Patent US5632873A successfully refreshed from Google Patents.
Patent US6301658B1 successfully refreshed from Google Patents.
US6301658B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and system for authenticating digital certificates issued by an authentication hierarchy
Assignee: McAfee LLC
•
Filing: 1998-09-09
•
Granted: 2001-10-09
•
Expires: 2018-09-09
Abstract
Abstract A method and system for efficiently authenticating digital certificates issued by an organization's authentication hierarchy. The system includes a verification server that manages a certificate repository and a verification cache having entries for verified digital certificates and certification revocation lists. Each cache entry includes a corresponding timestamp that indicates when the item was last authenticated. The verification server incrementally updates the verification cache using a recursive procedure to traverse the hierarchy's chain of authority signatures. The procedure performs costly verifications of digital signatures and scans of certification revocation lists only when an item's timestamp is out of date with respect to its issuer's digital certificate, certification revocation list or other security information.
Inventors
- 👤 Stephen C. Koehler
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-09 06:31
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/33; G06F2221/00; G06F2221/21; G06F2221/2151
Claims Analysis
Total Claims: 27
Claim 1
Independent Claim
133 words
A method for authenticating a user digital certificate issued by a certification authority (CA) belonging to a hierarchy of certification authorities (CA's) having a root CA, wherein each CA of the hierarchy except the root CA has a corresponding digital certificate from a parent CA of the hierarchy, the method comprising the steps of: providing a cache having entries for previously authenticated digital certificates, wherein each entry has a timestamp; traversing the hierarchy of CA's to determine a chain of parent CA's from the CA that issued the user digital certificate to the root CA; and marking the user digital certificate as authentic as a function of timestamp of a cache entry for the user digital certificate and the timestamps of cache entries for digital certificates of each CA of the determined chain.
Claim 2
Independent Claim
133 words
A method for authenticating a user digital certificate issued by a certification authority (CA) belonging to a hierarchy of certification authorities (CA's) having a root CA, wherein each CA of the hierarchy except the root CA has a corresponding digital certificate from a parent CA of the hierarchy, the method comprising the steps of: providing a cache having entries for previously authenticated digital certificates, wherein each entry has a timestamp; traversing the hierarchy of CA's to determine a chain of parent CA's from the CA that issued the user digital certificate to the root CA; and marking the user digital certificate as authentic as a function of timestamp of a cache entry for the user digital certificate and the timestamps of cache entries for digital certificates of each CA of the determined chain.
Claim 3
Dependent Claim
64 words
The method of claim 1 , wherein the marking step includes the steps of: authenticating the digital signature of the user digital certificate when a timestamp of the respective cache entry is older than a timestamp of the issuing CA; and updating the timestamp of the cache entry for the user digital certificate when the digital signature of the user digital certificate is authenticated.
Claim 4
Dependent Claim
80 words
The method of claim 2 , wherein the marking step includes the steps of: authenticating the digital signature of the digital certificate of each CA of the determined chain when a timestamp of the corresponding cache entry is older than a timestamp of the cache entry for the corresponding parent CA; and updating the timestamp of the corresponding cache entry of each CA of the determined chain when the digital signature of the digital certificate of each CA is authenticated.
Claim 5
Dependent Claim
28 words
The method of claim 2 , wherein the authenticating step includes the step of verifying the digital signature of the user digital certificate using a corresponding public key.
Claim 6
Dependent Claim
27 words
The method of claim 3 , wherein the authenticating step includes verifying the digital signature of each CA of the determined chain using a corresponding public key.
Claim 7
Dependent Claim
65 words
The method of claim 1 , wherein the verification cache has entries for certificate revocation lists (CRL's), and further wherein the marking step includes searching a CRL published by the CA issuing the user digital certificate when a timestamp of a cache entry for the CRL of the issuing CA is more recent than the timestamp of the cache entry for the user digital certificate.
Claim 8
Dependent Claim
67 words
The method of claim 1 , wherein the verification cache has entries for certificate revocation lists (CRL's), and further wherein the marking step includes searching a CRL published by the corresponding parent CA of each CA of the determined chain when a timestamp of a cache entry for the CRL is more recent than the timestamp of the cached entry for the digital certificate of the CA.
Claim 9
Independent Claim
138 words
A system for authenticating a user digital certificate issued by a certification authority (CA) belonging to a hierarchy of certification authorities (CA's) having a root CA, wherein each CA of the hierarchy except the root CA has a corresponding digital certificate from a parent CA of the hierarchy, the system comprising: a verification cache having a plurality of cache entries, wherein each cache entry corresponds to a digital certificate, and further wherein each cache entry has a timestamp indicating when a digital signature of the corresponding digital certificate was authenticated; and a verification server for authenticating the user digital certificate based on a comparison of the timestamp of a cache entry for the user digital certificate with timestamps of cache entries for each CA of a chain of parent CA's linking the issuing CA to the root CA.
Claim 10
Independent Claim
138 words
A system for authenticating a user digital certificate issued by a certification authority (CA) belonging to a hierarchy of certification authorities (CA's) having a root CA, wherein each CA of the hierarchy except the root CA has a corresponding digital certificate from a parent CA of the hierarchy, the system comprising: a verification cache having a plurality of cache entries, wherein each cache entry corresponds to a digital certificate, and further wherein each cache entry has a timestamp indicating when a digital signature of the corresponding digital certificate was authenticated; and a verification server for authenticating the user digital certificate based on a comparison of the timestamp of a cache entry for the user digital certificate with timestamps of cache entries for each CA of a chain of parent CA's linking the issuing CA to the root CA.
Claim 11
Dependent Claim
36 words
The system of claim 8 , wherein the verification server authenticates the digital signature of the user digital certificate when a timestamp of the respective cache entry is older than a timestamp of the issuing CA.
Claim 12
Dependent Claim
46 words
The system of claim 9 , wherein the verification server authenticates the digital signature of the digital certificate of each CA of the chain when a timestamp of the corresponding cache entry is older than a timestamp of the cache entry for the corresponding parent CA.
Claim 13
Dependent Claim
24 words
The system of claim 9 , wherein the verification server verifies the digital signature of the user digital certificate using a corresponding public key.
Claim 14
Dependent Claim
26 words
The system of claim 10 , wherein the verification server verifies the digital signature of each CA of the determined chain using a corresponding public key.
Claim 15
Dependent Claim
60 words
The system of claim 8 , wherein the verification cache has entries for certificate revocation lists (CRL's), and further wherein the verification server searches a CRL published by the CA issuing the user digital certificate when a timestamp of a cache entry for the CRL is more recent than the timestamp of the cache entry for the user digital certificate.
Claim 16
Dependent Claim
67 words
The system of claim 8 , wherein the cache has entries for certificate revocation lists (CRL's), and further wherein the verification server searches a CRL published by the corresponding parent CA of each CA of the chain when a timestamp of a cache entry for the CRL is more recent than the timestamp of the cached entry for the digital certificate of the CA of the chain.
Claim 17
Independent Claim
223 words
A system for processing client requests to authenticate user digital certificates issued by a certification authority (CA) of a hierarchy of certification authorities (CA's) having a root CA, wherein each CA of the hierarchy except the root CA has a corresponding digital certificate from a parent CA of the hierarchy, the system comprising: a verification cache having a plurality of cache entries, wherein each cache entry corresponds to a verified digital certificate, and further wherein each cache entry has a timestamp indicating when a digital signature of the corresponding digital certificate was authenticated; and a verification server executing a software program for performing the steps of: accessing the verification cache to retrieve a cache entry for a digital certificate of the CA issuing the user digital certificate; authenticating the digital certificate of the issuing CA as a function of cache entries for each CA of a chain of parent CA's from the issuing CA to the root CA; updating the timestamp of the cache entry for the digital certificate of the issuing CA when the digital certificate of the issuing CA is authenticated; and responding that the user digital certificate is authentic when the timestamp of the cache entry for the user digital certificate is more recent than the timestamp of the cache entry corresponding to the digital certificate of the issuing CA.
Claim 18
Independent Claim
223 words
A system for processing client requests to authenticate user digital certificates issued by a certification authority (CA) of a hierarchy of certification authorities (CA's) having a root CA, wherein each CA of the hierarchy except the root CA has a corresponding digital certificate from a parent CA of the hierarchy, the system comprising: a verification cache having a plurality of cache entries, wherein each cache entry corresponds to a verified digital certificate, and further wherein each cache entry has a timestamp indicating when a digital signature of the corresponding digital certificate was authenticated; and a verification server executing a software program for performing the steps of: accessing the verification cache to retrieve a cache entry for a digital certificate of the CA issuing the user digital certificate; authenticating the digital certificate of the issuing CA as a function of cache entries for each CA of a chain of parent CA's from the issuing CA to the root CA; updating the timestamp of the cache entry for the digital certificate of the issuing CA when the digital certificate of the issuing CA is authenticated; and responding that the user digital certificate is authentic when the timestamp of the cache entry for the user digital certificate is more recent than the timestamp of the cache entry corresponding to the digital certificate of the issuing CA.
Claim 19
Dependent Claim
27 words
The system of claim 15 , wherein the software program invokes a recursive subroutine to authenticate the digital certificate of each CA of the chain of CA's.
Claim 20
Dependent Claim
64 words
The system of claim 15 wherein the responding step of the software program includes: validating the digital signature of the user digital certificate when a timestamp of the respective cache entry is older than a timestamp of the issuing CA; and updating the timestamp of the cache entry for the user digital certificate when the digital signature of the user digital certificate is authenticated.
Claim 21
Dependent Claim
78 words
The system of claim 15 , wherein the of the software program authenticates the issuing CA by: validating the digital signature of the digital certificate of each CA of the chain when a timestamp of the corresponding cache entry is older than a timestamp of the cache entry for the corresponding parent CA; and updating the timestamp of the corresponding cache entry when the digital signature of the digital certificate of each CA of the chain is authenticated.
Claim 22
Dependent Claim
29 words
The system of claim 17 , wherein the validating step of the software program includes verifying the digital signature of the user digital certificate using a corresponding public key.
Claim 23
Dependent Claim
30 words
The system of claim 18 , wherein the authenticating step of the software program includes verifying the digital signature of each CA of the chain using a corresponding public key.
Claim 24
Dependent Claim
61 words
The system of claim 15 , wherein the verification cache has entries for certificate revocation lists (CRL's), and further wherein the responding step of the software program includes searching a CRL published by the issuing CA when a timestamp of a cache entry for the CRL is more recent than the timestamp of the cache entry for the user digital certificate.
Claim 25
Independent Claim
112 words
A method for maintaining a cache having entries for previously authenticated digital certificates issued by a certification authority (CA) belonging to a hierarchy of CA's, wherein each CA of the hierarchy except a root CA has a corresponding digital certificate issued by a parent CA of the hierarchy, the method comprising the steps of: authenticating a digital signature of the digital certificate of one of the CA's when a timestamp of the corresponding cache entry is older than a timestamp of the cache entry for the digital certificate of the corresponding parent CA; and updating the timestamp of the cache entry for the authenticated digital certificate when the digital signature is authenticated.
Claim 26
Independent Claim
112 words
A method for maintaining a cache having entries for previously authenticated digital certificates issued by a certification authority (CA) belonging to a hierarchy of CA's, wherein each CA of the hierarchy except a root CA has a corresponding digital certificate issued by a parent CA of the hierarchy, the method comprising the steps of: authenticating a digital signature of the digital certificate of one of the CA's when a timestamp of the corresponding cache entry is older than a timestamp of the cache entry for the digital certificate of the corresponding parent CA; and updating the timestamp of the cache entry for the authenticated digital certificate when the digital signature is authenticated.
Claim 27
Dependent Claim
61 words
The method of claim 22 , wherein the cache has cache entries for certificate revocation lists (CRL's) and the authenticating step includes searching a CRL published by the corresponding parent CA when a timestamp of a cache entry for the CRL is more recent than the timestamp of the cache entry for the digital certificate of the CA to be authenticated.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-10-08 | 2005-04-09 | 2005-10-09 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-10-08 | 2009-04-09 | 2009-10-09 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-10-08 | 2013-04-09 | 2013-10-09 | $7700.00 | Window Closed / Lapsed |