Using a portable security token to facilitate cross-certification between ceritification authorities

A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for using a portable security token to facilitate cross-certification between a first certification authority (CA) and a second CA, the method comprising:

• using the portable security token to transfer certification information between the first CA and the second CA, wherein the first CA and associated subscriber devices constitute a first public-key infrastructure (PKI) domain, wherein the second CA and associated subscriber devices constitute a second PKI domain, and wherein the portable security token communicates with the first CA and the second CA through a location-limited communication channel;
• using the certification information to issue a cross-certificate to the first CA signed by the second CA;
• and
• propagating the cross-certificate from the first CA to associated subscriber devices in the first PKI domain, thereby allowing the associated subscriber devices in the first PKI domain to authenticate themselves to devices in the second PKI domain.

An apparatus that uses a portable security token to facilitate cross-certification between a first certification authority (CA) and a second CA, comprising:

• a portable security token configured to transfer certification information between the first CA and the second CA, wherein the first CA and associated subscriber devices constitute a first public-key infrastructure (PKI) domain, wherein the second CA and associated subscriber devices constitute a second PKI domain, and wherein the portable security token communicates with the first CA and the second CA through a location-limited communication channel;
• a certificate issuing mechanism configured to use the certification information to issue a cross-certificate to the first CA signed by the second CA;
• and
• a propagation mechanism within the first PKI domain configured to propagate the cross-certificate from the first CA to associated subscriber devices in the first PKI domain, thereby allowing the associated subscriber devices in the first PKI domain to authenticate themselves to devices in the second PKI domain.