US6134550A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for use in determining validity of a certificate in a communication system employing trusted paths
Assignee: Entrust Ltd
•
Filing: 1998-03-18
•
Granted: 2000-10-17
•
Expires: 2018-03-18
Abstract
Abstract A method and apparatus constructs a preferred certificate chain, such as a list of all certificate authorities in a shortest trusted path, based on generated certificate chain data, such as a table of trust relationships among certificate issuing units in a community of interest, to facilitate rapid validity determination of the certificate by a requesting unit. In one embodiment, requesting units, such as certificate validation units or subscribers, send queries to a common certificate chain constructing unit. Each query may identify a beginning and target certification authority in the community. The certificate chain constructing unit then automatically determines the certification chain among certification issuing units between the beginning and target certification authorities for each query and provides certificate chain data to the requesting unit. The requesting unit then performs validity determination on the certificate to be validated based on the certificate chain data.
Inventors
- 👤 Paul C. Van Oorschot
- 👤 Michael J. Wiener
- 👤 Ian Curry
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-29 05:23
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/33; G06Q; G06Q20/00; G06Q20/38; G06Q20/382; G06Q20/3821; G06Q20/38215; H; H04; H04L; H04L9/00; H04L9/32; H04L9/3263; H04L9/3265; H04L9/3268; Y; Y10; Y10S; Y10S707/00; Y10S707/99931; Y10S707/99939; Y10S707/99941; Y10S707/99942
Claims Analysis
Total Claims: 43
Claim 1
Independent Claim
81 words
A method for determining validity of a certificate in a communication system employing trusted paths among certificate issuing units and among subscribers comprising: storing certificate chain data associated with a plurality of different subscribers, compiled from certification authority trust data, wherein the certification authority trust data represents trust relationships among various certificate issuing units in a community of interest; and constructing at least one preferred certificate chain based on the stored certificate chain data to facilitate validity determination of the certificate.
Claim 2
Independent Claim
81 words
A method for determining validity of a certificate in a communication system employing trusted paths among certificate issuing units and among subscribers comprising: storing certificate chain data associated with a plurality of different subscribers, compiled from certification authority trust data, wherein the certification authority trust data represents trust relationships among various certificate issuing units in a community of interest; and constructing at least one preferred certificate chain based on the stored certificate chain data to facilitate validity determination of the certificate.
Claim 3
Dependent Claim
55 words
The method of claim 1 wherein the certification authority trust data includes cross-certification data and further includes the step of generating the certificate chain data by analyzing the cross-certification data to derive linked trust relationships among various certificate issuing units to facilitate determination of at least one preferred trust path among selected certificate issuing units.
Claim 4
Dependent Claim
48 words
The method of claim 2 wherein the step of generating includes obtaining certificate revocation data and generating the certificate chain data in response to determining whether a trusted path link exists based on the certificate revocation data from at least one of the plurality of certificate issuing units.
Claim 5
Dependent Claim
32 words
The method of claim 1 further including the step of digitally signing the certificate chain data to assert validity of the certificate chain data for subscribers relying on the certificate chain data.
Claim 6
Dependent Claim
34 words
The method of claim 1 wherein the step of constructing the preferred certificate chain includes generating preferred certificate path response data based on the certificate chain data to effect validity determination of the certificate.
Claim 7
Dependent Claim
30 words
The method of claim 1 including generating a certificate chain query including data representing at least a target certificate issuing unit and receiving the preferred certificate chain in response thereto.
Claim 8
Dependent Claim
16 words
The method of claim 1 wherein the certificate chain data includes certificate issuing unit identification data.
Claim 9
Dependent Claim
42 words
The method of claim 1 including the step of generating the certificate chain data by analyzing stored cross-certification data to derive linked trust relationships among various certificate issuing units to facilitate determination of a shortest trust path among selected certificate issuing units.
Claim 10
Dependent Claim
42 words
The method of claim 1 including storing, for use by a certificate validation unit, the certificate chain data as certificate identification data entries, containing data representing cross-certificates that form the preferred certificate chain to facilitate validation of the certificate to be validated.
Claim 11
Dependent Claim
44 words
The method of claim 1 including storing, for use by a certificate validation unit, the certificate chain data as data representing certificate issuing unit identification data of at least certificate issuing units between an initial certificate issuing unit and a target certificate issuing unit.
Claim 12
Dependent Claim
20 words
The method of claim 1 including receiving a certificate chain query and providing the preferred certificate chain in response thereto.
Claim 13
Dependent Claim
28 words
The method of claim 1 including the step of storing certificate revocation data corresponding to certificate issuing units represented in the preferred certificate chain to facilitate certificate validation.
Claim 14
Independent Claim
59 words
A method for determining validity of a certificate in a communication system comprising: querying, by a requesting unit, to obtain compiled certificate chain data based on cross-certification data among trusted certificate issuing units in a community of interest; and receiving, by the requesting unit, the compiled certificate chain data to facilitate validity determination of the certificate to be validated.
Claim 15
Independent Claim
59 words
A method for determining validity of a certificate in a communication system comprising: querying, by a requesting unit, to obtain compiled certificate chain data based on cross-certification data among trusted certificate issuing units in a community of interest; and receiving, by the requesting unit, the compiled certificate chain data to facilitate validity determination of the certificate to be validated.
Claim 16
Dependent Claim
32 words
The method of claim 13 further including the step of digitally signing the certificate chain data to assert validity of the certificate chain data for subscribers relying on the certificate chain data.
Claim 17
Dependent Claim
26 words
The method of claim 13 wherein the step of querying includes generating a certificate chain query including data representing at least a target certificate issuing unit.
Claim 18
Dependent Claim
46 words
The method of claim 13 including the step of obtaining certificate revocation data and generating the certificate chain data in response to determining whether a trusted path link exists based on the certificate revocation data from at least one of the plurality of certificate issuing units.
Claim 19
Dependent Claim
46 words
The method of claim 16 including storing, for use by the requesting unit, the certificate chain data as certificate identification data entries, containing data representing individual certificates associated with certificate issuing units in the preferred certificate chain to facilitate validation of the certificate to be validated.
Claim 20
Independent Claim
96 words
An apparatus for use in determining validity of a certificate in a communication system employing trusted paths comprising: at least one storage medium having stored therein certificate chain data, compiled from at least certification authority trust data, representing trust relationships among a plurality of certificate issuing units in a community of interest; and at least one certificate chain data constructing unit, operatively coupled to the storage medium that constructs a preferred certificate chain associated with each of a plurality of different subscribers, based on the generated certificate chain data to facilitate validity determination of the certificate.
Claim 21
Independent Claim
96 words
An apparatus for use in determining validity of a certificate in a communication system employing trusted paths comprising: at least one storage medium having stored therein certificate chain data, compiled from at least certification authority trust data, representing trust relationships among a plurality of certificate issuing units in a community of interest; and at least one certificate chain data constructing unit, operatively coupled to the storage medium that constructs a preferred certificate chain associated with each of a plurality of different subscribers, based on the generated certificate chain data to facilitate validity determination of the certificate.
Claim 22
Dependent Claim
29 words
The apparatus of claim 18 including a certificate chain data generator means, operatively coupled to the storage medium, for generating the certificate chain data stored in the storage medium.
Claim 23
Dependent Claim
23 words
The apparatus of claim 19 wherein the certificate chain generator means determines the certificate chain data based on certificate issuing unit cross-certification data.
Claim 24
Dependent Claim
48 words
The apparatus of claim 19 wherein the certificate chain data generator obtains certificate revocation data and generates the certificate chain data in response to determining whether a trusted path link exists based on the certificate revocation data from at least one of the plurality of certificate issuing units.
Claim 25
Dependent Claim
33 words
The apparatus of claim 18 wherein the certificate chain constructing unit digitally signs the certificate chain data to assert validity of the certificate chain data for subscribers relying on the certificate chain data.
Claim 26
Dependent Claim
36 words
The apparatus of claim 18 wherein the certificate chain data constructing unit generates preferred certificate path response data based on the certificate chain data to effect validity determination of the certificate by a certificate validating unit.
Claim 27
Dependent Claim
36 words
The apparatus of claim 18 further comprising certificate validating means for generating a certificate chain query including data representing at least a target certificate issuing unit and for receiving the preferred certificate chain in response thereto.
Claim 28
Dependent Claim
50 words
The apparatus of claim 18 wherein the storage medium stores, for use by a certificate validating unit, the certificate chain data as certificate identification data entries, containing data representing individual certificates associated with certificate issuing units in the preferred certificate chain to facilitate validation of the certificate to be validated.
Claim 29
Dependent Claim
40 words
The apparatus of claim 18 wherein the storage medium stores, for use by a certificate validation unit, the certificate chain data as data representing certificate issuing unit links between an initial certificate issuing unit and a target certificate issuing unit.
Claim 30
Dependent Claim
36 words
The apparatus of claim 18 including means, operatively coupled to the certificate chain constructing unit, for receiving a certificate chain query and wherein the certificate chain constructing unit provides the preferred certificate chain in response thereto.
Claim 31
Dependent Claim
27 words
The apparatus of claim 18 wherein the storage medium contains certificate revocation data corresponding to certificate issuing units in the preferred certificate chain to facilitate certificate validation.
Claim 32
Independent Claim
69 words
A method for determining validity of a certificate in a communication system employing trusted paths among certificate issuing units and among subscribers comprising: storing compiled certificate chain data associated with different subscribers based on compiled certification authority trust data to facilitate validity determination of certificates by multiple subscribers; and providing the stored compiled certificate chain data in response to a request by at least one of the multiple subscribers.
Claim 33
Independent Claim
69 words
A method for determining validity of a certificate in a communication system employing trusted paths among certificate issuing units and among subscribers comprising: storing compiled certificate chain data associated with different subscribers based on compiled certification authority trust data to facilitate validity determination of certificates by multiple subscribers; and providing the stored compiled certificate chain data in response to a request by at least one of the multiple subscribers.
Claim 34
Dependent Claim
32 words
The method of claim 29 wherein the stored compiled certificate chain data is data representing at least one certificate chain and the stored certificate chain data is compiled based on cross-certification data.
Claim 35
Dependent Claim
34 words
The method of claim 29 wherein the stored certificate chain data is data from which a preferred certificate chain may be constructed and the stored certificate chain data is compiled based on cross-certification data.
Claim 36
Dependent Claim
47 words
The method of claim 29 including the step of: compiling certification authority trust data to generate the compiled certificate chain data for a plurality of subscribers wherein the compiled certificate chain data represents trust relationships among a plurality of certificate issuing units in a community of interest.
Claim 37
Dependent Claim
49 words
The method of claim 32 wherein the step of compiling includes obtaining certificate revocation data and generating the compiled certificate chain data in response to determining whether a trusted path link exists based on the certificate revocation data from at least one of the plurality of certificate issuing units.
Claim 38
Dependent Claim
25 words
The method of claim 29 including the step of receiving a certificate chain query and providing the stored compiled certificate chain data in response thereto.
Claim 39
Dependent Claim
25 words
The method of claim 29 including the step of receiving a certificate chain query and providing a response representing whether a target certificate is valid.
Claim 40
Dependent Claim
52 words
The method of claim 29 including the step of compiling, by a certificate issuing unit, the compiled certificate chain data corresponding to certificate issuing units having at least a cross-certification relationship with the certificate issuing unit and wherein the step of storing includes storing the compiled certificate chain data in a directory.
Claim 41
Dependent Claim
102 words
A storage medium for storing programming instructions that, when read by a processing unit, causes the processing unit to facilitate certificate chain data generation, the storage medium comprising: first means for storing programming instructions that facilitate compiling of certification authority trust data to generate certificate chain data associated with a plurality of different subscribers wherein the certificate chain data represents trust relationships among a plurality of certificate issuing units in a community of interest; and second storage means for storing the certificate chain data that is based on compiled certification authority trust data to facilitate validity determination of certificates by multiple subscribers.
Claim 42
Dependent Claim
102 words
A storage medium for storing programming instructions that, when read by a processing unit, causes the processing unit to facilitate certificate chain data generation, the storage medium comprising: first means for storing programming instructions that facilitate compiling of certification authority trust data to generate certificate chain data associated with a plurality of different subscribers wherein the certificate chain data represents trust relationships among a plurality of certificate issuing units in a community of interest; and second storage means for storing the certificate chain data that is based on compiled certification authority trust data to facilitate validity determination of certificates by multiple subscribers.
Claim 43
Dependent Claim
56 words
The storage medium of claim 37 wherein the first storage means further includes programming instructions that facilitate compiling by obtaining certificate revocation data and generating the certificate chain data in response to determining whether a trusted path link exists based on the certificate revocation data from at least one of the plurality of certificate issuing units.
References Cited (Backward Citations)
US5220604A
Cited
US5224163A
Cited
US5315657A
Cited
US5745886A
Cited
US5671280A
Cited
US5666416A
Cited
US5687235A
Cited
US5745574A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-10-17 | 2004-04-17 | 2004-10-17 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-10-17 | 2008-04-17 | 2008-10-17 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-10-17 | 2012-04-17 | 2012-10-17 | $7700.00 | Window Closed / Lapsed |