# US 2013/0159703 A1 · Utilizing a stapling technique with a server-based certificate validation protocol to reduce overhead for mobile communication devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2013/0159703 A1
- Document ID: US20130159703A1
- Status: Published application
- Kind: A1
- Application number: 13/328,334
- Filed: 2011-12-16
- Published: 2013-06-20
- Earliest claimed: 2011-12-16
- Assignees: Motorola Solutions, Inc.
- Inventors: Erwin Himawan; Anthony R. Metke; Shanthi E. Thomas
- Web page: https://patentgrep.com/patent/US20130159703A1

## CPC

- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A certificate issuer (210) can periodically request, receive, and store current server-based certificate validation protocol (SCVP) staples (225) for supported relying parties (205) from at least one server-based certificate validation protocol (SCVP) responder (215). The certificate issuer (210) can receive a contact initiation request (220) from one of the relying parties (205). Responsive to receiving the contact initiation request (220), the certificate issuer (210) can identify a current SCVP staple from the saved staples that is applicable to the relying party (205). The certificate issuer (210) can conveying a response to the contact initiation request (220) to the relying party (205). The response can comprise the identified SCVP staple and a public key infrastructure (PKI) certificate (230) of the certificate issuer. The SCVP staple can validate a certification path between the PKI certificate (230) and a different certificate trusted by the relying party (205).

## Claims

### Claim 1

A method at relying party for validating a subject certificate comprising:
receiving at a relying party from a subject, a first server-based certificate validation protocol (SCVP) response, wherein the SCVP response is signed by an SCVP server trusted by the subject, wherein the relying party, the subject, and the SCVP server are a set of computing devices communicatively linked to each other via at least one network;
the relying party retrieving a second SCVP response for the SCVP server signed by a SCVP server trusted by the relying party;
the relying party validating the authenticity and integrity of the second SCVP response;
the relying party validating the first SCVP response using information included in the second SCVP response; and
the relying party validating the subject certificate using information included in the first SCVP response.

### Claim 2 (depends on 1)

The method of claim 1, wherein the second SCVP response comprises a SCVP staple for validating a certification path between the subject certificate and a different certificate trusted by the relying party.

### Claim 3 (depends on 1)

The method of claim 1, where the second SCVP response includes constraints found in a certificate chain extending from a trusted authority of the relying party to the SCVP server of the subject.

### Claim 4 (depends on 3)

The method of claim 3, wherein the constraints comprise policy constraints, name constraints, path length constraints, or combinations thereof.

### Claim 5 (depends on 1)

The method of claim 1, wherein the second SCVP response include a certificate of the SCVP server trusted by the subject.

### Claim 6 (depends on 1)

The method of claim 1, wherein the second SCVP response includes policy mapping information found in a certificate chain extending from a trusted authority of the relying party to the SCVP server trusted by the subject.

### Claim 7 (depends on 1)

The method of claim 1, wherein the first SCVP response comprises path length information.

### Claim 8

A method at a server-based validation protocol (SCVP) server for providing certificate validation status information comprising:
receiving a SCVP request from an entity;
determining that a subject of a certificate to be validated is equivalent to that of the entity;
validating a certificate path between the subject of the certificate to be validated and a set of trusted certificates; and
returning a SCVP staple associated with the validated certificate path.

### Claim 9 (depends on 8)

The method of claim 8, wherein the SCVP staple contains a list of trusted certificates for which there is a validated path between the subject and one of the trusted certificates and associated constraints.

### Claim 10 (depends on 8)

The method of claim 8, wherein the SCVP server is a first SCVP server, said method further comprising:
identifying at the first SCVP server, a second SCVP server;
building a certificate path between a trust anchor of the first SCVP server and the second SCVP server and validating the built certificate path; and
when the built certificate path is valid, building a SCVP response for the second SCVP server and signing the built SCVP response.

### Claim 11 (depends on 10)

The method of claim 10, wherein a signing of a built SCVP response comprises providing a digital signature or providing a key-hashing for messaging authentication code (HMAC).

### Claim 12 (depends on 10)

The method of claim 10, wherein a SCVP response comprises constraints contained in certificates along a certificate path between the trust anchor of the first SCVP server and the second SCVP server, wherein the constraints comprise path length constraints, policy constraints, name constraints, or combinations thereof.

### Claim 13 (depends on 10)

The method of claim 10, wherein a SCVP response comprise policy mapping information contained in certificates along a certification path between the trust anchor of the first SCVP server and the second SCVP server.

### Claim 14

A method at a subject that issues a certificate for authenticating with a relying party comprising:
requesting at a subject a server-based certification validation protocol (SCVP) response for a subject certificate from the subject to a SCVP server;
the subject receiving a SCVP response from the SCVP server in response to the requesting;
the subject transmitting the SCVP response to the relying party; and
the subject proving to the relying party that the subject has possession of a public key referred to in the SCVP response, wherein the relying party, the subject, and the SCVP server are a set of computing devices communicatively linked to each other via at least one network.

### Claim 15 (depends on 14)

The method of claim 14, wherein the relying party validates the authenticity and integrity of the SCVP response.

### Claim 16 (depends on 14)

The method of claim 14, wherein the SCVP server builds a certificate path between a trust anchor of the subject and the SCVP server, wherein the SCVP server signs the SCVP response when the built certificate path is valid as determined by the SCVP server.

### Claim 17 (depends on 16)

The method of claim 16, further comprising:
the subject periodically requests, receives and stores current SCVP staples for supporting communication with relying parties, wherein the SCVP response for the subject certificate is one of the SCVP staples;
the subject initiating a contact request to the relying party;
in preparing the contact initiation request, the subject identifying a current SCVP staple from the saved staples that is applicable to the relying party, wherein the transmitted SCVP response comprises the identified SCVP staple, wherein the SCVP staple validates a certification path between the subject certificate and a different certificate trusted by the relying party.

### Claim 18 (depends on 17)

The method of claim 17, wherein the requesting, receiving, and storing of the SCVP staples by the subject reduces message traffic, contact initiation latency, and processing requirements at the relying party over other processes where the subject does not utilize SCVP staples.

### Claim 19 (depends on 17)

The method of claim 17, wherein by the relying party receiving the subject certificate and the SCVP staple from the subject, the relying party needs to only communicate via the contact initiation request in order to receive all the required information for determining that the subject has a valid subject certificate provided by an entity trusted by the relying party.

### Claim 20 (depends on 17)

The method of claim 17, wherein each of the SCVP staples that are stored by the subject comprise status for two or more segments, wherein said two or more segments comprise a local domain segment and one or more remote domain segments, wherein each of the local domain segment and the remote domain segments validates a corresponding portion of an end-to-end certification path.