Processing a certificate signing request in a dispersed storage network

Patent metadata

Field	Value
Publication number	US-9785491-B2
Application number	US-201213588286-A
Country	US
Kind code	B2
Filing date	Aug 17, 2012
Priority date	Oct 4, 2011
Publication date	Oct 10, 2017
Grant date	Oct 10, 2017

Abstract

A method begins by a requesting device transmitting a certificate signing request to a managing unit, wherein the certificate signing request includes fixed certificate information and suggested certificate information. The method continues with the managing unit forwarding the certificate signing request to a certificate authority and receiving a signed certificate from the certificate authority, wherein the signed certificate includes a certificate and a certification signature and wherein the certificate includes the fixed certificate information and determined certificate information based on the suggested certificate information. The method continues with the managing unit interpreting the fixed certificate information of the signed certificate to identify the requesting device and forwarding the signed certificate to the identified requesting device.

First claim

What is claimed is:

1. A method comprises:
receiving, by a requesting device from a managing unit, certificate information to initiate a digital certification acquisition sequence;
determining by the requesting device to initiate digital certification and generating a certificate signing request based on the certificate information;
transmitting, by the requesting device, the certificate signing request to the managing unit, wherein the certificate signing request includes fixed certificate information, suggested certificate information, and at least some of the certificate information received from the managing unit;
forwarding, by the managing unit, the certificate signing request to a certificate authority;
receiving, by the managing unit, a signed certificate from the certificate authority, wherein the signed certificate includes a certificate and a certification signature and wherein the certificate includes the fixed certificate information and determined certificate information that is at least partially different from the suggested certificate information;
interpreting, by the managing unit, the fixed certificate information of the signed certificate to identify the requesting device to generate an identified requesting device;
validating, by the managing unit, the signed certificate for the identified requesting device based on, at least in part, the determined certificate information; and
forwarding, by the managing unit, the signed certificate to the identified requesting device.

2. The method of claim 1 , wherein the fixed certificate information comprises at least one of:
a public key of the requesting device;
a universal unique identifier (UUID) of the requesting device;
a dispersed storage network (DSN) UUID of a DSN that the requesting device is affiliated with; or
a device type of the requesting device.

3. The method of claim 1 , wherein the suggested certificate information comprises at least one of:
a certificate signing request (CSR) format version;
a serial number of the CSR;
an algorithm identifier (ID) for a signed certificate generation algorithm;
an issuer name of a desired certificate authority;
a requested time validity period;
a subject ID of the requesting device;
a public key algorithm;
an issuer universal unique identifier (UUID) of the desired certificate authority;
a subject UUID of the requesting device;
a dispersed storage network (DSN) UUID of a DSN that the requesting device is affiliated with;
a device type of the requesting device;
requested account permissions for the requesting device; or
requested credential permissions for the requesting device.

4. The method of claim 3 , wherein the determined certificate information comprises at least one of:
or an alternate CSR format;
a new CSR serial number;
an alternate algorithm ID for an alternate signed certificate generation algorithm;
an issuer name of an actual certificate authority that is different from the desired certificate authority;
an alternate time validity period;
a new subject ID for the request device;
an alternate public key algorithm;
a UUID of the actual certificate authority;
a new UUID for the requesting device;
a new DSN UUID of a DSN that the requesting device is to be affiliated with;
a new device type for the requesting device;
determined account permissions for the requesting device that are different from the requested account permissions; or
determined credential permissions for the requesting device that are different from the requested credential permissions.

5. The method of claim 1 further comprises:
receiving, by the managing unit over time, a plurality of certificate signing requests (CSRs) from a plurality of requesting devices, wherein the plurality of CSRs includes the certificate signing request;
temporarily storing, by the managing unit, the plurality of CSRs;
forwarding, by the managing unit, the plurality of CSRs to one or more certificate authorities, which includes the certificate authority;
receiving, by the managing unit over time, a plurality of signed certificates from the one or more certificate authorities;
for each of the plurality of signed certificates, interpreting, by the managing unit, the fixed certificate information to identify a corresponding requesting device of the plurality of requesting devices to generate identified requesting devices;
validating, by the managing unit, each of the plurality of signed certificates for each of the corresponding identified requesting devices of the plurality of requesting devices based on, at least in part, the determined certificate information; and
forwarding, by the managing unit, a signed certificate of the plurality of signed certificates to the identified corresponding requesting device of the plurality of requesting devices.

6. The method of claim 1 , wherein the interpreting the fixed certificate information comprises:
comparing the fixed information of the certificate signing request to the fixed information of the signed certificate; and
when the fixed information of the certificate signing request compares favorably to the fixed information of the signed certificate, accessing a certificate signing request list to identify the requesting device.

7. The method of claim 6 , wherein the certificate signing request list comprises:
the certificate signing request;
an identifier of the requesting device based on the suggested certificate information or assigned by the managing unit; and
an address of the requesting device.

8. A method for execution by a managing unit of a dispersed storage network (DSN), the method comprises:
generating certificate information and transmitting the certificate information to a requesting device to initiate a digital certification acquisition sequence;
determining by the requesting device to initiate digital certification and generating a certificate signing request based on the certificate information;
receiving, from the requesting device, the certificate signing request that includes fixed certificate information, suggested certificate information, and at least some of the certificate information received from the managing unit;
forwarding the certificate signing request to a certificate authority;
receiving a signed certificate from the certificate authority, wherein the signed certificate includes a certificate and a certification signature and wherein the certificate includes the fixed certificate information and determined certificate information that is at least partially different from the suggested certificate information;
interpreting the fixed certificate information of the signed certificate to identify the requesting device to generate an identified requesting device;
validating the signed certificate for the identified requesting device based on, at least in part, the determined certificate information; and
forwarding the signed certificate to the identified requesting device.

9. The method of claim 8 , wherein the fixed certificate information comprises at least one of:
a public key of the requesting device;
a universal unique identifier (UUID) of the requesting device;
a dispersed storage network (DSN) UUID of the DSN that the requesting device is affiliated with; or
a device type of the requesting device.

10. The method of claim 8 , wherein the suggested certificate information comprises at least one of:
a certificate signing request (CSR) format version;
a serial number of the CSR;
an algorithm identifier (ID) for a signed certificate generation algorithm;
an issuer name of a desired certificate authority;
a requested time validity period;
a subject ID of the requesting device

Assignees

• Cilfone Bart
• Leggette Wesley
• Resch Jason K
• Baptist Andrew
• IBM

Inventors

• Cilfone Bart
• Leggette Wesley
• Resch Jason K
• Baptist Andrew

Classifications

• H04L2209/34

  Encoding or coding, e.g. Huffman coding or error correction · CPC title

• H04L9/0863

  involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067) · CPC title

• G06F21/33

  using certificates · CPC title

• H04L2209/04

  Masking or blinding · CPC title

• G06F3/067

  Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS] · CPC title