Customizable certificate validation policy

Patent metadata

Field	Value
Publication number	US-11973805-B2
Application number	US-202117459896-A
Country	US
Kind code	B2
Filing date	Aug 27, 2021
Priority date	Jan 20, 2021
Publication date	Apr 30, 2024
Grant date	Apr 30, 2024

Abstract

Specifications of digital certificate validation security policies for a server within an intranet environment are received. A first one of the policies is specified to be applied for an intranet network connection and a second for a network connection outside the intranet. Each of the first and second policies includes a plurality of different configurable individual settings to enable or disable corresponding individual components of a plurality of different component digital certificate validation checks. A determination is made to establish a connection with a network destination and a digital certificate from the destination is received. One of the policies to apply for the connection is identified. For each of the plurality of the different component checks, a determination is made based on the identified policy whether to perform the component check for the received certificate. Any of the plurality of the different component checks determined to be performed are performed.

First claim

What is claimed is:

1. A method, comprising:
receiving specifications of digital certificate validation security policies for a server within an intranet environment, where a first one of the digital certificate validation security policies is specified to be applied for a network connection within the intranet environment and a second one of the digital certificate validation security policies is specified to be applied for a network connection to a destination outside the intranet environment, and each of the first and second digital certificate validation security policies includes a plurality of different configurable individual settings to enable or disable corresponding individual components of a plurality of different component digital certificate validation checks including a first individually configurable setting included in the plurality of different configurable individual settings to enable or disable a hostname validation check and a second individually configurable setting included in the plurality of different configurable individual settings to enable or disable a certificate chain validation check;
determining to establish a connection with a network destination;
receiving a digital certificate from the network destination;
identifying at least one of the digital certificate validation security policies to apply for the connection;
for each of the plurality of different component digital certificate validation checks, determining based on the identified digital certificate validation security policy for the connection whether to perform the component digital certificate validation check for the received digital certificate; and
performing any of the plurality of different component digital certificate validation checks determined to be performed.

2. The method of claim 1 , wherein versions of the specifications of the digital certificate validation security policies are stored in a cloud-based datastore and provided to the server within the intranet environment.

3. The method of claim 2 , wherein the cloud-based datastore is utilized by a cloud-based application service, and wherein the cloud-based application service provides a graphical user interface for configuring the specifications of the digital certificate validation security policies.

4. The method of claim 3 , further comprising updating the specifications of the digital certificate validation security policies for the server within the intranet environment based on an update to the versions of the specifications of the digital certificate validation security policies stored in the cloud-based datastore.

5. The method of claim 3 , wherein the specifications of the digital certificate validation security policies for the server within the intranet environment specify a third one of the digital certificate validation security policies to be applied for a network connection to the cloud-based application service.

6. The method of claim 5 , wherein the specifications of the digital certificate validation security policies for the server within the intranet environment specify a fourth one of the digital certificate validation security policies to be applied for a network connection to an external application service different from the cloud-based application service.

7. The method of claim 6 , wherein the first and fourth digital certificate validation security policies each specify a different group of network endpoints.

8. The method of claim 6 , wherein the second and fourth digital certificate validation security policies each specify a different group of network endpoints.

9. The method of claim 3 , wherein the specifications of the digital certificate validation security policies for the server within the intranet environment specify a third one of the digital certificate validation security policies to be applied for a second network connection to a second destination outside the intranet environment, and the third one of the digital certificate validation security policies specifies a fallback digital certificate validation security policy.

10. The method of claim 3 , wherein the specifications of the digital certificate validation security policies for the server within the intranet environment specify a third one of the digital certificate validation security policies, the third one of the digital certificate validation security policies specifying a fallback digital certificate validation security policy, and wherein the fallback digital certificate validation security policy corresponds to the second one of the digital certificate validation security policies.

11. A system, comprising:
one or more processors;
a network communication interface, wherein the network communication interface is connected to an intranet environment; and
a memory coupled to the one or more processors, wherein the memory is configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
receive specifications of digital certificate validation security policies, where a first one of the digital certificate validation security policies is specified to be applied for a network connection within the intranet environment and a second one of the digital certificate validation security policies is specified to be applied for a network connection to a destination outside the intranet environment, and each of the first and second digital certificate validation security policies includes a plurality of different configurable individual settings to enable or disable corresponding individual components of a plurality of different component digital certificate validation checks including a first individually configurable setting included in the plurality of different configurable individual settings to enable or disable a hostname validation check and a second individually configurable setting included in the plurality of different configurable individual settings to enable or disable a certificate chain validation check;
determine to establish a connection with a network destination;
receive a digital certificate from the network destination;
identify at least one of the digital certificate validation security policies to apply for the connection;
for each of the plurality of different component digital certificate validation checks, determine based on the identified digital certificate validation security policy for the connection whether to perform the component digital certificate validation check for the received digital certificate; and
perform any of the plurality of different component digital certificate validation checks determined to be performed.

12. The system of claim 11 , wherein versions of the specifications of the digital certificate validation security policies are stored in a cloud-based datastore.

13. The system of claim 12 , wherein the cloud-based datastore is utilized by a cloud-based application service, and wherein the cloud-based application service provides a graphical user interface for configuring the specifications of the digital certificate validation security policies.

14. The system of claim 13 , wherein the memory is further configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
update the specifications of the digital certificate validation security policies based on an update to the versions of the specifications of the digital certificate validation security policies stored in the cloud-based datastore.

15. The system of claim 13 wherein the specifications of the digital certificate validation secur

Assignees

• Servicenow Inc

Inventors

• Phan Thanh Trac
• Ramamohan Bhargav
• Stentiford Gary
• Fong Michael
• Marquardt Matthew M
• Sandoval Jennifer Luna

Classifications

• H04L9/3265 Primary

  using certificate chains, trees or paths; Hierarchical trust model · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L63/205 Primary

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title