# US 12,603,789 B2 · Systems and methods for securing interconnecting directories > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,789 B2 - Document ID: US12603789B2 - Status: Granted - Kind: B2 - Application number: 18/367,885 - Filed: 2023-09-13 - Published: 2024-03-14 - Granted: 2026-04-14 - Earliest claimed: 2022-09-14 - Assignees: Vocalink International Limited - Applicants: Vocalink International Limited - Inventors: Boy-Anthony Kühne; Christopher Paul Kendall; David Andrew Bray - Web page: https://patentgrep.com/patent/US12603789B2 ## CPC - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/3247: {involving digital signatures} - H04L 9/40: Network security protocols - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 2209/76: Proxy, i.e. using intermediary entity to perform cryptographic operations - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods are provided for deploying keys in connection with proxy resolution. One example computer-implemented method includes distributing, by a service core computing device, a root certificate signed by a certificate authority and an intermediate certificate, which is signed by a root private key associated with the root certificate, and receiving, from a participant, a signing request for a participant certificate including a participant public key. The method also includes assessing, by the service core computing device, the signing request for the participant certificate and signing, by the service core computing device, the participant certificate with an intermediate public key included in the intermediate certificate. The method then includes disseminating the signed participant certificate to the participant and another participant, whereby the participants on the participant certificate based on the participant certificate being signed by the intermediate public key. ## Claims ### Claim 1 A computer-implemented method comprising: distributing, by a service core computing device, a root certificate signed by a certificate authority and an intermediate certificate, which is signed by a root private key associated with the root certificate, the root certificate having a longer life to expiration than the intermediate certificate; receiving, from a participant, a signing request for a participant certificate, the participant certificate including a participant public key, the participant certificate having a shorter life to expiration than the intermediate certificate; assessing, by the service core computing device, the signing request for the participant certificate, based on ordering of content in the signing request; signing, by the service core computing device, the participant certificate with an intermediate public key included in the intermediate certificate; disseminating the signed participant certificate to the participant and at least one other participant, whereby the at least one other participant trusts a request from the participant, which is signed by a private key of the participant, based on the participant certificate including the public key validating the signed request and the participant certificate being signed by the intermediate public key, which is dependent on the root certificate; receiving, by the service core computing device, a message from the participant; and encrypting data, by the service core computing device, based on the participant certificate of the participant, prior to providing the encrypted data to the participant in response to the message. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the certificate authority is a third party relative to the service core and the participant; and wherein the root certificate includes an indication of the certificate authority. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein assessing the signing request is further based on a channel through which the signing request is received. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein assessing the signing request includes assessing a life to expiration of the participant certificate. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the service core computing device includes an authentication service and a core vault; wherein receiving the signing request includes receiving, by the authentication service, the signing request; and wherein assessing the signing request and signing the participant certificate includes assessing, by the core vault, the signing request and signing, by the core vault, the participant certificate. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising signing the intermediate certificate with the root private key, which forms a key pair with a root public key. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising authenticating a message sender of the message based on the disseminated participant certificate prior to providing the encrypted data to the participant in response to the message. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, further comprising distributing, by the service core computing device, a central certificate signed by an intermediate private key associated with the root certificate. ### Claim 9 A non-transitory computer-readable storage medium comprising executable instructions, which when executed by at least one processor in deploying keys in connection with proxy resolution, cause the at least one processor to: distribute a root certificate signed by a certificate authority and an intermediate certificate, which is signed by a root private key associated with the root certificate, the root certificate having a longer life to expiration than the intermediate certificate; receive, from a participant, a signing request for a participant certificate, the participant certificate including a participant public key, the participant certificate having a shorter life to expiration than the intermediate certificate; assess the signing request for the participant certificate, based on ordering of content in the signing request; sign the participant certificate with an intermediate public key included in the intermediate certificate; and disseminate the signed participant certificate to the participant and at least one other participant, whereby the at least one other participant trusts a request from the participant, which is signed by a private key of the participant, based on the participant certificate including the public key validating the signed request and the participant certificate being signed by the intermediate public key, which is dependent on the root certificate; receive a message from the participant; and encrypt data, based on the participant certificate of the participant, prior to providing the encrypted data to the participant in response to the message. ### Claim 10 (depends on 9) The non-transitory computer-readable storage medium of claim 9, wherein the executable instructions, when executed by the at least one processor to assess the signing request, further cause the at least one processor to: assess a channel through which the signing request is received; and assess a life to expiration of the participant certificate. ### Claim 11 (depends on 9) The non-transitory computer-readable storage medium of claim 9, wherein the executable instructions, when executed by the at least one processor, further cause the at least one processor to sign the intermediate certificate with the root private key, which forms a key pair with a root public key. ### Claim 12 (depends on 9) The non-transitory computer-readable storage medium of claim 9, wherein the executable instructions, when executed by the at least one processor, further cause the at least one processor to authenticate a message sender of the message based on the disseminated participant certificate prior to providing the encrypted data in response to the message. ### Claim 13 (depends on 9) The non-transitory computer-readable storage medium of claim 9, wherein the executable instructions, when executed by the at least one processor, further cause the at least one processor to distribute a central certificate signed by an intermediate private key associated with the root certificate. ### Claim 14 A computer-implemented method comprising: distributing, by a service core computing device, a root certificate signed by a certificate authority and an intermediate certificate, which is signed by a root private key associated with the root certificate, the root certificate having a longer life to expiration than the intermediate certificate; receiving, from a participant, a signing request for a participant certificate, the participant certificate including a participant public key, the participant certificate having a shorter life to expiration than the intermediate certificate; assessing, by the service core computing device, the signing request for the participant certificate, based on ordering of content in the signing request; signing, by the service core computing device, the participant certificate with an intermediate public key included in the intermediate certificate; disseminating the signed participant certificate to the participant and at least one other participant, whereby the at least one other participant trusts a request from the participant, which is signed by a private key of the participant, based on the participant certificate including the public key validating the signed request and the participant certificate being signed by the intermediate public key, which is dependent on the root certificate; receiving, by a computing device of a second participant, a message from the participant; and encrypting data, by the computing device of the second participant, based on the participant certificate of the participant, prior to providing the encrypted data to the participant in response to the message. ### Claim 15 (depends on 14) The computer-implemented method of claim 14, wherein the certificate authority is a third party relative to the service core and the participant; and wherein the root certificate includes an indication of the certificate authority. ### Claim 16 (depends on 14) The computer-implemented method of claim 14, wherein assessing the signing request is further based on a channel through which the signing request is received. ### Claim 17 (depends on 14) The computer-implemented method of claim 14, wherein assessing the signing request includes assessing a life to expiration of the participant certificate. ### Claim 18 (depends on 14) The computer-implemented method of claim 14, further comprising authenticating a message sender of the message based on the disseminated participant certificate prior to providing the encrypted data in response to the message. ### Claim 19 (depends on 14) The computer-implemented method of claim 14, wherein the participant and the second participant are included in different geographic regions.