computer; retrieving an access control rule to apply to the communication session with said client during which directory services is provided to said client; and applying said access control rule to the communications session with said client.
Claim 11
Dependent Claim
26 words
A method according to claim 5, further including the step of accessing information related to the degree of trust which may be associated with said client.
Claim 12
Independent Claim
164 words
A method for providing secure communications between a client at a first workstation coupled to a network including a plurality of computers, each of said plurality of computers including a directory server and an associated data base, comprising the steps of: transmitting from said first workstation to a first computer of said plurality of computers a request from said user for at least one of information and services, said request uniquely identifying said client; checking by the first computer's directory server, the associated data base at said first computer to determine if the client is recognized by said first computer; checking by the second computer's directory server, the associated data base at said second computer coupled to said network, to determine if the client is recognized; and retrieving from said second computer, if the client is recognized, an access control rule to apply to the communication session with said client during which at least one of information and services is provided to said client.
Claim 13
Independent Claim
164 words
A method for providing secure communications between a client at a first workstation coupled to a network including a plurality of computers, each of said plurality of computers including a directory server and an associated data base, comprising the steps of: transmitting from said first workstation to a first computer of said plurality of computers a request from said user for at least one of information and services, said request uniquely identifying said client; checking by the first computer's directory server, the associated data base at said first computer to determine if the client is recognized by said first computer; checking by the second computer's directory server, the associated data base at said second computer coupled to said network, to determine if the client is recognized; and retrieving from said second computer, if the client is recognized, an access control rule to apply to the communication session with said client during which at least one of information and services is provided to said client.
Claim 14
Dependent Claim
24 words
A method according to claim 7, further including the step of accessing trust related information from the internal data base of said second computer.
Claim 15
Dependent Claim
33 words
A method according to claim 8, further including the step of applying the trust related information and the access control rule to the client's request to ensure that authorization levels are not exceeded.
Claim 16
Dependent Claim
22 words
A method according to claim 7, wherein said request is a request for an electronic business transaction transmitted to a web site.
Claim 17
Dependent Claim
34 words
A method according to claim 7, wherein the request is a request for a business transaction and wherein the server which recognizes the client develops transaction parameters in the context of the parties involved.
Claim 18
Dependent Claim
22 words
A method according to claim 7, wherein said transmitting step includes the step of uniquely identifying the client via a digital certificate.
Claim 19
Dependent Claim
24 words
A method according to claim 7, wherein said transmitting includes the step of transmitting data uniquely identifying the client including the client's public key.
Claim 20
Dependent Claim
41 words
A method according to claim 7, wherein said step of checking by said first computer's directory server includes the step of checking to determine if the public key of an identified certifying party is stored in said associated internal data base.
Claim 21
Dependent Claim
32 words
A method according to claim 7, further including the step of applying said access control rules to permit the client to access said directory only in accordance with said access control rules.
Claim 22
Dependent Claim
48 words
A method according to claim 7, wherein said client requests access to a web site via said request and further including the step of applying said access control rules to permit the client to perform operations at said web site only in accordance with said access control rules.
Claim 23
Independent Claim
127 words
A method for providing secure directory services communications between a client at a first workstation and a computer having a directory server comprising the steps of: transmitting from a client's workstation a request for directory services to said computer said request from said client including at least one of information and services, said request including a digital certificate for uniquely establishing that said client has a known identity which can subsequently be unambiguously verified; verifying by said directory server the authorization for the server to comply with the request based upon at least one digital certificate and information related to the request context; and retrieving an access control rule to apply to the communication session with said client during which directory services is provided to said client.
Claim 24
Independent Claim
127 words
A method for providing secure directory services communications between a client at a first workstation and a computer having a directory server comprising the steps of: transmitting from a client's workstation a request for directory services to said computer said request from said client including at least one of information and services, said request including a digital certificate for uniquely establishing that said client has a known identity which can subsequently be unambiguously verified; verifying by said directory server the authorization for the server to comply with the request based upon at least one digital certificate and information related to the request context; and retrieving an access control rule to apply to the communication session with said client during which directory services is provided to said client.
Claim 25
Dependent Claim
23 words
A method according to claim 17, further including the step of applying said access control rule to the communications session with said client.
Claim 26
Dependent Claim
14 words
A method according to claim 17, wherein said request includes the client's public key.
Claim 27
Dependent Claim
43 words
A method according to claim 17, wherein said computer includes an internal data base and wherein said step of verifying includes the step of checking to determine if the public key of an identified certifying party is stored in said internal data base.
Claim 28
Dependent Claim
41 words
A method according to claim 18, wherein said computer includes a directory and wherein said step of applying said access control rules includes the step of permitting the client to access said directory only in accordance with said access control rules.
Claim 29
Dependent Claim
50 words
A method according to claim 18, wherein said client requests access to a web site via said request and wherein said step of applying said access control rules includes the step of permitting the client to perform operations at said web site only in accordance with said access control rules.
Claim 30
Dependent Claim
26 words
A method according to claim 17, further including the step of accessing information related to the degree of trust which may be associated with said client.
Claim 31
Dependent Claim
164 words
Apparatus for providing secure directory services while responding to a request for information or services by a client at a first workstation comprising: a secure communications input module for receiving from said client's workstation a request for directory services including at least one of information and services, said request including a digital certificate for uniquely establishing that said client has a known identity which can subsequently be unambiguously verified; a directory server module for responding to said request; and a database for storing information indicative of the public key of the issuer of the client's digital certificate and for storing access control rules to apply to requests; said directory server module being operable to verify the authorization for the server to comply with the request based upon at least one digital certificate and information related to the request context and for retrieving an access control rule to apply to the communication session with said client during which directory services are provided to said client.
Claim 32
Dependent Claim
164 words
Apparatus for providing secure directory services while responding to a request for information or services by a client at a first workstation comprising: a secure communications input module for receiving from said client's workstation a request for directory services including at least one of information and services, said request including a digital certificate for uniquely establishing that said client has a known identity which can subsequently be unambiguously verified; a directory server module for responding to said request; and a database for storing information indicative of the public key of the issuer of the client's digital certificate and for storing access control rules to apply to requests; said directory server module being operable to verify the authorization for the server to comply with the request based upon at least one digital certificate and information related to the request context and for retrieving an access control rule to apply to the communication session with said client during which directory services are provided to said client.
Claim 33
Dependent Claim
27 words
Apparatus according to claim 24, wherein said directory server module to operable to apply said access control rule is applied to the communications session with said client.
References Cited (Backward Citations)
US4405829A
Cited
US4864494A
Cited
US5214702A
Cited
US5138712A
Cited
US5586260A
Cited
US5572673A
Cited
US5604490A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-07-12 | 2003-01-11 | 2003-07-13 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-07-12 | 2007-01-11 | 2007-07-13 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-07-12 | 2011-01-11 | 2011-07-13 | $7700.00 | Window Closed / Lapsed |