Central cryptographic management for computer systems

Patent metadata

Field	Value
Publication number	US-9954848-B1
Application number	US-201414245600-A
Country	US
Kind code	B1
Filing date	Apr 4, 2014
Priority date	Apr 4, 2014
Publication date	Apr 24, 2018
Grant date	Apr 24, 2018

Abstract

A system implemented on a server computer for managing digital certificates includes a certificate management agent module, a digital certificate processing module and a configuration module. The certificate management agent module processes requests to create a plurality of certificate management agents. Each of the certificate management agents is configured to manage a lifecycle of a digital certificate for a client electronic device. The digital certificate processing module processes requests from the certificate management agent module for digital certificates for the plurality of certificate management agents. The configuration module receives and processes configuration parameters for the certificate management agents and for the digital certificates.

First claim

What is claimed is:

1. A system implemented on a server computer for managing digital certificates, the system comprising:
a computer-readable storage medium encoding instructions; and
a processor programmed to execute the instructions to create:
an agent module, the agent module processing requests to create a plurality of certificate management agents for managing lifecycles of digital certificates, each of the plurality of certificate management agents being configured to manage a lifecycle of a digital certificate for a client electronic device, and at least one of the plurality of certificate management agents being stored on each client electronic device;
a digital certificate processing module, the digital certificate processing module processing requests from the agent module for digital certificates for the plurality of certificate management agents;
a configuration module, the configuration module receiving and processing configuration parameters for the certificate management agents and for the digital certificates; and
an agent manager module configured to add or modify agent groups, wherein each agent group comprises one or more agent managers for managing one or more of the certificate management agents, wherein each agent manager is associated with an assignable authority level, wherein each agent manager is assignable to multiple agent groups, and wherein each agent manager is assignable to different authority levels within different agent groups;
wherein the agent module generates a unique identifier for each of the plurality of certificate management agents when each of the plurality of certificate management agents is created, and wherein the unique identifier is different for each certificate management agent and is based on a respective client electronic device; and
wherein the digital certificate processing module generates a digital certificate on the server computer for the client electronic device based upon configuration information from the configuration module, the configuration module using the unique identifier to identify the configuration information for the client electronic device.

2. The system of claim 1 , wherein the digital certificate processing module provides the configuration information for the digital certificates to a certificate authority and obtains the digital certificates from the certificate authority.

3. The system of claim 1 , wherein the configuration module includes a plurality of configuration templates.

4. The system of claim 1 , wherein the agent manager module is further configured to add or modify configuration management agents for the multiple agent groups.

5. The system of claim 1 , further comprising a scheduler module for scheduling a provisioning of a digital certificate at the client electronic device.

6. The system of claim 1 , further comprising an activity report module for receiving reports regarding a health status of a digital certificate.

7. The system of claim 1 , further comprising a server communication module for establishing a mode of communication between the server computer and a certificate management agent on the client electronic device, wherein the mode of communication is either a push mode or a pull mode, the push mode comprising initiating communications to the client electronic device from the server computer, the pull mode comprising receiving communications at the server computer initiated at the client electronic device.

Assignees

• Wells Fargo Bank Na
• Wells Fargo Bank Na

Inventors

• Stoica Andrei
• Murarka Sumit
• Ridilla Michael Peter
• Sanghvi Samir Rameshchandra
• Pradier Jerome

Classifications

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L29/06775

  Electricity · mapped topic

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/321

  involving a third party or a trusted authority · CPC title