US 2004/0168056 A1 · Revocation of a certificate and exclusion of other principals in a digital rights management (DRM) system based on a revocation list from a delegated revocation authority

Abstract

A digital certificate identifies an entity as having authority over the certificate to revoke same as delegated by the issuer. The certificate also has at least one revocation condition relating to possible revocation of the certificate. To authenticate the certificate, the identification of the delegated revocation authority, a location from which a revocation list is to be obtained, and any freshness requirement to be applied to the revocation list are determined from the certificate. It is then ensured that the revocation list from the location is present and that the present revocation list satisfies the freshness requirement, that the revocation list is promulgated by the delegated revocation authority identified in the certificate, and that the certificate is not identified in the revocation list as being revoked.

Claims22

Dependent claims

A digital certificate for authenticating a corresponding element, the certificate issued by an issuer for being verified by a trusted component of a computing device to authenticate the element, the verification including ensuring that the certificate is not revoked, the certificate comprising:

an identification of an entity as having authority over the certificate to revoke same as delegated by the issuer, the delegated revocation authority revoking the certificate by identifying same in a revocation list;
and
at least one revocation condition relating to possible revocation of the certificate, each revocation condition having to be satisfied when the certificate is employed to authenticate the element.

A method for authenticating a digital certificate for a corresponding element on a computing device, the certificate being issued by an issuer for being authenticated by a trusted component of the computing device to authenticate the element, the method comprising:

determining from the certificate an identification of an entity as having authority over the certificate to revoke same as delegated by the issuer, the delegated revocation authority revoking the certificate by identifying same in a revocation list;
determining from the certificate a location from which the revocation list is to be obtained;
determining from the certificate any freshness requirement to be applied to the revocation list;
ensuring that the revocation list from the location is present and that the present revocation list satisfies the freshness requirement;
ensuring that the present revocation list is promulgated by the delegated revocation authority identified in the certificate;
and
ensuring that the certificate is not identified in the present revocation list as being revoked.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application

10/374,312Filed 26 Feb 2003

Published

26 Aug 2004

Term ends

Not estimatedThe source records don’t support an estimate.

Classification5 codes

G06F 21/10
Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity: protecting distributed…
H04L 9/3268
Involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements: using…
H04L 2209/603
Digital content management, e.g. content distribution: digital right managament [DRM]
G06F
Computing and data processing

Revocation of a certificate and exclusion of other principals in a digital rights management (DRM) system based on a revocation list from a delegated revocation authority

Life of this patent

Revocation of a certificate and exclusion of other principals in a digital rights management (DRM) system based on a revocation list from a delegated revocation authority

Life of this patent

Abstract

Claims22