Certificate authority
AssigneeNokia Solutions and Networks Oy
InventorsRobert Seidl, Norbert Goetze, Markus Bauer-Hermann
Life of this patent
Estimating the term…
Abstract
A protocol for issuing and controlling digital certificates is described in which an identity management system is used to identify a user requesting a digital certificate and is also used to issue the digital certificate itself. Accordingly, an IDM-based PKI system is provided.
Claims9
A method for provisioning user certificates in a system comprising a user-controlled client, comprising:
- generating, by a client, a public and private key pair for a user;
- generating, by the client on behalf of the user, a certificate signing request using the public and private key pair,
- wherein the certificate signing request comprises zero or more attributes selected by the user, at least one attribute that does not require input from the user, and the public key of the user;
- sending, by the client, the certificate signing request to an identity management system connected to a database containing the attributes of the user;
- and
- receiving a digital certificate from the identity management system in response to the certificate signing request.
An apparatus, comprising:
- at least one processor;
- and
- at least one memory comprising computer program code,
- the at least one memory and computer program code configured, with the at least one processor, to cause the apparatus at least to
- generate a public and private key pair for a user;
- generate, on behalf of the user, a certificate signing request using the public and private key pair,
- wherein the certificate signing request comprises zero or more attributes selected by the user, at least one attribute that does not require input from the user, and the public key of the user;
- send the certificate signing request to an identity management system connected to a database containing the attributes of the user;
- and
- receive a digital certificate from the identity management system in response to the certificate signing request.
A computer program product embodied on a non-transitory computer-readable medium, the computer program product configured to control a processor to perform operations, comprising:
- generating, by a client, a public and private key pair for a user;
- generating, by the client on behalf of the user, a certificate signing request using the public and private key pair,
- wherein the certificate signing request comprises zero or more attributes selected by the user, at least one attribute that does not require input from the user, and the public key of the user;
- sending, by the client, the certificate signing request to an identity management system connected to a database containing the attributes of the user;
- and
- receiving a digital certificate from the identity management system in response to the certificate signing request.
Dependencies are inferred from the claim text.