Conditioned use of certificates

Patent metadata

Field	Value
Publication number	US-9754253-B1
Application number	US-201113305547-A
Country	US
Kind code	B1
Filing date	Nov 28, 2011
Priority date	Nov 28, 2011
Publication date	Sep 5, 2017
Grant date	Sep 5, 2017

Abstract

Identity certificates such as SSL certificates can be issued in such a way that their use can be disabled upon short notice. In one embodiment, private signing information associated with a certificate is used by an infrastructure service on behalf of an entity, without making the private signing information accessible to the entity. In another embodiment, short-term certificates are dynamically issued to an application based on a previous certificate authorization.

First claim

What is claimed is:

1. A method, under control of one or more computing systems configured with executable instructions, comprising:
executing, by the one or more computing systems, a network application on behalf of an entity;
obtaining a certificate that associates a public cryptographic key with the entity, wherein the public cryptographic key corresponds to a private cryptographic key;
storing the private cryptographic key and the certificate for use in conjunction with the network application, wherein the private cryptographic key is inaccessible to the entity;
in response to requests to the network application, determining whether the entity is authorized to use the certificate; and
in response to determining that the entity is authorized to use the certificate, generating responses on behalf of the entity using the private key and delivering the responses and the certificate on behalf of the entity.

2. The method of claim 1 , wherein the determining that the entity is authorized to use the certificate comprises granting authorization for the entity to use the certificate in response to payment of at least one certificate usage fee.

3. The method of claim 1 , wherein the determining that the entity is authorized to use the certificate comprises granting authorization for the entity to use the certificate in response to payment of at least one certificate usage fee, the at least one certificate usage fee being based at least in part on the number of responses generated.

4. The method of claim 1 , wherein generating the responses comprises generating signatures using the private key.

5. The method of claim 1 , wherein the certificate comprises a secure sockets layer (SSL) certificate.

6. A system that provides computing resources for use by entities, comprising:
one or more processors;
computer-readable memory storing instructions that are executable by the one or more processors to perform actions comprising:
authorizing at least one of the entities a first time to use a certificate;
executing applications on behalf of the said at least one of the entities to serve data to application consumers;
in response to receiving a request from said at least one of the entities for the certificate to be served to the application consumers, authorizing said at least one of the entities a second time to use the certificate; and
generating application responses on behalf of said one of the entities using authentication information associated with the certificate, the authentication information including at least a private portion that is inaccessible to said at least one of the entities.

7. The system of claim 6 , the actions further comprising conditioning the generating upon continued authorization for said at least one of the entities to use the certificate.

8. The system of claim 6 , the actions further comprising conditioning the generating upon payment of at least one certificate usage fee.

9. The system of claim 6 , the actions further comprising conditioning the generating upon payment of at least one certificate usage fee, the at least one certificate usage fee being based at least in part on the number of application responses generated.

10. The system of claim 6 , the actions further comprising conditioning the generating upon payment of at least one certificate usage fee, the at least one certificate usage fee being based at least in part on usage of the certificate.

11. The system of claim 6 , wherein generating the application responses comprises generating at least one signature based at least in part on the private portion of the authentication information.

12. The system of claim 6 , the actions further comprising obtaining the certificate from a certification authority.

13. The system of claim 6 , wherein the certificate comprises a secure sockets layer (SSL) certificate.

14. A method, under control of one or more computing systems configured with executable instructions, comprising:
receiving, by the one or more computing systems, an authorization request from a requesting entity for a certificate authorization;
in response to receiving the authorization request, attempting to authorize the requesting entity;
upon authorizing the requesting entity, granting the certificate authorization, wherein the certificate authorization is valid for a first time period;
receiving multiple certificate requests from the requesting entity based at least in part on the certificate authorization; and
in response to receiving one of the certificate requests during the first time period, providing a certificate, the certificate being valid for a second time period that is smaller than the first time period.

15. The method of claim 14 , further comprising charging for each provided certificate that is based on the certificate authorization.

16. The method of claim 14 , further comprising conditioning the providing of the certificate upon continued authorization of the requesting entity.

17. The method of claim 14 , further comprising conditioning the providing of the certificate upon payment by the requesting entity.

18. The method of claim 14 , further comprising conditioning the providing of the certificate upon payment of at least one certificate usage fee, the at least one certificate usage fee being based at least in part on certificate usage.

19. The method of claim 14 , wherein the certificate comprises a secure sockets layer (SSL) certificate.

20. A method, under control of one or more computing systems configured with executable instructions, comprising:
receiving, by the one or more computing systems, an authorization request from a requesting entity for a certificate authorization;
in response to receiving the authorization request, attempting to authorize the requesting entity;
upon authorizing the requesting entity a first time, granting the certificate authorization;
issuing one or more certificates to the entity based at least in part on the certificate authorization; and
conditioning use of the one or more certificates upon authorizing the requesting entity again a subsequent time, after the certificate authorization is granted and after the one or more certificates are issued.

21. The method of claim 20 , wherein the one or more certificates have validity periods that are smaller than a period of the certificate authorization for the entity, and wherein the validity periods begin during the certificate authorization period for the entity.

22. The method of claim 20 , wherein:
the one or more certificates have validity periods that are smaller than an authorization period of the certificate authorization; and
the conditioning comprises performing the issuing upon the continued payment authorization by the requesting entity.

23. The method of claim 20 , wherein:
the one or more certificates have validity periods that are smaller than an authorization period of the certificate authorization; and
the conditioning comprises refusing to authorize the requesting entity again upon failure to receive at least one certificate usage fee.

24. The method of claim 20 , wherein the one or more certificates are associated with private signing information that is inaccessible to the requesting entity, and the method further comprises generating responses on behalf of the requesting entity based at least in part on the private signing information.

25. The method of claim 20 , wherein:
the one or m

Assignees

• Brandwine Eric J
• Amazon Tech Inc

Inventors

• Brandwine Eric J

Classifications

• G06Q20/38215 Primary

  Use of certificates or encrypted proofs of transaction rights · CPC title

• G06Q20/382 Primary

  insuring higher security of transaction · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04L63/166

  at the transport layer · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title