URL-based certificate in a PKI

Patent metadata

Field	Value
Publication number	US-9813249-B2
Application number	US-201414458971-A
Country	US
Kind code	B2
Filing date	Aug 13, 2014
Priority date	Oct 17, 2001
Publication date	Nov 7, 2017
Grant date	Nov 7, 2017

Abstract

A method of requesting and issuing a certificate from certification authority for use by an initiating correspondent with a registration authority is provided. The initiating correspondent makes a request for a certificate to the registration authority, and the registration authority sends the request to a certificate authority, which issues the certificate to the registration authority. The certificate is stored at a location in a directory and this location is associated with a pointer such as uniform resource locator (URL) that is derived from information contained in the certificate request. The initiating correspondent computes the location using the same information and forwards it to other corespondents. The other correspondents can then locate the certificate to authenticate the public key of the initiating correspondent.

First claim

What is claimed is:

1. A non-transitory computer readable medium for allocating an address to enable publishing of a certificate in an addressable database accessible via a communications network, wherein a location of said database is publicly known within the communications network, said non-transitory computer readable medium comprising computer executable instructions for:
receiving a certificate generation request from a client device via said communications network;
obtaining a certificate locator by applying a mathematical function to information in said certificate generation request, wherein said certificate locator identifies an address within said database at which to store said certificate; and
enabling publishing of said certificate, once issued, in said database at said address within said database, said publishing enabling another device in said communications network to retrieve said certificate using said location of said database and said certificate locator,
said certificate location received by said another device from said client device,
said client device having generated the certificate locator from said certificate generation request in the same manner.

2. The non-transitory computer readable medium according to claim 1 wherein said certificate locator comprises a string which can be mapped to said address within said database.

3. The non-transitory computer readable medium according to claim 2 wherein said string is used as said address in said database.

4. The non-transitory computer readable medium according to claim 2 wherein said string is utilized as a pointer to said address within said database.

5. The non-transitory computer readable medium according to claim 1 wherein said certificate locator is a portion of an output of said mathematical function.

6. The non-transitory computer readable medium according to claim 1 further comprising instructions for a certificate authority to generate said certificate and publish said certificate in said database using said certificate locator.

7. The non-transitory computer readable medium according to claim 1 wherein said certificate locator is obtained from information including a time varying element.

8. A non-transitory computer readable medium associated with a client device for enabling another device in a communications network to reconstruct an address of a certificate published in an addressable database accessible via said communications network, said non-transitory computer readable medium comprising instructions for:
generating a certificate generation request;
sending said certificate generation request to a public key infrastructure for issuing and publishing said certificate, wherein said public key infrastructure processing said certificate generation request obtains a certificate locator by applying a mathematical function to information in said certificate generation request, wherein said certificate locator identifies an address within said database at which said public key infrastructure may publish said certificate;
generating, at the client device, the same certificate locator from said certificate generation request in the same manner; and
forwarding said certificate locator generated by said client device to said another device to enable said another device to retrieve said certificate via said communications network by combining said certificate locator with a location of said database in said communications network.

9. The non-transitory computer readable medium according to claim 8 wherein said certificate locator comprises a string configured for mapping to said address within said database.

10. The non-transitory computer readable medium according to claim 9 wherein said string is to be used as said address in said database.

11. The non-transitory computer readable medium according to claim 9 wherein said string is to be utilized as a pointer to said address within said database.

12. The non-transitory computer readable medium according to claim 8 wherein said certificate locator is a portion of an output of said mathematical function.

13. The non-transitory computer readable medium according to claim 9 wherein said certificate generation request is sent to a registration authority in said public key infrastructure.

14. The non-transitory computer readable medium according to claim 8 wherein said certificate locator is obtained from information including a time varying element.

15. A non-transitory computer readable medium for allocating an address to enable publishing of a certificate in an addressable database accessible via a communications network, wherein a location of said database is publicly known within the communications network, said non-transitory computer readable medium comprising computer executable instructions for:
receiving a certificate generation request from a client device via said communications network;
obtaining a certificate locator by applying a hash function to information in said certificate generation request, wherein said certificate locator identifies an address within said database at which to store said certificate; and
enabling publishing of said certificate, once issued, in said database at said address within said database, said publishing enabling another device in said communications network to retrieve said certificate using said location of said database and said certificate locator,
said certificate location received by said another device from said client device,
said client device having generated the certificate locator from said certificate generation request in the same manner.

16. The non-transitory computer readable medium according to claim 15 wherein said certificate locator comprises a string which can be mapped to said address within said database.

17. The non-transitory computer readable medium according to claim 16 wherein said string is used as said address in said database.

18. The non-transitory computer readable medium according to claim 16 wherein said string is utilized as a pointer to said address within said database.

19. The non-transitory computer readable medium according to claim 15 wherein said certificate locator is a portion of an output of said hash function.

20. The non-transitory computer readable medium according to claim 15 further comprising a certificate authority generating said certificate and publishing said certificate in said database using said certificate locator.

21. The non-transitory computer readable medium according to claim 15 wherein said certificate locator is obtained from information including a time varying element.

22. The non-transitory computer readable medium associated with a client device for enabling another device in a communications network to reconstruct an address of a certificate published in an addressable database accessible via said communications network, said non-transitory computer readable medium comprising computer executable instructions for:
generating a certificate generation request;
sending said certificate generation request to a public key infrastructure for issuing and publishing said certificate, wherein said public key infrastructure processing said certificate generation request obtains a certificate locator by applying a hash function to information in said certificate generation request, wherein said certificate locator identifies an address within said database at which said public key infrastructure may publish said certificate;

Assignees

• Certicom Corp

Inventors

• Fahn Paul Neil
• Semple James

Classifications

• H04L2463/102

  applying security measure for e-commerce · CPC title

• H04L9/3268 Primary

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• H04L63/04

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title