Patent US6324645B1 successfully refreshed from Google Patents.
US6324645B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Risk management for public key management infrastructure using digital certificates
Assignee: Digicert Inc
•
Filing: 1998-08-11
•
Granted: 2001-11-27
•
Expires: 2018-08-11
Abstract
Abstract A public key management infrastructure ( 104 ) is shared by at least two users ( 102 ). A method ( 300 ) for managing risk arising from a user's use of the shared public key management infrastructure ( 104 ) includes the following steps. The user ( 102 ) is associated (301) with a digital certificate ( 200 ) which is issued and digitally signed by a certification authority (CA). The digital certificate ( 200 ) represents that the user ( 102 ) is bound to a public key ( 210 ) corresponding to a private key held by the user ( 102 ); the public key ( 210 ) and the private key form a key pair for use in public-key cryptography. The digital certificate ( 200 ) further includes an access label ( 216 ), which may identify the domain ( 105 ) within the public key management infrastructure ( 104 ) which the user ( 102 ) is authorized to access and/or the privileges which the user ( 102 ) is authorized to exercise. The user's identity and the validity of the digital certificate ( 200 ) are established ( 303,305 ). The access label ( 216 ) is read ( 304 ) from the user's digital certificate ( 200 ), and the user's use of the public key management infrastructure ( 104 ) is controlled ( 306 ) based upon the access label ( 216 ).
Inventors
- 👤 Richard F Andrews
- 👤 Peter Williams
- 👤 Judy Lin
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 20:05
CPC Classifications
H; H04; H04L; H04L9/00; H04L9/006; H04L9/32; H04L9/3263; H04L2209/00; H04L2209/56
Claims Analysis
Total Claims: 20
Claim 1
Independent Claim
181 words
In a system including a public key management infrastructure shared by at least two groups of users, wherein the public key management infrastructure includes a database of digital certificates issued to the users, a method for managing risk arising from a user's use of the public key management infrastructure, the method comprising: dividing the database into domains, each domain including digital certificates issued to users in one of the groups; receiving a digital certificate for a user, wherein the digital certificate is issued by a CA to the user, the digital certificate represents that the user is bound to a public key corresponding to a private key held by the user, the public key and the private key form a key pair for use in public-key cryptography, the digital certificate includes a domain identifier, and the digital certificate is digitally signed by the CA; establishing a validity of the digital certificate; establishing the user's identity; reading the domain identifier from the user's digital certificate; and permitting the user to access digital certificates included in the domain identified by the domain identifier.
Claim 2
Dependent Claim
181 words
In a system including a public key management infrastructure shared by at least two groups of users, wherein the public key management infrastructure includes a database of digital certificates issued to the users, a method for managing risk arising from a user's use of the public key management infrastructure, the method comprising: dividing the database into domains, each domain including digital certificates issued to users in one of the groups; receiving a digital certificate for a user, wherein the digital certificate is issued by a CA to the user, the digital certificate represents that the user is bound to a public key corresponding to a private key held by the user, the public key and the private key form a key pair for use in public-key cryptography, the digital certificate includes a domain identifier, and the digital certificate is digitally signed by the CA; establishing a validity of the digital certificate; establishing the user's identity; reading the domain identifier from the user's digital certificate; and permitting the user to access digital certificates included in the domain identified by the domain identifier.
Claim 3
Dependent Claim
81 words
The method of claim 1 wherein: the database includes records, each record including information pertaining to a digital certificate; each domain includes records for digital certificates in the domain; each record includes a domain identifier for identifying which domain includes the record; and the step of permitting the user to access the digital certificates includes precluding the user from accessing a record when the domain identifier in the record does not match the domain identifier contained in the user's digital certificate.
Claim 4
Dependent Claim
79 words
The method of claim 1 wherein: the database includes records, each record including information pertaining to a digital certificate; each domain includes records for digital certificates in the domain; each record includes a domain identifier for identifying which domain includes the record; and the step of permitting the user to access the digital certificates includes permitting the user to access a record when the domain identifier in the record matches the domain identifier contained in the user's digital certificate.
Claim 5
Dependent Claim
100 words
The method of claim 1 wherein: the database includes records, each record including information pertaining to a digital certificate; each domain includes records for digital certificates in the domain; each record includes a domain identifier for identifying which domain includes the record; the step of receiving a digital certificate for a user comprises receiving a digital certificate for a PKI administrator; and the step of permitting the user to access the digital certificates includes permitting the PKI administrator to change a record when the domain identifier in the record matches the domain identifier contained in the PKI administrator's digital certificate.
Claim 6
Dependent Claim
41 words
The method of claim 4 wherein: the PKI administrator's digital certificate further includes privileges information; and the step of permitting the user to access the digital certificates includes permitting the PKI administrator to change a record according to the privileges information.
Claim 7
Dependent Claim
20 words
The method of claim 4 further comprising the step of: generating a record of changes made by the PKI administrator.
Claim 8
Dependent Claim
148 words
A computer readable medium for managing risk arising from a user's use of a public key management infrastructure, wherein the public key management infrastructure is shared by at least two groups of users and includes a database of digital certificates issued to users, the computer readable medium storing: a digital certificate issued by a CA to a user, wherein the digital certificate represents that the user is bound to a public key corresponding to a private key held by the user, the public key and the private key form a key pair for use in public-key cryptography, the digital certificate is digitally signed by the CA, and the digital certificate includes: user information pertaining to the user, and a domain identifier which permits the user to access digital certificates included in the domain identified by the domain identifier, wherein the domain includes digital certificates for the user's group.
Claim 9
Dependent Claim
148 words
A computer readable medium for managing risk arising from a user's use of a public key management infrastructure, wherein the public key management infrastructure is shared by at least two groups of users and includes a database of digital certificates issued to users, the computer readable medium storing: a digital certificate issued by a CA to a user, wherein the digital certificate represents that the user is bound to a public key corresponding to a private key held by the user, the public key and the private key form a key pair for use in public-key cryptography, the digital certificate is digitally signed by the CA, and the digital certificate includes: user information pertaining to the user, and a domain identifier which permits the user to access digital certificates included in the domain identified by the domain identifier, wherein the domain includes digital certificates for the user's group.
Claim 10
Dependent Claim
16 words
The computer readable medium of claim 7 wherein: the domain identifier additionally identifies the user's group.
Claim 11
Dependent Claim
18 words
The computer readable medium of claim 7 wherein: the domain identifier includes information that has been one-way hashed.
Claim 12
Dependent Claim
26 words
The computer readable medium of claim 7 wherein: the digital certificate complies with the X.509 format; and the domain identifier is contained in an X.509 extension.
Claim 13
Independent Claim
165 words
A method for managing risk arising from a user's use of a public key management infrastructure, wherein the public key management infrastructure is shared by at least two groups of users and includes a database of digital certificates issued to users, the method comprising: receiving information pertaining to a user; including in a digital certificate user information pertaining to the user, wherein the digital certificate is issued by a CA, the digital certificate represents that the user is bound to a public key corresponding to a private key held by the user, the public key and the private key form a key pair for use in public-key cryptography, and the digital certificate is digitally signed by the CA; determining a domain identifier appropriate for the user, wherein the domain identifier permits the user to access digital certificates included in the domain identified by the domain identifier, and the domain includes digital certificates for the user's group; and including in the digital certificate the domain identifier.
Claim 14
Independent Claim
165 words
A method for managing risk arising from a user's use of a public key management infrastructure, wherein the public key management infrastructure is shared by at least two groups of users and includes a database of digital certificates issued to users, the method comprising: receiving information pertaining to a user; including in a digital certificate user information pertaining to the user, wherein the digital certificate is issued by a CA, the digital certificate represents that the user is bound to a public key corresponding to a private key held by the user, the public key and the private key form a key pair for use in public-key cryptography, and the digital certificate is digitally signed by the CA; determining a domain identifier appropriate for the user, wherein the domain identifier permits the user to access digital certificates included in the domain identified by the domain identifier, and the domain includes digital certificates for the user's group; and including in the digital certificate the domain identifier.
Claim 15
Dependent Claim
35 words
The method of claim 11 wherein: the digital certificate complies with the X.509 format; and the step of including in the digital certificate the domain identifier comprises including the domain identifier in an X.509 extension.
Claim 16
Dependent Claim
44 words
The method of claim 11 wherein: the step of receiving information pertaining to a user comprises receiving information pertaining to the user's group; and the step of determining a domain identifier appropriate for the user comprises determining the domain identifier for the user's group.
Claim 17
Dependent Claim
57 words
The method of claim 13 wherein: the step of receiving information pertaining to the user's group comprises receiving a name of the user's group; and the step of including in the digital certificate a domain identifier comprises: producing a one-way hash of the name of the user's group, and including the one-way hash in the digital certificate.
Claim 18
Independent Claim
164 words
A system comprising: a public key management infrastructure shared by at least two groups of users and including a database of digital certificates issued to users; a security engine coupled to the public key management infrastructure for managing risk arising from shared use of the public key management infrastructure; and a digital certificate accessible by the security engine, wherein the digital certificate is issued by a CA to the user, the digital certificate represents that the user is bound to a public key corresponding to a private key held by the user, the public key and the private key form a key pair for use in public-key cryptography, the digital certificate includes a domain identifier, and the digital certificate is digitally signed by the CA; wherein the security engine establishes the user's identity, validates the user's digital certificate, and permits the user to access digital certificates included in the domain identified by the domain identifier, such domain including digital certificates for the user's group.
Claim 19
Independent Claim
164 words
A system comprising: a public key management infrastructure shared by at least two groups of users and including a database of digital certificates issued to users; a security engine coupled to the public key management infrastructure for managing risk arising from shared use of the public key management infrastructure; and a digital certificate accessible by the security engine, wherein the digital certificate is issued by a CA to the user, the digital certificate represents that the user is bound to a public key corresponding to a private key held by the user, the public key and the private key form a key pair for use in public-key cryptography, the digital certificate includes a domain identifier, and the digital certificate is digitally signed by the CA; wherein the security engine establishes the user's identity, validates the user's digital certificate, and permits the user to access digital certificates included in the domain identified by the domain identifier, such domain including digital certificates for the user's group.
Claim 20
Dependent Claim
69 words
The system of claim 15 wherein: the database includes records, each record containing information pertaining to a digital certificate; each domain includes records for digital certificates in the domain; each record includes a domain identifier for identifying which domain includes the record; and the security engine permits the user to access a record when the domain identifier in the user's digital certificate matches the domain identifier in the record.
References Cited (Backward Citations)
US5546465A
Cited
DE19628261A1
Cited
US5638343A
Cited
US6009173A
Cited
US5920630A
Cited
US6038322A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-11-26 | 2005-05-28 | 2005-11-27 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-11-26 | 2009-05-28 | 2009-11-27 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-11-26 | 2013-05-28 | 2013-11-27 | $7700.00 | Window Closed / Lapsed |