Security System Providing Methodology for Cooperative Enforcement of Security Policies During SSL Sessions

A system for controlling a certificate-based protocol session, the system comprising:

• a security policy indicating conditions under which a client is permitted to participate in a certificate-based protocol session;
• a module that traps an attempt at the client to participate in the certificate-based protocol session, by intercepting a request to retrieve a certificate for authenticating the client;
• a module that determines whether the client complies with the security policy;
• and
• a module that prevents retrieval of said certificate when the client does not comply with the security policy.

An improved method for retrieving certificates for use in certificate-based protocols, the improvement comprising:

• monitoring requests to retrieve certificates at a machine, for ensuring the machine's compliance with a security policy as a prerequisite to certificate retrieval;
• as each given certificate is requested to be retrieved at the machine, determining whether the machine complies with the security policy;
• and
• blocking retrieval of a given requested certificate in instances where the machine violates said security policy.

A system for controlling access to certificates comprising:

• a certificate store for storing certificates on a machine;
• a security policy specifying conditions that the machine must comply with;
• means for monitoring requests for retrieving a certificate from the certificate store;
• means for monitoring compliance of the machine with the security policy;
• and
• means for preventing retrieval of a particular certificate, when the machine does not comply with the security policy.